Pristine spam trap

What it means

M3AAWG defines a pristine or pure trap as an address that has never been active for an email user before being deployed as a spam trap. Since nobody could have signed it up, a hit frequently comes from web harvesting, address space probing or dictionary attacks, and M3AAWG notes that pristine trap hits may strongly indicate purchased lists.

Trap operators place such addresses where only harvesters will find them. Project Honey Pot, for example, installs addresses on websites that are tagged to the time and IP address of the visitor, so it can tell when and by whom an address was harvested.

Trap data feeds blocklists and reputation systems, as M3AAWG notes, so a pristine hit can lead to a listing. The fix is to stop using the source the address came from.