Spam Traps: How They Get Into B2B Lists and How to Avoid Them

TL;DR

• What they are: addresses that blocklist operators and mailbox providers keep to catch senders who mail people without permission. Operators never publish them.
• How they reach a B2B list: bought and rented lists, scraped pages and WHOIS records, guessed addresses, and old records whose mailboxes or domains died.
• What verification does: it can keep a bouncing address off your list. Spamhaus says list validation does not clean spam traps, and the verifiers' own pages either say they catch only the traps they know or that no verifier can remove them.
• What to do: fix where the list comes from, suppress every hard bounce, and carry that suppression list to every new domain.

Spam traps are addresses that blocklist operators keep to catch senders who mail people without permission, and operators never reveal them. SpamCop publishes its weighting: below a trap score of 6, each trap report counts 5 times, and from 6 up the count is squared. It will not list an IP on one report. Spamhaus says list validation "does not" clean spam traps.

You cannot check an address against a list of spam traps, because the operators never publish one. That makes the usual advice to clean the list hard to follow. The useful questions are where each address came from and how old it is.

This guide stays with what the trap operators publish. Spamhaus, SpamCop and M3AAWG have each written down how traps work and how senders end up on one, and Spamhaus and M3AAWG also say what they think of cold email and verification. Where those sources disagree with each other or with a verifier's marketing, we say so and pick no side.

What is a spam trap?

Spamhaus defines a spam trap as an address used to expose senders who add people to their lists without permission. Its glossary says traps are addresses that have not opted into any email. Trap owners never reveal them. Part of the reason is that traps are "a component of the secret sauce of their filtering," and part is that a sender who learns one trap just suppresses that single address and leaves the data problem alone.

That is why no public list exists. One reply on r/Emailmarketing to a user asking how to find traps puts it plainly: "If spam traps were easy to identify, then they would serve no purpose."

M3AAWG's 2023 guide for ESPs adds that traps are "designed to be indistinguishable from other email addresses" and sit on corporate domains as well as freemail ones. So the idea that traps live only on Gmail and Yahoo does not match what M3AAWG wrote. A later section sets that line beside M3AAWG's 2019 paper, which says something different.

The types of spam traps

Spamhaus describes seven kinds of trap, and the kind decides how one reaches a B2B list. The table follows Spamhaus's descriptions. The last column gives the route into a list where Spamhaus or M3AAWG states one.

How long before an address becomes a recycled trap?

There is no fixed answer. Spamhaus says a dead address hard-bounces for a period, "often 12 months or more." M3AAWG says the length of inactivity "can vary significantly among operators" and suggests 12 months as a minimum. So 12 months is a floor in the operators' own words, not a rule. An address that bounced last week is still in the bounce phase Spamhaus describes, so suppress it now, before that phase ends.

How spam traps get into B2B lists

Four routes show up in the operators' pages. Spamhaus and M3AAWG give no percentage for any of them, and we found no sourced one elsewhere, so we give none either.

Bought and rented lists

Spamhaus's Sender Guidelines name purchased, rented and harvested lists as the most common source of spam trap hits. Its marketing FAQ says to never buy or rent addresses from anyone. The same FAQ says purchased lists inevitably hold traps or produce complaints and bounces, and the buyers end up blocklisted. M3AAWG's 2019 paper says buying or sending to purchased lists breaks its core values, whether the mail is B2B or B2C.

Scraped pages and WHOIS records

Spamhaus says seeded traps are scattered "in webpage source code, for example," so a sender who scrapes pages, or buys from someone who does, collects them. Role addresses are the other scraping hazard. WHOIS records publish postmaster@, abuse@ and admin@, and Spamhaus says those are frequently harvested and mailed. M3AAWG's list of routes also names trade show lists, single opt-in forms and e-pended lists.

Guessed addresses

Spamhaus counts guessing as harvesting: some senders "try random combinations of email addresses" at an ISP to find live ones. Pattern guessing in cold email, such as first.last@company.com, is a narrower practice, and we found no operator source that names it. In our reading the weak point is the same, because until something confirms an address, nobody knows whether a person reads it there. We found no trap rate for guessed addresses.

Old records and dead domains

Old records are the quiet route. Spamhaus says trap owners buy expired domains and in many cases switch them off for a while before turning them on as traps, so a company that closes or renames itself can leave addresses that later become traps. Dead mailboxes follow the pattern in the table: bounce, wait, return as a trap. The sender who keeps mailing an address after it bounced, or who moves to new domains without the suppression list, is the one who hits it.

What the operators say about cold email

Spamhaus's guidance is built on permission and confirmed opt-in, so none of its advice on sourcing is an endorsement of any way to build a cold list. M3AAWG addresses cold email directly. Its Position on Cold Email, from November 2025, names "detection in spam traps" among the reputation metrics that indicate a sender is cold emailing, next to blocklisting, high unknown user hard bounces and high complaint rates.

M3AAWG's Sender Best Common Practices v4.0, from August 2026, defines cold email in section 4.5 and says M3AAWG "views such email as abusive." The November 2025 position paper is narrower. It calls unsolicited email, cold email included, an abusive practice when it goes out by "deceptive and misleading delivery methods." The best practices text has no such condition, though it points to the position paper for the full details. We quote each as written and pick neither.

The 2019 M3AAWG paper on selling address lists is the source for B2B. It says many B2B senders face very little consequence for poor list collection, that many business addresses have no feedback loops, and that "Spamtrap networks are also limited when it comes to business addresses." It also says numerous corporate domains block all mail when a list source looks suspect, abruptly and sometimes for extremely long periods. Its position is that permission is required for B2B and B2C alike.

That sits beside the 2023 line that traps exist on corporate domains. The two documents are nearly four years apart and read differently. Either way, thinner trap coverage on business domains is not safety: the 2019 paper itself warns that corporate filters can block a sender hard.

What happens when you hit one

Of the operators we read, SpamCop is the only one that publishes how it weighs trap reports. Its documentation says its traps are non-existent addresses it set up and never used to sign up for anything, so mail to one means the address was harvested. Below a trap score of 6, its blocklist multiplies the number of trap reports by 5 and adds that to the report score. From 6 up, it squares the number.

SpamCop's own examples show the effect. A host with 2 trap reports and 3 user reports scores 13, because 2 times 5 plus 3 is 13. A host with 7 trap reports and 3 manual reports scores 52, because 7 squared plus 3 is 52.

The blocklist will not list an IP address with only one report filed. With two reports it lists for at most 12 hours after the most recent reported mail. The SpamCop team balances the threshold by hand and gives no number for it, and the blocklist ignores reports older than a week.

Spamhaus gives no weighting. Its March 2026 post on reputation says trap hits "carry a heavier reputational impact compared to most other metrics." Its CSS page says listings are "always the result of multiple events and heuristics." So we found no public rule that one trap hit gets an IP listed. M3AAWG says the consequences vary with the number of hits, the type of trap and who runs it.

Some articles say one hit blacklists you. The public rules we read do not say that, and they do not say a single hit is harmless either.

Someone running cold campaigns for clients wrote on r/Coldemailing that they had apparently hit a spam trap, and that every secondary sending domain for one client was then flagged by SURBL. The post is one person's account, and it says nothing about how often this happens.

Can email verification remove spam traps?

The operators say no, and so do the verifiers' own help pages, which admit limits. The marketing is looser.

Spamhaus has said so for years. Its glossary calls the claim that a company can find and remove traps "a questionable claim," because Spamhaus frequently sees trap mail from "verified" lists. Its marketing FAQ says such services "simply do not work as claimed." The Sender Guidelines tell senders to avoid list validation as a way to clean traps, because it "does not do so" and never replaces permission.

MillionVerifier's help centre says "Email verifiers cannot confirm and remove spam traps," and calls an offer to remove them false advertising. Four other verifiers say less, in different ways.

Four of the five state a limit outright. NeverBounce makes two different statements: its help article limits itself to "known" traps, and its homepage does not.

What verification does is narrower. Spamhaus's 2015 article says a verification service determines whether an address exists and does nothing to verify permission. It says verification might be of marginal help for mistyped point-of-sale addresses but "won't catch many typo traps." It adds that verification can have a role in a healthy email system.

Spamhaus also says a dead-address trap rejects mail with a hard bounce before it is turned back on. A verifier that catches that bounce keeps the address off your list during that window. That is our reading of Spamhaus's description, not a claim any verifier makes.

On WizLeads, Verify Email returns valid, invalid, unknown or error plus a catch-all flag, and it charges 0.5 credits per email for every email processed, whatever the result. Its API reference has no spam-trap field, so no result it returns tells you an address is not a trap.

How to avoid spam traps in cold email

Spamhaus's advice reduces to one idea: stop looking for traps and fix where the addresses came from.

1. Know the source of every address. Spamhaus tells senders not to try to identify or suppress a trap address. They should audit the acquisition process to find which list segment or collection method introduced it, and remove that source entirely. Tag every import with its source and the date it was added, so that audit is possible.
2. Suppress every hard bounce at once, and keep the suppression list when you change domains or tools. Spamhaus says to suppress hard bounces immediately, and warns that on new infrastructure bounced addresses get mailed again, because "old inactive addresses are where recycled spam traps sit." Fewer bounces also keep you inside the limits your sending platform sets.
3. Re-verify old records before each send. M3AAWG suggests suppressing recipients who remain chronically unengaged or non-deliverable. A cold list has no engagement history on first send, so age and bounce history are what you have, and a verifier run just before sending catches addresses that bounce now.
4. Strip role addresses. Spamhaus says postmaster@, abuse@ and admin@ should almost NEVER be on a marketing list, and WHOIS records publish them.
5. Do not scrape pages or WHOIS records, and do not buy. Seeded traps are planted for scrapers and for people who buy from scrapers. What buying a list costs and what regulators say is in our list-buying guide.

A cleaner list does not make cold email permission-based. It lowers your exposure to the hit the operators describe, which is all a list-side control can do. M3AAWG adds that tools which monitor blocklists and reputation can report trap hits without exposing the traps.

Spam trap removal: what to do if you hit one

Fix the segment, stop sending to it, then wait for the listing to expire or request removal. No one can remove the trap itself. Spamhaus says any offer to remove a listing for a fee is a scam.

Find the segment first. Spamhaus says a trap hit is proof of a data collection or hygiene problem, and that hunting for the trap only treats the symptom. Match the hit to the import, scrape or vendor that brought the address in, and drop that source entirely.

Then wait. A Spamhaus CSS listing normally expires three days after the last spam detection, and Spamhaus will re-list an IP at once if the problem continues. SpamCop listings expire 24 hours after the last reported email.

If you cannot say where an address came from and when someone last confirmed it, leave it out of the next send. That rule costs you some contacts and protects the domains the rest depend on.