A spam trap is an email address that no person uses, kept by a mailbox provider, an anti-abuse group or a blocklist operator so that any message sent to it proves the sender did not verify consent or clean the list. Traps are never published as traps: a pristine trap is planted on web pages for harvesters to scrape, a recycled trap is an abandoned mailbox switched back on, and a typo trap sits on a misspelled domain.
What Spaw answers
No verifier can name a trap, because a trap that is known stops working. What Spaw can see are the shapes traps take: a domain on the typo-squat map answers likely_typo, a mailbox that once said it did not exist and exists again answers recycled_mailbox, and a username that looks machine-made carries the generated weight. Reporting your bounces through the feedback endpoint feeds the not-found memory that the recycled shape is read from.
What it does not mean
A clean verification is not proof that an address is not a trap, and a trap hit is not a fine: the cost is reputation at the receivers that read the operator's list. The defence is the list itself — confirmed opt-in, prompt bounce handling, and never mailing an address nobody has heard from in years.