The standard email client response to spam is to move the message out of sight. Mark it as junk. Let the filter learn. Repeat indefinitely. This approach manages the symptoms without addressing the cause, and it leaves the sender entirely unaffected.

Automated abuse reporting is a different approach. Instead of hiding spam, you report it to the infrastructure operators and authorities who can actually act on it.

The Limits of Passive Filtering

Spam filtering has gotten good. Bayesian classifiers, neural networks, reputation databases — modern spam filters catch the vast majority of junk before you ever see it. But the filter’s job is to protect your inbox, not to penalize the sender. The spammer’s infrastructure keeps running. Their domain stays registered. Their IP block continues sending.

Active abuse reporting changes the operational calculus. When a spammer’s IP gets reported to AbuseIPDB, network operators around the world can block it. When a domain gets reported to its registrar for violating terms of service, the domain can be suspended. These aren’t guaranteed outcomes, but they impose real costs and create real friction for spam infrastructure.

The problem has always been the effort required. Properly identifying the originating IP in a multi-hop email chain, locating the right registrar abuse contact, and formatting a complaint correctly takes time that most people don’t have. cji.email automates most of that.

How cji.email Parses Spam Headers

Every email carries a chain of Received: headers that trace its path from origin to destination. Each hop in that chain records the IP address and timestamp of the handoff. The first Received: header added by your server — the last one in the chain when reading from top to bottom — contains the IP address that actually delivered the message to you.

cji.email’s Rust backend parses this chain and extracts the originating IP, filtering out internal hops from your own mail infrastructure. It also extracts:

  • The Message-ID, which uniquely identifies the spam message
  • The From domain and its WHOIS registrar
  • The X-Originating-IP header, when present (used by some webmail providers)
  • Any Reply-To domain, which often differs from the From domain

This extraction runs locally and completes in milliseconds.

Reporting to AbuseIPDB

AbuseIPDB is a global database of IP addresses reported for malicious activity, including spam. Network administrators check it before accepting connections. Internet service providers use it to identify compromised infrastructure on their networks.

When you flag a message for abuse reporting in cji.email, it submits the extracted IP address to AbuseIPDB with the appropriate abuse category code (category 18: Spam) and a comment summarizing the message. The submission uses the AbuseIPDB API with your API key, configured once in Settings.

Your report is added to the collective intelligence that helps others block the same IP.

Domain Registrar Complaints

For spam that uses newly registered domains or repeatedly abusive domains, a complaint to the registrar can be more effective than an IP report. cji.email identifies the registrar from WHOIS data and can generate a formatted abuse complaint email addressed to the registrar’s abuse contact.

The complaint includes the relevant headers, a description of the violation, and — in jurisdictions where applicable — a reference to the relevant anti-spam law (CAN-SPAM, GDPR, etc.). You review the draft before it’s sent.

Spam Traps and What They Tell You

Some abuse-fighting organizations maintain “spam trap” email addresses — addresses that were never subscribed to anything and only receive mail from senders who obtained addresses improperly. If you receive email at an address you’ve never given out, that’s a strong signal the sender is operating a spam campaign.

cji.email lets you designate addresses as spam traps in your account settings. Any message received at a designated trap address is automatically flagged, headers extracted, and an abuse report queued. This is particularly useful for people who run custom domains and maintain honeypot addresses for exactly this purpose.

The Larger Effect

No single report stops a spammer. But automated reporting, at scale, is effective in ways that individual manual reports are not. When cji.email makes it a three-second action to report a spam message to the right infrastructure operators, more reports get filed. More reports mean higher risk for senders, higher operational costs for spam infrastructure, and more pressure on the registrars and hosting providers that enable it.

We’re building the reporting tools into cji.email because we think email clients should be participants in maintaining a functioning email ecosystem, not just passive recipients of whatever arrives.