4 ms·

I have an email address that I've only ever used as my AWS account email since many years ago. Somehow I started getting spam on it last year. It is not an addr

by aviv 8y ago

I have an email address that I've only ever used as my AWS account email since many years ago. Somehow I started getting spam on it last year. It is not an address anyone could guess or somehow generate based on other data points such as name or otherwise.

hkai 8y ago
I am using a separate email for each website, using the catch-all email feature. It helped me find out a couple of local companies that are selling my data to spammers.
bhauer 8y ago
Many of us who operate our own mail services use a unique email address for every web service we use. You'd be surprised how many of these unique email addresses I've received spam at (and have subsequently blackholed). I would estimate less than 50% of the associated services ever report a data breach event. I figure either there has been an unreported breach or, possibly more likely, the service sold their userlist either directly to spammers or sold it to another group who was themselves breached. The upside, though, is that blackholing an address used for a single service is super simple and satisfying.
- scomp 8y ago
  Do you have any more info on running your own mail server? I looked at doing so but was promptly steered away because of blacklisting, servers that allow it and redundancy.
  - yerasame 8y ago
    I'm not sure what the up or downsides would be, but I personally just have all mail sent to *@mydomain.tld forwarded to a single email address. This way I can give each service a unique email address, while preserving the ability to divine whether a particular address has been lost or stolen, by looking at the sent to field. Well, there's the obvious comfort of having all your mail in one place -- and all the obvious disadvantages that entails, I suppose.
  - dhuramas 8y ago
    Can't recommend FastMail enough- it has aliases which automatically forward mail from xyz@alias.yourdomain.com to your alias@yourdomain.com - This is very similar in practice to the + trick with gmail[1] but with the benefit that your email addresses will pass all stupid Javascript email validation rules. [1] https://www.thewindowsclub.com/gmail-address-tricks https://www.thewindowsclub.com/gmail-address-tricks
    - ReidZB 8y ago
      You can also set up wildcard aliases, e.g. I have the equivalent of *@example.com, leading to addresses like hackernews@example.com.
    - aviv 8y ago
      Been using Fastmail for ages... great provider.
- anotherevan 8y ago
  I do something similar using https://www.spamgourmet.com/ https://www.spamgourmet.com/ Although many services are getting wise to many of these services and not let you sign up with their domains.
- eridius 8y ago
  I would guess most companies are not in the business of selling their user email lists, but rather, shared the user's email with a third-party company that provided some service, and that third-party company then sold it.
- _coveredInBees 8y ago
  You can do this with a gmail account too. If your email address is johnsmith@gmail.com...the following addresses all fwd to your main address John.smith@gmail.com Johnsmith+quora@gmail.com Johnsmith+equifax@gmail.com Etc...
  - ALittleLight 8y ago
    Can't the spammer just s/'\+.*@'/'@'/ or something and throw away the + sign and all that follows? Or the company could do this if they were selling your email address.
  - brocket 8y ago
    I used to use this technique for many years, but occasionally ran into issues with form validators rejecting the email address. I finally stopped because I never got spam from those email addresses (even in spam folder). I figured it's trivial for spammers to strip out the extra text, any half-decent spammer should know this trick. Also, I suspected they might change the +text to put the blame on someone else.
  - tedunangst 8y ago
    While we're on the subject, all combinations of dots are equivalent. this.isme and th.isisme and thisis.me, etc. Finite variety, but good enough for a few generic throwaways and never filtered or stripped that I've seen.
  - ahje 8y ago
    I use domain.tld@subdomain.domain.tld combined with a catch-all address for that sub-domain. It gets around various email validation regexes that won't accept +.
- varenc 8y ago
  As an anecdote to that: I've received recruiter spam to "<my_email>+fuckyouadobe@gmail.com". Turns out when I was forced to signed up for an Adobe account years ago I'd added "+fuckyouadobe" to my email and, of course, Adobe was inevitably hacked. The leaked database had somehow made its way into recruiter software. The recruiter told me their vendor and when I got in touch with them (Aevy.com) they, of course, had no idea how that email got there. Sadly these days people are probably smart enough to strip out these additions to gmail addresses. I would guess that's what Aevy did after I reached out...

by aviv 8y ago

hkai 8y ago

I am using a separate email for each website, using the catch-all email feature. It helped me find out a couple of local companies that are selling my data to spammers.

bhauer 8y ago

Many of us who operate our own mail services use a unique email address for every web service we use. You'd be surprised how many of these unique email addresses I've received spam at (and have subsequently blackholed). I would estimate less than 50% of the associated services ever report a data breach event. I figure either there has been an unreported breach or, possibly more likely, the service sold their userlist either directly to spammers or sold it to another group who was themselves breached. The upside, though, is that blackholing an address used for a single service is super simple and satisfying.

scomp 8y ago
Do you have any more info on running your own mail server? I looked at doing so but was promptly steered away because of blacklisting, servers that allow it and redundancy.
- yerasame 8y ago
  I'm not sure what the up or downsides would be, but I personally just have all mail sent to *@mydomain.tld forwarded to a single email address. This way I can give each service a unique email address, while preserving the ability to divine whether a particular address has been lost or stolen, by looking at the sent to field. Well, there's the obvious comfort of having all your mail in one place -- and all the obvious disadvantages that entails, I suppose.
- dhuramas 8y ago
  Can't recommend FastMail enough- it has aliases which automatically forward mail from xyz@alias.yourdomain.com to your alias@yourdomain.com - This is very similar in practice to the + trick with gmail[1] but with the benefit that your email addresses will pass all stupid Javascript email validation rules. [1] https://www.thewindowsclub.com/gmail-address-tricks https://www.thewindowsclub.com/gmail-address-tricks
  - ReidZB 8y ago
    You can also set up wildcard aliases, e.g. I have the equivalent of *@example.com, leading to addresses like hackernews@example.com.
  - aviv 8y ago
    Been using Fastmail for ages... great provider.
anotherevan 8y ago
I do something similar using https://www.spamgourmet.com/ https://www.spamgourmet.com/ Although many services are getting wise to many of these services and not let you sign up with their domains.
eridius 8y ago
I would guess most companies are not in the business of selling their user email lists, but rather, shared the user's email with a third-party company that provided some service, and that third-party company then sold it.
_coveredInBees 8y ago
You can do this with a gmail account too. If your email address is johnsmith@gmail.com...the following addresses all fwd to your main address John.smith@gmail.com Johnsmith+quora@gmail.com Johnsmith+equifax@gmail.com Etc...
- ALittleLight 8y ago
  Can't the spammer just s/'\+.*@'/'@'/ or something and throw away the + sign and all that follows? Or the company could do this if they were selling your email address.
- brocket 8y ago
  I used to use this technique for many years, but occasionally ran into issues with form validators rejecting the email address. I finally stopped because I never got spam from those email addresses (even in spam folder). I figured it's trivial for spammers to strip out the extra text, any half-decent spammer should know this trick. Also, I suspected they might change the +text to put the blame on someone else.
- tedunangst 8y ago
  While we're on the subject, all combinations of dots are equivalent. this.isme and th.isisme and thisis.me, etc. Finite variety, but good enough for a few generic throwaways and never filtered or stripped that I've seen.
- ahje 8y ago
  I use domain.tld@subdomain.domain.tld combined with a catch-all address for that sub-domain. It gets around various email validation regexes that won't accept +.
varenc 8y ago
As an anecdote to that: I've received recruiter spam to "<my_email>+fuckyouadobe@gmail.com". Turns out when I was forced to signed up for an Adobe account years ago I'd added "+fuckyouadobe" to my email and, of course, Adobe was inevitably hacked. The leaked database had somehow made its way into recruiter software. The recruiter told me their vendor and when I got in touch with them (Aevy.com) they, of course, had no idea how that email got there. Sadly these days people are probably smart enough to strip out these additions to gmail addresses. I would guess that's what Aevy did after I reached out...