TemporaryMail

Kind of compromises the mission alignment and trust though if it's through ads.

I don't agree with this and I think the right approach is to simply not require visitors to give up their email accounts if they don't want to.

If you want to block a malicious attacker, then you can use a captcha.

A serious malicious attacker wouldn't have a problem paying a few dollars to buy a domain, creating a catch-all address and if he wants to take it one step further he can even have it look like a legitimate email service.

Disposable services are ad blockers for emails.

They use the same IP and their domains are all listed here: https://verifymail.io/domain/carspure.com

I have to admit that they have improved though as earlier they were all using the same MX records, now at least each domain has its own.

Yes, just like all other email providers nothing is encrypted and you could totally look at the emails.

The difference here is though that there's nothing of value.

If I wanted to use this for malicious intent, then I think the most valuable thing I could get away with would be a 5% discount coupon.

I like that you bring this stuff up though as it could perhaps be good to mention this on the site down at the FAQ so people don't think I'm doing something shady with the service since there are no ads.

That's not really true because they used to have the same mail server so if you found one domain, then you could easily find the rest of the domains too.

I remember when this was a thing like back in the early 2000s, but nowadays everyone bombards their users with ads regardless of TLD.

It's a pretty big list of names that I've scraped together.

There's barely and load on the server to generate the names and it only happens once for the new users so it wouldn't be worth putting that load on the client just for that one time, especially not with the traffic it's currently getting (currently around 1k users/day).

You're right about that and I'm doing my best at rotating, but it's very easy to detect these addresses as the "detectors" can simply just set a cron to grab the latest domains once an hour.

I'm however thinking about creating a paid service with a low price (maybe like $2/month) just to filter out the majority of the bots and then using that money to get a lot of domains.

Just for fun.

It started with me getting annoyed with SHEIN as they sent out spam to me and their unsubscribe link was set to localhost (127.0.0.1 - they are still using this last I checked) and in the same time period I found a suitable domain at an auction so I thought I'd give this a go.

Those are the same links that I posted, no?

Thanks for having a look at this thread and I would be more than glad to answer any questions or feedback that you may have.