Koli-Lõks controls a large spamtrap collection that receives millions of emails per day. They classify spamtraps into four categories: pristine spamtraps that never existed, role addresses for specific jobs, typotraps that are similar to real domains, and repurposed spamtraps that were previously real email addresses. Repurposed spamtraps make up 75% of the collection and provide information about spam sent to outdated email lists. Koli-Lõks further categorizes repurposed spamtraps by the original owner's industry to allow analysis of spam by sector.

1. Koli-Lõks OÜ
Messaging Intelligence and Analysis
4 April 2015
About Our Spamtrap Collection
Koli-Lõks controls a spamtrap collection that currently receives an average of three to four million delivery
attempts per day. The collection includes generic top-level spamtrap domains, regional- or country-specific
top-level domains (ccTLDs), and spamtrap email addresses at live domains.
Our spamtrap domains and email addresses are managed in accordance with the criteria specified in the
Messaging Malware Mobile Anti-Abuse Working Group (M3
AAWG) Best Current Practices For Building and
Operating a Spamtrap1
. Before we make a spamtrap domain live, we research its history thoroughly, finding
out who previously owned it (if anybody), and what they did with it.
Any spamtrap email address that might ever have been a real email address must meet the M3
AAWG
minimum timeout period: not less than twelve consecutive months during which the email address was
undeliverable. That can be accomplished either by rejecting all delivery attempts for that email address, or by
removing all MX servers for the domain, as happens when a domain lapses with the registrar and is not in
DNS at all.
Koli-Lõks classifies its spamtraps into four categories:
• Pristine spamtraps. About 3% of spam to our collection is sent to pristine spamtraps, email
addresses that never existed prior to being created as spamtraps, at domains that are not near
equivalents of other domains that are used for email. Pristine spamtraps should receive no email at
all. If they do, that email was unsolicited. If that email is bulk email, it is spam.
• Role addresses. About 2% of spam to our collection is sent to role addresses, email addresses that
were assigned to a particular job, or role, in an organization rather than to a specific person. Role
addresses do not normally send email outside of their organizations, and rarely subscribe to receive
bulk email of any kind. If a role address receives any bulk email, that email is probably spam. If a role
address receives bulk email after a 12-month timeout, that email is spam.
• Typotraps. About 20% of spam to our collection is sent to email addresses at domains that are near
equivalents to domains that are used for email. Typotraps are technically pristine spamtraps, but
typotraps often receive email that is the result of a mistake. A user might mistype his or her email
address in a web form, or a data entry clerk might mistype or misread the email address from web
form output or a manual signup list. Typotraps serve as valuable proxies for data quality.
• Repurposed spamtraps. About 75% of spam to our collection is sent to repurposed spamtraps,
email addresses that were (or are assumed to have been) actual email addresses assigned to and used
by real people at some time in the past. All email addresses that are not currently in use, have gone
through the M3
AAWG-specified 12-month timeout, and that do not fit into one of the other
categories, are classified as repurposed spamtraps. Repurposed spamtraps should not appear on
properly-maintained bulk email lists. They receive a great deal of spam, including spam sent to high-
quality purchased and email appended lists.
Spamtraps that previously belonged to a company, organization, or individual are further classified where
possible by the activity that their original owners were engaged in, allowing for feeds that focus on specific
industries or types of activity and reports that are broken down by industry. The current categories are:
• Companies. For-profit business entities. This category is further subdivided into industry segments.
• Educational Institutions. Universities, vocational schools, K-12 schools, and university- or
government-owned institutes that do research into education or provide products or services for
schools and universities.
• Governments. Governments and agencies at any level from municipal to national.
1 https://www.m3aawg.org/sites/maawg/files/news/M3AAWG_Spamtrap_Operations_BCP-2013-10.pdf
Page 1 of 2

2. Koli-Lõks OÜ
• Internet Service Providers. Providers of connectivity, leased servers, colocation, cloud or VPS servers,
email accounts, web hosting, DNS, or other internet-based services.
• Mixed. Any domain that does not fit neatly into any other category.
• Non-Profit Organizations. Any organization whose charter or official mission is not to make a profit,
but something else, and that does not distribute any profits to its owners or shareholders. Further
subdivided into advocacy groups, charities, political parties, religious groups, and others.
• Personal/Vanity. Personally-owned domains that are used for private interests, not to run a business
or organization.
• Unknown. Any domain that never existed before we registered it, or whose purpose we were unable
to determine.
Finally, each repurposed spamtrap has an approximate age assigned to it, the length of time since it was last
known or suspected to have been a live email address. This information is useful for distinguishing between
data quality problems and probable deliberate spam. Email to a repurposed spamtrap that was sent by a
company or organization that did not exist at the time the email address was taken out of use is probably
deliberate spam. The same email sent to an email address that the company or organization might have
obtained legitimately at one time is probably evidence of poor data quality and failed bounce processing.
Page 2 of 2