Timeline for How did the spammers get this address?
Current License: CC BY-SA 3.0
23 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 16, 2014 at 10:39 | review | Suggested edits | |||
| Aug 16, 2014 at 12:12 | |||||
| Apr 27, 2014 at 12:56 | comment | added | dotancohen | Related issue: security.stackexchange.com/questions/51996/… | |
| Jan 30, 2014 at 10:01 | answer | added | Sharon Williams | timeline score: -3 | |
| Jan 28, 2014 at 6:53 | comment | added | dotancohen | @pacifist: No, the hostname of the box was simply 'neptune'. Nice thought, though. | |
| Jan 28, 2014 at 6:15 | comment | added | pacifist | Is test-config-aws-neptune-2014-08 the hostname of the box in question? | |
| Jan 28, 2014 at 4:52 | answer | added | tylerl | timeline score: 1 | |
| Jan 27, 2014 at 15:11 | answer | added | AJ Henderson | timeline score: 11 | |
| Jan 27, 2014 at 15:06 | comment | added | AJ Henderson | @dotancohen - you aren't understanding what I'm saying. A catch-all address doesn't matter what address they send it to, it still goes to that inbox. If I set up [email protected] as the catch all address and a spammer e-mails [email protected], as long as there is no "[email protected]" then the e-mail will be delivered to [email protected]. You should generally not make your primary e-mail account the catch-all unless you really REALLY like spam. Spammers immediately start sending spam to pretty much any new TLD to random common addresses on it (such as admin or contact). | |
| Jan 27, 2014 at 15:04 | comment | added | dotancohen |
@Philipp: The @my-domain.com mail is handled by Google Apps, which I access via Thunderbird using SSL for both IMAP and SMTP.
|
|
| Jan 27, 2014 at 15:03 | comment | added | dotancohen | @AJHenderson: Yes, but my question is how the spammers knew to send mail addressed to that address! | |
| Jan 27, 2014 at 15:02 | comment | added | Philipp | Is the mailserver @my-domain.com hosted on your own server or by a webhoster? | |
| Jan 27, 2014 at 14:40 | comment | added | AJ Henderson | @dotancohen - if you configured it as a catch-all address, it means that all mail sent to the domain that doesn't go to an existing address goes to that mailbox. That's the point of a catch-all address. | |
| Jan 27, 2014 at 14:34 | comment | added | dotancohen | @AJHenderson: Yes, the domain name receives all mail sent to it. But how did the spammers know to send mail to the specific address "[email protected]"? That is not a lucky guess. | |
| Jan 27, 2014 at 14:11 | comment | added | AJ Henderson | What do you mean by catch-all domain? If you have the account set as a catch-all or an admin contact on the domain, then it was likely farmed from the whois records. Even "private" whois records can be queried through the proper channels. That is the entire point of whois and it wouldn't surprise me if at least some spammers have made it past that. | |
| Jan 27, 2014 at 13:56 | comment | added | dotancohen | Question edited with clarifications. | |
| Jan 27, 2014 at 13:56 | history | edited | dotancohen | CC BY-SA 3.0 |
added 1014 characters in body
|
| Jan 27, 2014 at 13:48 | comment | added | zedman9991 | Keeping it very simple have you considered the actual email sent and received. Was it controlled or perhaps did it including responding to web advertisements etc? | |
| Jan 27, 2014 at 13:39 | comment | added | Flo | Some webservers have a "contact admin" feature on Error 404. Could that be it? | |
| Jan 27, 2014 at 12:43 | history | tweeted | twitter.com/#!/StackSecurity/status/427783973482528769 | ||
| Jan 27, 2014 at 11:36 | comment | added | ratchet freak | amazon or hackers might have mined the disks on the virtual machines for email addresses, or one of the machines that you used to configure it was compromised. Also don't discount that the sender machine wasn't compromised just because the OS is not a popular target. | |
| Jan 27, 2014 at 10:04 | comment | added | dotancohen | 'Amazon' the company never had the address other than in a config file on a virtual machine that I rent from them (AWS EC2). I used a throwaway address on a catchall domain, as stated in the OP. | |
| Jan 27, 2014 at 9:46 | comment | added | Rory Alsop♦ | Remember the attack surface must include Amazon giving the spammer your email address, whether deliberately or accidentally. | |
| Jan 27, 2014 at 9:14 | history | asked | dotancohen | CC BY-SA 3.0 |