Strange unsolicited email sent to almost never used email address

Question

What initially looked like typical spam now seems extra odd and is bugging me (only figuratively I hope).

Ostensibly, a sales rep from DomainNameSales.com (DNS), which I'd never heard of, sent an unsolicited sales pitch to an almost-never used email address of mine offering a domain name for sale I'd never considered.

Among bottom-feeder types, i.e., the world of hording and selling domain names, this group seems somewhat legit, but I can't figure out how the heck they got my weird email address I'd forgotten. Searching the web for this odd address yielded zero results in DuckDuckGo and Google. I apparently configured the acct years ago to forward to an active address of mine, which labeled the forwarded email and made the spam stand out like a sore thumb in my inbox.

I checked the real contact info for corresponding private whois domains I manage and confirmed I hadn't used the odd address there. Now I wonder if my old odd email acct was hacked (I didn't know its password and failed to answer the security questions but regained control via its parent email acct).

Meanwhile, the same salesperson from domainnamesales has sent 4 or 5 messages to the same odd address asking me to make an offer.

This smells exceptionally bad because (1) I've never received any other email at this address before including spam! and (2) the offered domain is plausibly related to my real name even though the body's salutation has the wrong first and last name.

It's creeping me out like it's a spear phishing campaign.

Anyone else seen this? I searched domain-name forums (yuck) and couldn't find anything about this under "warnings" and "scams."

If it wasn't for the address they sent it to, I would've just trashed and ignored the messages. It's like receiving a forwarded package addressed to an abandoned cabin you bought but only used once or twice 6 years ago.

Answer 1

A critical piece of information is, is your old mail account - not its password - easily guessable and related to you?

For example, my old ADSL company by default assigned me an authenticating username (only valid on copper, so totally superfluous - if I can authenticate at all, then I'm physically connected!). I never used it anywhere.

But if my name is Mario Rossi and my email is mrossi@gnail.com, and I use ThatProvider, then I surely have also a Mario.Rossi@ThatProvider.it address.

I too set up a forwarding, thinking that the company would send there some email of interest to me (such as "Service Interruption Next Thursday"). (Actually they never did, and used my public email address instead. But I sort of forgot/didntcared the forwarding in place).

And so a coupla years ago some smart guy generated

for name in MostFrequentItalianNames:
    for surname in MostFrequentItalianSurnames:
        address = name + "." + surname + "@ThatProvider.it"

and let fly with a million emails. I got two of them.

(On an unrelated note, it got even better. From my IP on a Usenet post, my name and surname could be garnered as well as the fact that I was a ThatProvider customer. A targeted attempt using "Name.Surname@ThatProvider.it" as login, and passwords from { Name, Surname, admin, password, apritisesamo, pippo, pluto, topolino... } on my home router HTTP remote administration interface immediately followed).

So, if your old account is similarly generated, and there is a relation between your old name/surname and the domain being offered OR some googleable connection between same, this could have happened to you too.

Answer 2

I run my own email server, so, typically, when I need to register software I've purchased, or provide an email address associated with registration at a website, I create a unique alias that identifies the company or site, e.g., if I register with Acme Corporation, it may be acmecorp011315@example.com. If I start receiving spam at that address, I know where the spammer got the email and I invalidate the email alias and will normally terminate any further relationship with that company. Many years ago I registered software I purchased from Brøderbund Software using such an email address. The company eventually was purchased by another company. It was not until quite some time years after the company ceased to exist that I started getting spam to that address. Since the address was not something a spammer would have guessed, my assumption was that the company's mailing list was either an asset eventually sold to others or someone compromised a system belonging to some company that subsequently acquired the Brøderbund Software email list.

I've also had a similar situation occur with another very large, still extant company. I only used the email address for that company and almost never got any email to it for years. Then, recently, I started getting a barrage of spam to that address for all sorts of dubious products and services. So I assume the company either sold their mailing list, or some employee of the company sold it unbeknownst to the company, or one of their systems was compromised by outsiders who copied their mailing list.

I've also seen a number of incidents where someone's PC was compromised and malware scanned the system looking for email addresses which it then used to try to trick others into thinking they were getting email from someone they knew by using an email it found as the "from" address. I presume such found addresses could also be sold, instead, though I'm not aware of that happening.

So when you mentioned the address was an "almost-never used email address of mine", the possibility that someone else had that email address and sold it or it was taken from one of their systems seemed to be a possible explanation, though it does seem odd, if that was the case, that you would only see email to it from that one source. I would have expected that you would be seeing mail from other sources to it, also, if that is what happened, unless DomainNameSales was the only company interested in purchasing a list that contained your old email address.

Answer 3

Well, shame on me. It turns out I had submitted a domain name sales query long ago with this odd email address and totally forgot about it.

The sender just answered my question about how they got my odd email address, stating I inquired about the domain months ago. They included the date of my inquiry and my correct IP address, plus the domain name is similar to my Twitter account.

In the months it took them to reply, I completely forgot about my inquery, mostly likely submitted during a groggy late night session.

My apologies for the false alarm. The replies were informative, though, so thank you. Go ahead and downvote the original post since I blew it.