Mailbaby’s “Rattle Trap” (reverse spam traps) to identify spam

What is a Spam Trap?

A spam trap is a decoy email address used by internet service providers and security companies to catch and block spammers. Since these addresses are not owned by real people and never sign up for newsletters, any email sent to them is immediately identified as unsolicited spam. This helps organizations flag malicious senders and protect real users from unwanted junk mail. Spam traps recieve email, and while mailbaby does have some spam traps for getting email, we utilize many more reverse traps.

---

From MailBaby to “The Rattle Trap”: A New Way to Catch Spammers

Fighting spam usually involves blocking bad emails from entering your inbox. However, at MailBaby, we decided to turn the tables. We developed a reverse trap system we affectionately call “The Rattle Trap.”

Why the name? Because much like handing a baby a toy to keep them occupied, we hand spammers a fake account to play with. They shake it around trying to make noise, and while they think they are working, they are actually just alerting us to their presence.

How the Reverse Trap Works

In a typical cyberattack, spammers look for “compromised” email accounts—real accounts where they have stolen the username and password. They use these accounts to send out thousands of spam emails, hoping to look like a legitimate user.

MailBaby’s Rattle Trap uses specific email accounts that appear to be compromised but are actually under strict surveillance. These accounts are configured so they cannot actually send outgoing email.

When a spammer obtains the credentials for one of these trap accounts and attempts to route spam through it, the system silently watches. The email never leaves the server, so the internet stays clean, but the attempt itself provides us with a goldmine of data.

The “Hundreds” of Reasons This Works

Because the spammer believes they are using a working account, they keep trying to send messages. This allows MailBaby to gather critical intelligence in real-time. Every few days, this system helps us identify:

• Hundreds of Bad Authentication IPs: We capture the exact IP addresses the spammers are connecting from, allowing us to block them instantly across the network.
• Password Disclosure Endpoints: We can see exactly where spammers are testing their stolen credentials.
• New Spam Content: Spammers are constantly inventing new templates to trick filters. Our trap catches these new techniques immediately, often days before they hit the wider internet.

By setting a trap that invites spammers in but doesn’t let them out, we can identify threats faster than ever, keeping the MailBaby network secure and “cry-free.”