What we can act on
- An inbox on our domains used to abuse another service's signup or trial system.
- Automated hammering of our endpoints from a single network.
- Requests from a service that wants our receiving domains excluded from its signups.
What we cannot act on
We do not send mail, so spam claiming to come from our domains was not sent by us — the envelope sender was forged. We also cannot recover an expired inbox or produce message content that has already been deleted.
What to include in a report
- The temporary address involved, in full.
- Timestamps in UTC, as precise as you can manage.
- Relevant message headers if you have them.
- What outcome you are asking for.
How to reach us
Send reports through the contact page. Reports about active abuse are prioritised over everything else.
Built-in protections
Mailbox generation and API access are rate limited per network using keyed hashes rather than stored IP addresses, repeated suspicious behaviour raises a risk score that triggers a challenge, and outbound sending does not exist at all.