5 ms·

> So I'll use amazon@example.com when signing up at Amazon I go a little farther. I figure an attentive spammer might figure out that if I use amazon@johnsmit

> So I'll use amazon@example.com when signing up at Amazon I go a little farther. I figure an attentive spammer might figure out that if I use amazon@johnsmith.net to sign up for Amazon, I may have exactly the scheme where *@johnsmith.net will work, so they can just add that to the spam list as a wildcard and pick a new address every time. So instead, I use john101@johnsmith.net, john102, john103, etc, to try and obscure my strategy and prolong the life of the domain forwarding.

willcipriano 5y ago
I just have a entire domain for the purposes of spam. Anything sent to there ends up in my bulk folder. I use amazon@domain.com so I can tell who sells my email or gets hacked. Never noticed someone trying to send a email to any addresses I haven't previously used.
- wastholm 5y ago
  > Never noticed someone trying to send a email to any addresses I haven't previously used. At least a few years ago, I noticed a lot of spam to <random first name>@<my domain> -- i.e., completely made-up addresses that I had never used. Since messages sent to those addresses were guaranteed to be spam, I started treating them as free training data for the spam filter. I don't know if this still happens, though, because I haven't looked.
  - Grollicus 5y ago
    This is currently happening to my email domain. Gets rejected as it doesn't have a valid hash (recipient name), but the logfiles are full of <3 letters>@mydomain.com and <english_word>@mydomain.com rejections.
    - klyrs 5y ago
      Yeah, this is an age-old issue -- in the early 00s, my mom got a domain and used the email <first_initial>@<domain>.com. She gave up battling the deluge of spam after about a year. We looked through the logs, and saw that her next choice of handle was also getting tons of spam, too, because it was also short.
- batch12 5y ago
  I do the same thing. I use whatever@domain.email. The addresses are temporary if I want them to be and I can automatically lock the senders to a list that is either automatically learned after x days or manually curated. I've seen some 'marketing' mail get filtered but no hacks yet.
- cgriswald 5y ago
  I’ve got amazon@domain.com email for my domain and I’ve never created such an account, much less given it out. Without some uniqueness in the username, I’m not sure you can tell a company sold or lost your data.
nerdponx 5y ago
I've wondered about this with big companies like Facebook, Google, Amazon, etc. as well as behind-the-scenes spyware/ad firms who are all probably very interested in linking my identity across user accounts, email addresses, device fingerprints, etc. I've hoped that there aren't enough people doing it (yet) for these orgs to find it worth the effort.
- macNchz 5y ago
  There very much are companies doing this and selling it as a service...here's an API that you can query with a piece of contact information to retrieve all sorts of additional information, including hashes of alternate email addresses, mobile device ids, social media profiles, and plenty of other stuff: https://platform.fullcontact.com/docs/apis/enrich/person-insights-bundles https://platform.fullcontact.com/docs/apis/enrich/person-ins...
  - rootusrootus 5y ago
    At a certain point -- probably the moment it becomes a business unto itself -- this kind of data collection should be subject to all the same rules we've come up with for credit bureaus. It should be a legal requirement that I can get the entire profile they have built for me.
  - nerdponx 5y ago
    I was wondering specifically if they have special cases to identify such "personal" email domains and use them for record linkage. It seems like an obvious thing to try, but maybe not worth the effort of implementing it, given the high risk of false positives and the low % of people who actually do stuff like this (not to mention they're probably not people who click on ads anyway).
- rootusrootus 5y ago
  Given the sheer amount of money involved, I believe it is likely that there are players in the market who are far more capable than we give them credit for.
bcrosby95 5y ago
Spamming is a numbers game. I kinda doubt enough people are using this scheme to make figuring this out worthwhile for a spammer.
typicalbender 5y ago
Hard truth is you're not worth enough for a spammer to look for that pattern, it's a numbers game and you're just making it harder on yourself. Also unless you're keeping a lookup table you're losing a great benefit of the wildcard. You can, and I have caught a few places, tell when a company sells your email. If I get an email from company XYZ to my email abc@example.com I know exactly who sold my email and to whom.
- rootusrootus 5y ago
  I agree that I'm probably not worth the effort, but if this kind of domain wildcard strategy were to become more popular it is entirely feasible for a rudimentary machine learning algorithm to detect its use. > unless you're keeping a lookup table you're losing a great benefit of the wildcard That's true, I don't keep a lookup table per se, though I do have a deleted items folder that I could look back in. I'm not sure what I would do, though, if I knew what particular company sold my email address? Send them a nastygram they will just ignore? I just block the address and move on.
- labawi 5y ago
  I think a typical spammer doesn't care much about such users, but if given given a choice they would rather avoid such users. AFAIU, most buld spam is targeted on gullible or vulnerable people. The spam is often terrible on purpose. Sophisticated or targeted attacks are a different category and they may be a good reason to prefer something non-guessable.
licebmi__at__ 5y ago
I kinda imagine that spammer go for low hanging fruit. So spammers won’t bother with defeating a catchall domain forwarding, as it’s unlikely to give them returns. Although a motivated attacker might decide to try to send interesting phishing.
dhruvrrp 5y ago
What do you use for email hosting? Ive tried to do something similar but most places have a limit for email addresses even with paid plans.
- SilverRed 5y ago
  Fastmail does not seem to have any limit listed. I have not tested any extreme case since I just use a wildcard.

willcipriano 5y ago

I just have a entire domain for the purposes of spam. Anything sent to there ends up in my bulk folder. I use amazon@domain.com so I can tell who sells my email or gets hacked. Never noticed someone trying to send a email to any addresses I haven't previously used.

wastholm 5y ago
> Never noticed someone trying to send a email to any addresses I haven't previously used. At least a few years ago, I noticed a lot of spam to <random first name>@<my domain> -- i.e., completely made-up addresses that I had never used. Since messages sent to those addresses were guaranteed to be spam, I started treating them as free training data for the spam filter. I don't know if this still happens, though, because I haven't looked.
- Grollicus 5y ago
  This is currently happening to my email domain. Gets rejected as it doesn't have a valid hash (recipient name), but the logfiles are full of <3 letters>@mydomain.com and <english_word>@mydomain.com rejections.
  - klyrs 5y ago
    Yeah, this is an age-old issue -- in the early 00s, my mom got a domain and used the email <first_initial>@<domain>.com. She gave up battling the deluge of spam after about a year. We looked through the logs, and saw that her next choice of handle was also getting tons of spam, too, because it was also short.
batch12 5y ago
I do the same thing. I use whatever@domain.email. The addresses are temporary if I want them to be and I can automatically lock the senders to a list that is either automatically learned after x days or manually curated. I've seen some 'marketing' mail get filtered but no hacks yet.
cgriswald 5y ago
I’ve got amazon@domain.com email for my domain and I’ve never created such an account, much less given it out. Without some uniqueness in the username, I’m not sure you can tell a company sold or lost your data.

nerdponx 5y ago

I've wondered about this with big companies like Facebook, Google, Amazon, etc. as well as behind-the-scenes spyware/ad firms who are all probably very interested in linking my identity across user accounts, email addresses, device fingerprints, etc. I've hoped that there aren't enough people doing it (yet) for these orgs to find it worth the effort.

macNchz 5y ago
There very much are companies doing this and selling it as a service...here's an API that you can query with a piece of contact information to retrieve all sorts of additional information, including hashes of alternate email addresses, mobile device ids, social media profiles, and plenty of other stuff: https://platform.fullcontact.com/docs/apis/enrich/person-insights-bundles https://platform.fullcontact.com/docs/apis/enrich/person-ins...
- rootusrootus 5y ago
  At a certain point -- probably the moment it becomes a business unto itself -- this kind of data collection should be subject to all the same rules we've come up with for credit bureaus. It should be a legal requirement that I can get the entire profile they have built for me.
- nerdponx 5y ago
  I was wondering specifically if they have special cases to identify such "personal" email domains and use them for record linkage. It seems like an obvious thing to try, but maybe not worth the effort of implementing it, given the high risk of false positives and the low % of people who actually do stuff like this (not to mention they're probably not people who click on ads anyway).
rootusrootus 5y ago
Given the sheer amount of money involved, I believe it is likely that there are players in the market who are far more capable than we give them credit for.

bcrosby95 5y ago

Spamming is a numbers game. I kinda doubt enough people are using this scheme to make figuring this out worthwhile for a spammer.

typicalbender 5y ago

Hard truth is you're not worth enough for a spammer to look for that pattern, it's a numbers game and you're just making it harder on yourself. Also unless you're keeping a lookup table you're losing a great benefit of the wildcard. You can, and I have caught a few places, tell when a company sells your email. If I get an email from company XYZ to my email abc@example.com I know exactly who sold my email and to whom.

rootusrootus 5y ago
I agree that I'm probably not worth the effort, but if this kind of domain wildcard strategy were to become more popular it is entirely feasible for a rudimentary machine learning algorithm to detect its use. > unless you're keeping a lookup table you're losing a great benefit of the wildcard That's true, I don't keep a lookup table per se, though I do have a deleted items folder that I could look back in. I'm not sure what I would do, though, if I knew what particular company sold my email address? Send them a nastygram they will just ignore? I just block the address and move on.
labawi 5y ago
I think a typical spammer doesn't care much about such users, but if given given a choice they would rather avoid such users. AFAIU, most buld spam is targeted on gullible or vulnerable people. The spam is often terrible on purpose. Sophisticated or targeted attacks are a different category and they may be a good reason to prefer something non-guessable.

licebmi__at__ 5y ago

I kinda imagine that spammer go for low hanging fruit. So spammers won’t bother with defeating a catchall domain forwarding, as it’s unlikely to give them returns. Although a motivated attacker might decide to try to send interesting phishing.

dhruvrrp 5y ago

What do you use for email hosting? Ive tried to do something similar but most places have a limit for email addresses even with paid plans.

SilverRed 5y ago
Fastmail does not seem to have any limit listed. I have not tested any extreme case since I just use a wildcard.