Say our domain is contoso.com. We have our email set up so if anybody typos an email address it lands at [email protected]. So if you email anybody in the firm but get the email address wrong it will land in the support email box.

We have received emails from Paypal in the support mailbox indicating someone tried to open an account using, say, '[email protected]' which does not exist. We are sure this is not anybody in the firm. Only I have the ability email accounts and I am sure my account has not been compromised.

Question is, why would anybody do this? What's the point of trying to open a Paypal account as [email protected] if you have no way to receive those emails?

2 Answers 2


Background form bots attempt to complete many types of forms including registration forms in the attempt of spreading spam/junk all over the internet.

It's likely the email addresses from your company are being used automatically just to complete the form. They don't always care what form they are competing. Do you get other junk to random addresses at your company? (I suspect so like everyone).


This is what we call as standard Internet background noise. It manifests itself in different ways on different types of systems (webservers, mail servers, routers, VPN concentrators, etc..

It's just hackers using bots to get through points of low resistance. They're not worried about high failure rates because cost is low and payouts are well worth it. I know this sounds like normalization of something evil - it probably is, but the risk is low and cost of defense (beyond standard / minimal best practices) is high - so not quite worth paying much attention.

Now that you know the type of attack, do setup alerts - not for the failures, but for a success after a string of failures.

If you have a reputation system, you could also add any metadata you have about the attempt - for future tracking of potentially legitimate access from the same/similar source. Most reputation systems are IP address based - a technique that is low-fidelity in this day and age. So try to go beyond that if your logs have more info.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .