3 ms·

> Another interesting gail.com factoid: my amazing e-mail provider, ProtonMail, rejects about 1.2 million mis-addressed e-mails per week to the gail.com domain.

> Another interesting gail.com factoid: my amazing e-mail provider, ProtonMail, rejects about 1.2 million mis-addressed e-mails per week to the gail.com domain. Would be interesting to set up mail servers on "mistyped" domain names. I wouldn't be surprised if you could get sensitive information that would be useful for spear phishing.

paulgb 5y ago
There's a similar attack involving registering domains that are a bit flip off from a well-known domain. https://arstechnica.com/gadgets/2021/03/windows-com-bitsquatting-hack-can-wreak-unknown-havoc-on-pcs/ https://arstechnica.com/gadgets/2021/03/windows-com-bitsquat...
zimpenfish 5y ago
> I wouldn't be surprised if you could get sensitive information that would be useful for spear phishing. I know a bunch of people with common names who frequently get misdirected gmails that include car rentals, doctor appointments, hotel bookings, etc. I've only had a few (<10), alas, and they were mostly about buying art. (Although who knows? Maybe those "misdirected" emails are themselves a sophisticated attack to get people to click on the "unsubscribe" or "this is not me" links...)
- notJim 5y ago
  I have a relatively common name in South America, and get all kinds of stuff. Travel itineraries, legal documents, info about kids soccer matches, all sorts of stuff. I used to try to help people but it’s honestly pretty annoying, so I just delete it now.
- verve_rat 5y ago
  Yeah, I have a firstname.lastname@gmail address and I have received mortgage documents for two different people in two different countries.
tephra 5y ago
I created a little python script that took a list of domains and created various misspellings of those domains, checked for MX records set for them. I ran this on a list of "sensitive domains" (law authorities, government agencies etc). For example there were 2-3 domains for misspellings of "polisen.se" (the Swedish police) that had MX records set and were presumably receiving some emails they shouldn't.
jobigoud 5y ago
Also known as typosquatting https://en.wikipedia.org/wiki/Typosquatting https://en.wikipedia.org/wiki/Typosquatting
RamRodification 5y ago
An interesting fact: A factoid is not "a small piece of fact", it is infact: an item of unreliable information that is reported and repeated so often that it becomes accepted as fact.
- jasonhansel 5y ago
  An interesting factoid: though that was the original (and etymologically correct) meaning of the word "factoid," the meaning has since shifted. The word can now also mean "a briefly stated and usually trivial fact." Source: https://www.merriam-webster.com/dictionary/factoid https://www.merriam-webster.com/dictionary/factoid

paulgb 5y ago

There's a similar attack involving registering domains that are a bit flip off from a well-known domain. https://arstechnica.com/gadgets/2021/03/windows-com-bitsquatting-hack-can-wreak-unknown-havoc-on-pcs/ https://arstechnica.com/gadgets/2021/03/windows-com-bitsquat...

zimpenfish 5y ago

> I wouldn't be surprised if you could get sensitive information that would be useful for spear phishing. I know a bunch of people with common names who frequently get misdirected gmails that include car rentals, doctor appointments, hotel bookings, etc. I've only had a few (<10), alas, and they were mostly about buying art. (Although who knows? Maybe those "misdirected" emails are themselves a sophisticated attack to get people to click on the "unsubscribe" or "this is not me" links...)

notJim 5y ago
I have a relatively common name in South America, and get all kinds of stuff. Travel itineraries, legal documents, info about kids soccer matches, all sorts of stuff. I used to try to help people but it’s honestly pretty annoying, so I just delete it now.
verve_rat 5y ago
Yeah, I have a firstname.lastname@gmail address and I have received mortgage documents for two different people in two different countries.

tephra 5y ago

I created a little python script that took a list of domains and created various misspellings of those domains, checked for MX records set for them. I ran this on a list of "sensitive domains" (law authorities, government agencies etc). For example there were 2-3 domains for misspellings of "polisen.se" (the Swedish police) that had MX records set and were presumably receiving some emails they shouldn't.

jobigoud 5y ago

Also known as typosquatting https://en.wikipedia.org/wiki/Typosquatting https://en.wikipedia.org/wiki/Typosquatting

RamRodification 5y ago

An interesting fact: A factoid is not "a small piece of fact", it is infact: an item of unreliable information that is reported and repeated so often that it becomes accepted as fact.

jasonhansel 5y ago
An interesting factoid: though that was the original (and etymologically correct) meaning of the word "factoid," the meaning has since shifted. The word can now also mean "a briefly stated and usually trivial fact." Source: https://www.merriam-webster.com/dictionary/factoid https://www.merriam-webster.com/dictionary/factoid