> My site also has some Windows software downloads on it, and I occasionally get emails for bundling dodgy installers. Most of these tend to be "residential proxy" services looking to sell access to users' internet connections.

I wonder what these people are thinking? Like, TOR operators know the risks with connection sharing - most particularly: pedos using their service to share CSAM. But everyday people?! They have no idea until one day they get v&.

Prey on users who don't know the difference. Sell the residential proxy service to scammers who use high-reputation residential IPs to commit crime or fraud or other shady things.

I think these services are used mainly for scraping sites which try to hide their data (think LinkedIn). They don't offer any protection to those that are breaking the law, afaik. So I would expect that there isn't much risk of putting their victims ("endpoints") in trouble with the law.

Not condoning it of course, it is still an ugly practice.

I've read through some of Brian Krebs' articles on some of these proxies, the ones I get these email offers from seem a little less slimy than that and more above board like you say. It's still not an acceptible thing to be seeling your users out to though.

You just saved me some work, thanks!

I also get these emails but run a WordPress site. I was convinced they would fingerprint websites and mail those to these sites only.

It was on my todo to see if I could hide the fingerprint of WordPress.

But now that you mention this, it's obvious it wouldn't do much. In hindsight, I could have know these spammer would just spam everybody in bulk.

Masking your WordPress install is a pretty good idea for plenty of other reasons though, just hiding wp-login will save you a lot of headache with bots wasting your CPU cycles and bandwidth trying to bruteforce.

Sounds like a challenge to hide the wordpressyness entirely though, it's got a huge surface area.

This is my favorite sort of email that we get about once a month in various forms... their title at the end is hilarious.

---

Subject: Found a security vulnerability on your website.

Hi Team, I am Harris, a security researcher, and I have found a security vulnerability in your website outside a bug bounty program.

I can disclose all the vulnerabilities found and their proper fixes too, to make your website more secure.

Companies I helped have always been generous and helped me back with rewards in amounts they think are appropriate to the issues I have found. If you appreciate my help, I'd be happy to receive a bonus payment via PayPal, Bitcoin, Payoneer, or Bank Transfer.

Waiting for a positive response from your end.

Thanks and Regards,

Harris A

Certified Ethical Hacker

On the off chance you entertain these individuals, it's usually something really dull an automated scanner picked up.

What happens if you don't pay? Or do they expect you to pay up front for essentially a pig in a poke?

The last one I engaged with only mentioned payment after the fact (along with wanting me to hire them to do a full pentest).

I just ignored them and that was it.

I would like to keep a working <email:> tag on my website but doing so seems to attract tons of spam email that goes something like this, or otherwise offers from random web developer conglomerates offering to "better" my website (which I try to keep simple and plain). :/

We run an educational blog for our saas product and we get some legit emails from readers but also a lot of the spam and some of it is scary good.

They feed in so much context that it does appear to be a real person and it ends up wasting a lot of time and honestly it's quite hurtful. We spend a lot of time sharing our stuff and these fake connections are a major turnoff.

Recently we encountered a wave of "awards shortlist" sort of emails written by AI with deep context that will cosider us for award for one easy payment! Except they always forget to tune the topic as we're not running software security service, we cover web scraping.

I feel like AI will kill email communication between strangers. It's getting so exhausting.

This may not be appropriate for your use case, but have you tried rotating the publicly facing email address when you get spam or on an interval? For example [email protected] ([email protected], [email protected], …).

I believe most legitimate visitors send an email shortly after visiting a page with the address while spam emails often have a much longer lead time for new addresses (it takes time to get scraped, put in a database, and then get used).

However this does mean that extended communication on that address and saved addresses will not work well.