A signup form 'validated' his email by mailing him spam about magnets
Right after he typed his address into Pangram's signup form, a stranger's email landed: a 'fact of the day' about magnetic domains, the real text hidden off-screen at -9999px. He had never asked to hear about magnets.
An engineer testing Pangram's signup found that the act of entering his email address triggered an unsolicited message from a churn of throwaway domains, its payload a base64 HTML blob of physics filler buried off-screen.
Then the company's founder turned up in the thread: 'I had no idea this was happening' — he traced it to a third-party validation vendor in his own stack.
A 'verification' email that was actually spam about magnetic domains
The complaint in the original post is precise. The author was poking at the signup form for Pangram, an AI-text-detection service. Typing an address fires a POST to pangram.com/api/validate-email to check the address before anything else happens. Moments after he submitted his, an email arrived from "Winwin Insights" with the subject of a fact of the day about magnetism.
It was not a verification link. The body was base64-encoded HTML whose visible content was a paragraph on magnetic domains in physics, with the real markup shoved off-screen via absolute positioning at -9999px. The sender rotated through a churn of fresh domains (sifgoldenshine.com, classmerge.com), carried a Precedence: Bulk header, and his Postfix logs showed retries from multiple IPs, some already blocked by SPAMRATS and Barracuda. The author's advice is the old one: just send a verification link and don't try to validate the address beforehand.
Two theories in the thread: incompetent vendor, or address harvesting
The room split fast over whether this was a dumb pipeline or a business model. A high-karma reader actually reproduced it.
"I did end up getting a random empty email. From a 'Adventure-Meter Department' at bugbusterbrigade.com … it's some sort of attempt at inbox testing. Perhaps it's an attempt to sniff out AI agents signing up for their service?" — a reader who replicated it on a fresh address
Others read it darker, as a two-sided market dressed up as a service.
"Sell verification services to one set of clients, and use the harvested email addresses to sell spam delivery to another set of clients." — a commenter sketching the playing-both-sides model
A third pointed out that even "valid" tells you nothing useful: the address could belong to a stranger — [email protected], for instance — and that smelled to him like an exfiltration backend quietly collecting new signups.
The founder shows up: 'I had no idea this was happening'
The reversal came from the company itself.
"Founder of Pangram here. We use Zerobounce and CustomerIO for email validation. I had no idea this was happening … this is not intentional on our part. Will dig deeper and eliminate the part of the stack that is sending spam." — the founder of Pangram
That lands the story where the title only hinted: the spam wasn't a sinister design decision but a third-party validation vendor doing something the people selling the product didn't even know about. Which is the quiet warning for anyone wiring a validate-email call into a signup flow — you are handing every address a user types to a black box, and the black box may be mailing them.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Wizards of the Coast workers win a union — and a lecture on why US unions are weird
The NLRB has recognized United Wizards of the Coast. In the thread, a Wizards employee says he wishes he'd had a union through the tech layoffs that came before this job — and a high-karma reader explains why a single-company US union is a strange thing.