I have a domain that is only used by me, with several inboxes in the format aep-x-company@domain , where i replace 'company' with wherever i sign up. This way i can detect when someone sells email addresses.
However, since yesterday i am receiving spam on about 10 of them simultaneously. The source are infected servers, valid headers and everything. The content contains no links, and no fraud, it is a sequence of unrelated sentences in english. Likely designed to get a low bayes spam ranking.
There is no list of valid inboxes on my mail server, it's just a regex that matches foo-x-bar to foo. I use roundcube as webmail, that can only be accessed through https, and i only use chrome on linux.
Breakdown on what these inboxes are: 2 porn sites, 2 dating sites, 4 publicly visible addresses, 1 dropbox, 1 online shop
Especially dropbox makes me wonder if its really them selling my address or spammers having compromised one of my systems. How would i know? i see nothing unusual on any of them. None of my machines is sending spam, as far as i can see, so that should be a good sign of being clean, i guess. On the other hand i have no idea what the point of that spam is, since all it does is poison bayes.