Pangram introduced a `/api/validate‑email` endpoint that fires a spam‑style email to each address entered. The message, marked “Fact of the day,” originates from a rotating list of over a hundred domains. By forcing immediate delivery, the service bypasses standard bounce checks, even reaching mailboxes that flag spam through reputation lists.

The spam originates from domains like apiaryapiaries.com and sifgoldenshine.com, with senders rotating to evade blocks. Logs show rapid retries from different servers when a host is rejected by blacklists such as spam.spamrats.com or Barracuda. Each retry uses a fresh sender address, ensuring the message eventually lands in the inbox or triggers a hard bounce that confirms address validity for testing.

This technique turns a simple validation call into an unsolicited mail blast, undermining the premise that sending a verification link suffices. Pangram’s transactional emails are actually routed through Mailgun, not the spam network. The exercise exposes how validation services can be gamed, highlighting the need for stricter anti‑spam checks before claiming an address is active within the system.