2

I run a cyber security firm called Bluflame Security. On our subdomain lab.bluflamesecurity.com we have an email sign up box for people to sign up for our newsletter. All it is, is a simple php script that gets the user input and then sends me or my other business partner an email with the persons email.

Although recently it looks like we are getting targeted.

I have been getting almost 4 user signups per day from random emails with Russian names from the email provider mail.ru and only from there. It is very strange.

I understand that it is probably a bot, but why would a bot be putting the email in there and nothing else? Instead of sending spam, it seems to be providing us with a very large collection of mail.ru email addresses.

What would be the reason for this besides spamming me with email applications? I am considering running some recon on some of the addresses to figure out who they are.

  • 4
    Your website gives a 500 error for the store & you don't say what country/territory you operate in (I will unkindly assume you are in the USA because of that, sorry). Also, quite a few links on your website don't work or stay on the same page. Probably not too good an advert for your services to be honest given the nature of the business you are in. – Julian Knight Dec 20 '16 at 0:07
  • 1
    Your site does not seem to redirect me to https (although this is not required, for a security company it feels a bit weird), and when visiting the site on https the site requests some non-https sources. – Rolf ツ Aug 17 '17 at 10:00
1

mail.ru probably has an easy sign-up option which means that hacking networks can sign up thousands of accounts per day. This offsets any attempt to get the accounts banned or blacklisted.

The reason is likely to be attempts to find entry to legitimate security sites so that they can piggy back to more interesting targets.

Since it is really unlikely that you will have a legitimate customer using mail.ru, I'd probably just block access to that domain.

It seems there has recently been some very large increases in this kind of activity along with targeted attacks and Wordpress attacks, possibly some new networks appearing.

The signup form on the labs page doesn't seem to do anything but if you are seeing some activity on it, it will be because you haven't added any bot protection to it maybe.

Ah, just found the second form for a subscription. This also appears to have no protection on it. I entered a random and fairly obviously incorrect email address - even with an invalid top-level domain - and it accepted it.

As an aside, that page fails accessibility standards really badly (the colours on the subscribe form are almost unusable to me let alone to anyone partially sigted or with colour-blindness) so you might want to think about that as in many countries, you will get into trouble if someone chooses to follow up on it.

  • Interesting, I almost want to see if I can create a honeypot for this and catch one of them in the act. – xxen0nxx Dec 20 '16 at 0:14
  • Interesting, literly right as I made this post I get 2 more. – xxen0nxx Dec 20 '16 at 0:15
  • Well, I think you've done that by accident anyway by not having any protection on it! :-) Expect to see more activity on it over the coming days and weeks. Did you see my request from something@blah.blah? – Julian Knight Dec 20 '16 at 0:16
  • What do you mean no protection. A capcha? Ill be adding that but there is protection on it. – xxen0nxx Dec 20 '16 at 0:18
  • Ahaha and yes I did, I was wondering about that one. – xxen0nxx Dec 20 '16 at 0:18
0

Mail.ru indeed has one of the easier sign ups from the email providers. Which in turn, lets them create a lot of accounts (as Julian mentioned). Afterward, the mail accounts can be used for various purposes.

Main points of attack are weakly protected websites with poor security to login system or overall easily accessible. And since it is also a security company, that adds an additional purpose for them. To try and hijack your production or access your client base for malicious purposes.

Additionally, if your website is built on an exploitable platform or has exploitable parts of the code, registering and trying different means of approach and breakdown of the site is also quite common.

Honestly, there are so many things you need to be concerned when it comes to protection, it's hard to catch everything at once, but my recommendations to anyone making their pages, especially if it contains products or strong client base, is to do thorough research on safe security practice and necessary means of protection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.