What we remember, and what we never share
For every submission we check, we keep a note of what happened to it: let through, or stopped as spam. We keep that note against a one-way fingerprint of the connection it came from, the small block of addresses around it, and, when the form has one, the sender’s email. When the next submission arrives, from any store, we look back over the last seven days.
We also check two public lists that anyone can read: throwaway-inbox domains, and blocks of addresses that have been hijacked or leased by professional spam operations. Both are refreshed daily, and an out-of-date copy of the second is dropped rather than trusted, because those blocks change hands.
Emails are compared as locked fingerprints made with a secret only our server holds, so they can’t be turned back into an address. When a customer asks you to delete their data through Shopify, their email’s shared fingerprint is deleted, so it can’t be followed from store to store any more. Fingerprints we haven’t seen for 30 days are deleted too.
The flags, one by one
These are the notes you might see on a submission in your report. Each says what it does on its own.
Only ever sent spam
Stops itThis connection was stopped as spam on five or more other stores this week, and we have never let anything from it through: not on any store this week, and never on yours. We count every send that got through on its own, however much spam arrives with it, so a phone network or office that real customers get through on doesn’t look like this, even in the middle of a flood. It is the one kind of history that stops a submission by itself.
If it was someone real: it’s rare, but a quiet connection can look like this (say, someone’s first message from a VPN a spammer also used this week). They were told it wasn’t sent and given your email. Mark it as a real customer and we stop counting this connection on your store.
Stopped on other stores this week
Asks for a lookSubmissions from this connection were stopped as spam on three or more other stores in the last seven days. It could be a spammer. It could just as easily be a phone network or an office where one person was up to no good. So on its own it only marks the submission “Worth a look”, and it reaches you.
Email address seen spamming
Asks for a lookThis email address was used in submissions stopped as spam at least twice across the stores we protect this week. Anyone can type any email into a form, so this never stops a submission on its own.
Nearby addresses sent spam
Asks for a lookOther addresses in the same small block were stopped on five or more other stores this week, and nothing from that block got through. Spam tools hop between the addresses of one rented block; this lets us notice one they haven’t used yet. It’s a mild sign, and never stops anyone on its own.
From a hijacked network
Asks for a lookThis address sits in a block that a public, daily-updated list names as hijacked or leased by professional spam operations. Real customers almost never come from these blocks, but addresses do change hands, so on its own this only marks the submission “Worth a look”.
Many sends in a few minutes
Asks for a lookYour storeThe same connection sent this form more than five times in ten minutes (more than ten for a newsletter or login form, where people do retry). People send a form once or twice; scripts send it again and again. We count each send the moment it arrives, so fifty at once are noticed straight away. A customer trying the same message again counts once for up to three tries, and anyone on your allow list is never counted.
Running a promotion that sends a whole office to your sign-up form? Email contact@jola.com.au and we’ll relax that form so it allows twice as many.
Stopped on your store today
Asks for a lookYour storeSubmissions from this connection were already stopped on your store at least twice in the last 24 hours.
Sent here before without trouble
Benefit of the doubtYour storeThis connection has sent your forms at least three times this week and none of it was ever stopped on your store. We lower its risk, and history from other stores is never allowed to help stop it. What happened on other stores doesn’t spoil it: on a phone network, someone else behind the same address will have been stopped somewhere.
History alone doesn’t stop a shared connection
Your customers on a phone network or an office connection share an address with hundreds of other people. If one of them sends spam, the address picks up a history, and that history isn’t your customer’s fault. So we hold history to one rule.
History from other stores counts towards stopping a submission only when the visit itself shows something a real person’s browser never does, like a security check made on another website, or when your own store sees the same connection sending the form again and again right now.
A form filled in by autofill in a blink doesn’t count. Neither does a hidden field a password manager filled in. A customer who has written to you before without trouble is never stopped on history at all.
The one exception is “Only ever sent spam”: a connection we have never let anything through from. We count what got through on its own, so no amount of spam from a shared connection can hide the customers on it.
Try it. Every answer below was worked out by the same code that checks your forms, at the Balanced setting.
Nothing worth holding it up for. It goes straight through.
If a real customer was flagged
In your report, open the submission and choose This was a real customer. We stop counting that connection’s history on your store for 30 days, and everything about that email for 90. Their bursts still count: fifty sends in ten minutes is never the customer you marked.
Apart from “Only ever sent spam”, history can’t stop anyone on its own (that includes the hijacked-network list). If a submission was stopped, the reason that mattered is the other one on it, and that’s the one to look at.
A promotion that sends an office to your newsletter form can look like a burst. Email contact@jola.com.au with the form’s name and we’ll relax it so it allows twice as many sends.
Email contact@jola.com.au and we’ll turn off Use what other stores have seen for your store. Only what happens on your own store will count. Your visitors’ email and network fingerprints are then not added for the other stores either; hashed IP addresses still count, the same way.
How big is the network?
Honestly: it’s the stores Spambuster runs on, over the last seven days. That’s a lot smaller than services built on hundreds of thousands of websites, and we don’t pretend otherwise. What ours has that theirs usually doesn’t is the story behind each note: why a submission was stopped, and whether a merchant said it was a real customer. That’s what lets us act on less, and it grows with every store that joins. Alongside it we use the two public lists above, which cover throwaway inboxes and hijacked networks whatever store they turn up on first.
Every number and rule here is taken from our own code as it runs today, and the answers in Figure 01 were worked out by it, not written by hand. Something here doesn’t match what you’re seeing? Email contact@jola.com.au and a person who builds Spambuster will look.