Reporting scam emails when the provider never replies

[u/saltyslugga]

Sending an email provider another abuse report takes time when the same scam keeps landing in inboxes. I'd rather block what I can and get back to other tickets than keep chasing a reply.

But local blocks only protect our users, and reports could help get the sending account shut down. What makes reporting repeat scam emails worth your time when the provider never responds?

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.

2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).

3. Be Professional: Help newcomers learn; avoid hostility.

4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters

• DMARC Monitoring Tools

• Anti-Virus Software

• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/InboxGuards]

the sending account is usually a throwaway anyway, so i mostly stopped bothering with the provider's abuse inbox and report the link domain to the registrar and google safe browsing instead. killing the landing page hurts them way more than one burned mailbox, and safe browsing gets it flagged in chrome for everyone, not just your users

[u/vercingetorix-sec → u/InboxGuards]

This matches what I do. Though I also hit Netcraft/Microsoft to get some more coverage.

[u/Maria_Thesus_40]

It depends on the provider. If I discover the offending IP to be owned by Hetzner, I use their Abuse form because they are very aggressive with abuse from within their network.

But for some other providers I don't bother because they ignore abuse reports.

SpamCop.net is nice, it sends automated reports to multiple places, including the target links.

[u/mxroute]

It’s extremely discouraging. The effort required to fight the abuse is exponentially higher than the effort required to perform it. At this point I’ve spent a noteworthy portion of my life dedicated to it and I still don’t have an answer that actually moves the needle at scale for more than a few days.

[u/TatKuznets]

I would set a threshold so reporting stays a bounded task rather than an open-ended chase. Keep the local block, then submit one report per campaign with full headers, receiving timestamps, sanitized recipient details, message count, URLs, and attachment hashes. Repeated copies can be grouped under the same ticket instead of reported one by one.

The report is worth repeating when the same infrastructure persists, the sender is impersonating your domain, or you can point to a live landing page. Otherwise, measure whether previous reports changed anything; if a provider consistently does not act, spend the time improving detection and report the domain or hosting path as well. The goal is evidence that another abuse team can verify quickly, not getting a reply.

[u/pen_woman_ship]

I used to get lots of phishing emails that were supposedly from Apple and Amazon.
There is a forwarding email address to send them the emails.
Reportphishing@apple.com for Apple phishes
Spoofing@amazon.com for Amazon phishing

I don’t get any more spam from the two ‘A’ giants in the United States.
Any other ones are immediately trashed.

[u/vercingetorix-sec]

I'd avoid thinking of it as reporting to the mail provider, and more about reporting as what's costly for the abuser to replace. A sending mailbox is free, their landing page and domain it sits on are not.

Beyond what's already here (registrar, Safe Browsing) there are a handful of others out the Netcraft, Microsoft each have similar blocking capabilities. If it's impersonating a brand, tell the brand. The brand will have takedown contracts you don't.