Super User 
Placing your email publicly on a site almost always means instant doom for the Spam folder.
So what do you do so that you can have an email address that is shared with your friends and fellow blog readers but not adulterated by public spammers? One technique found is to change the email address:
foo@bar.com ==> foo[at]bar[dot]com or foo(removethis)@bar.com, and more.
But does this obfuscation really work? That’s exactly what Kyle Cronin asks:
Does email address obfuscation actually work?
The typical rationale is that this kind of obfuscation prevents the email address from being automatically recognized and harvested by spammers. In an age where spammers can beat all but the most diabolical captchas, is this really true? And given how effective modern spam filters are, does it really matter if your email address is harvested?
akira gives us the answer:
Yes, (in a way) email obfuscation works.
He quotes a study that was conducted starting back in 2006. The study took 9 different methods of posting an email out in the public. He then posted them, and waited for one and a half years. Then he collected how much spam was sent to each account. Here is what each method was and how much spam was sent (in order of best method):
- CSS Codirection (0 MB of Spam)
Example:
<span style="unicode-bidi:bidi-override; direction: rtl;"> moc.elpmaxe@zyx </span>
- CSS Display (0MB of Spam)
Example:
xyz<span style="display:none">foo</span>@example.com
- ROT13 Encryption (0MB of Spam)
Example:
klm@rknzcyr.pbz
-
Using AT’s and DOT’s (0.084MB of Spam)
Example:
xyz AT example DOT com
- Building with Javascript (0.144MB of Spam)
Example:
var m = 'xyz'; // you can use any clever method of m += '@'; // creating the string containing the email m += 'example.com'; // and then add it to the DOM (eg,via $('.email).append(m); // jquery) - Replacing ‘@’ and ‘.’ with Entities (1.6MB of Spam)
Example:
xyz@example.com
- Splitting E-Mail with Comments (7.1 MB of Spam)
Example:
xyz<!-- eat this spam --><!-- yeah! -->example<!-- shoo -->com
- Urlencode (7.9MB of Spam)
Example:
xyz%40example.com
- Plain Text (21MB of Spam)
Example:
xyz@example.com
Here’s a graph from the site:
As you can see clearly from the results, obfuscation really does work! You have to do some coding to get it to work fully, but by simply changing the @’s to [AT] and ‘.’s to [DOT] you’ll be pretty safe. Take that you low-life spammers!
Filed under Featured
I am shocked I tell you, shocked! I never would have imagined that using the words ‘at’ and ‘dot’ would work so effectively, considering how incredibly trivial it is to write a regex to catch it. Shocked!
I like how ROT13 works so well, since it looks like a normal, un-obfuscated email address to a dumb bot, so it tries to spam an invalid address (or discards it if it’s smart enough—which we just established that it’s not).
I’m confused by the discrepancy between the effectiveness of the “CSS Display” and “HTML Comments” methods. They are basically the same thing (they look alike when viewing the code), just using different tags, but one works and the other doesn’t? I can only assume that the harvesters are discarding comment tags.
Until bots are able to harvest rendered HTML instead of just the code, I’ll be using the CSS tricks. They are particularly nice because they not only allow the user to view the address without needing to decode it, but also make it simple enough for the author to insert the address with little work, unlike some methods like the JavaScript one.
Shocked.