6 ms·

I'm glad you had a good experience. I had a different one. I've ran my own domain for longer than you have, and many emails have been compromised. Some are 1

I'm glad you had a good experience. I had a different one. I've ran my own domain for longer than you have, and many emails have been compromised. Some are 100% from companies selling the emails to sister companies. The majority, though, is from a company itself being compromised by hackers / database access / etc. LinkedIn, Neopets, ProFlowers, TeeSpring, etc. I can go on.

bombcar 4y ago
Compromises are 99% of those I see (similar setup) - the last 1% is acquired companies that have pivoted/do something else. It's not quite spam, it's not quite illegitimate, but it's not what I signed up for.
- jawns 4y ago
  I've seen a shift. Between 2005-2010, I used [company]@[mydomain.com], and I noticed that I would get spam in the form of [gibberish]@[mydomain.com], presumably from spammers who were just targeting email addresses with a catch-call filter. In fact, around that time, my hosting provider, Dreamhost, started restricting email catch-alls to deal with this problem. But then from around 2010 onward, that type of spam became much less common, and nowadays it's as you say. The vast majority, probably 90%, come from compromised accounts, like linkedin@[mydomain.com]. The rest hit the unique email addresses I have submitted in domain registration forms. That's even more surprising considering that I've since shifted to using [username]+[company]@[mydomain.com]. Spammers could pretty easily strip off the `+[company]`, but I haven't seen that happen much.
  - bombcar 4y ago
    We've successfully pushed spam down hard enough that the only people spamming are people who never even see your email address; it's all computerized and they just don't care at all to try to do anything to clean up the lists.
  - stormbrew 4y ago
    The gibberish name ones may be targeting backscatter. They might have a reply-to with the address they're really targeting. And that may have dropped off because there was a concerted effort to make it harder to do that around then. In particular, that's kind of what killed qmail as an in-vogue MTA, because it wasn't being updated and you had to use awkward patches to stop backscatter.
- ziddoap 4y ago
  >It's not quite spam, it's not quite illegitimate, but it's not what I signed up for. If it's not what you signed up for, isn't that pretty much the definition of spam?
  - bombcar 4y ago
    You usually sign up for "company updates" or some such nomenclature, but after Bob's Discount Swords pivots to Improved Plowshares™, it's not really relevant anymore. Then again, I actually fill out that little question after unsubscribing. The above I consider "legit" as long as unsubscribe works.
    - thewebcount 4y ago
      In my experience, you don't sign up for anything, but are automatically added to mailing lists against your will just for the sin of purchasing something. I never want to get emails from any company just because I purchased 1 item from them. Most people I know tell me they feel the same way, but instead of unsubscribing, they just mark it as spam and eventually it stops showing up in their inbox. If I want emails from you, I will explicitly ask to be added to your mailing list. Anything else is spam as far as I'm concerned.
      - denton-scratch 4y ago
        > just for the sin of purchasing something Ah: prior commercial relationship. That's not spam, unless they ignore your unsubscribe request. I hope you're not notifying the world that your preferred supplier of [X] is a spammer. I like to stay on good terms with my preferred suppliers.
        aendruk 4y ago
        illegal spam ⊆ spam If I didn’t ask for it, it’s spam, regardless of whatever holes the US has punched in its definition to keep business owners happy.
  - denton-scratch 4y ago
sokoloff 4y ago
Similar here. I don't recall when I started doing it, but it's been at least 20 years. I get a fair amount of spam from "well, what did you expect?" addresses (social sites, mostly) and some from addresses that are hard to pin down (paypal address might be shared to a seller; amazon address is definitely shared to sellers). The most surprising one is ongoing spam (and semi-legitimate contacts from recruiters) to an address that I only (intentionally) used at O'reilly. I just checked HIBP and that address was exposed in the July 2018 Apollo exposure.
- Brian_K_White 4y ago
  I'd love a wall of shame that collected all these bad examples. It would have to somehow be protected against bad actors scrubbing themselves by any other means than no longer being bad actors.
bagels 4y ago
Had the same experience when TD Ameritrade had an employee selling email addresses. My scheme is company+10 random digits, it was clearly not guessed.
saxonww 4y ago
The worst offender for me is an email address I used to get a fishing license from the state fish and wildlife group. As soon as I did that, I started getting advertisements from some outfitter/prepper type places. Not sure if they bought the address or if licensee info is public in my state.
- brightball 4y ago
  I made the mistake of using my primary address when I decided to get my real estate license years ago. It’s on another level now.
- jimmydddd 4y ago
  Probably public. In NJ, you get snail mail solicitations when you register stuff at the DMV.
pavon 4y ago
I have a similar experience. I've been using this system for about 15 years, and have to block one or two address a year due to spam. A couple were due to first party spam that I could not manage to unsubscribe from (Cooks Illustrated, I'm looking at you), and a few scraped from forums (didn't realize the email would be public when signing up). The rest appeared to be due to an account compromise (based on breadth of low quality spam) - oh and less than 1/4 of those sites notified me of a compromise. I don't think I've ever received spam from what appears to be a "legitimate" "business partner" which is what I would expect from emails that were sold. I also get a handful of spams a month from default addresses (hostmaster, etc), all of which come from Chinese IPs. I don't have any email address posted on my websites to scrape from (mailto: or otherwise), so I don't get any spam from that. The end result is pretty much no spam. I assumed when I first setup my domain I'd have to configure spam assassin at some point, but that point has never come, thankfully.
zndr 4y ago
Seconding this. And to compound this after doing a half ass job of what OP has done, I recently moved my custom google apps free domain to have a second reception domain i use JUST for this with a `.email` TLD (side note: the amount of tools that don't see modern TLD's as valid is enraging)> I made the (maybe poor) choice of donating to political campaigns before the last US election using these emails - `Biden-campaign@` - `democrats@` - `<specific local race@` All of those I've had to unsubscribe from about 2-3 dozen total OTHER email lists as those emails are literally sold/given out to other campaigns. the biden one being the worst. Also if you have your own business you'll start getting solicitations, LOTS of solicitations. And god forbid your email is on an old resume, or somewhere else. Now, is any of this "technically" spam? Maybe but not really. Do I consider it worthless? yes. But to site your last specific one. I did a search for an address I know was on a compromised product. Specifically a game Heroes of Newerth. They were hacked in I believe 2015 and the list was sold. My email was my old method `name+hon@email.domain`. I get like 20~ emails to that a year and all of them go to spam or are flagged as spam automatically.
- archi42 4y ago
  Yeah, HoN was the first of my catch-alls to receive spam. Idiots didn't even acknowledge that they have been compromised and insisted that obviously I did use hon@mail.mydomain.tld somewhere else. These days I'd use the opportunity to check how well GDPR works in practice.
akira2501 4y ago
I've noticed a lot of "mid size" compromises. The pizza place down the street uses a third party digital order system, that was compromised. One of the first emails I actually had to blackhole due to the insane volume of spam and attacks that started coming to it. Also.. my previous landlord. His computer or account got compromised at some point, and that was another email I had to blackhole due to the insane volume of porn spam that started coming to it.
moontear 4y ago
Exactly my experience. The leaked emails are pretty much always related to hacks/leaks of said companies. I have a couple of addresses that look to have been sold (e.g. addresses used in cheap kickstarter campaigns), but that is more rare.
ChristopherDrum 4y ago
Yes, I have been doing exactly the same for at least 15 years now and have had a wide variety of throwaway/registration emails compromised.
prawn 4y ago
Same. I get spam/phishing at a number of the custom email addresses I've used. Including adobe@, elance@, etc.

bombcar 4y ago

Compromises are 99% of those I see (similar setup) - the last 1% is acquired companies that have pivoted/do something else. It's not quite spam, it's not quite illegitimate, but it's not what I signed up for.

jawns 4y ago
I've seen a shift. Between 2005-2010, I used [company]@[mydomain.com], and I noticed that I would get spam in the form of [gibberish]@[mydomain.com], presumably from spammers who were just targeting email addresses with a catch-call filter. In fact, around that time, my hosting provider, Dreamhost, started restricting email catch-alls to deal with this problem. But then from around 2010 onward, that type of spam became much less common, and nowadays it's as you say. The vast majority, probably 90%, come from compromised accounts, like linkedin@[mydomain.com]. The rest hit the unique email addresses I have submitted in domain registration forms. That's even more surprising considering that I've since shifted to using [username]+[company]@[mydomain.com]. Spammers could pretty easily strip off the `+[company]`, but I haven't seen that happen much.
- bombcar 4y ago
  We've successfully pushed spam down hard enough that the only people spamming are people who never even see your email address; it's all computerized and they just don't care at all to try to do anything to clean up the lists.
- stormbrew 4y ago
  The gibberish name ones may be targeting backscatter. They might have a reply-to with the address they're really targeting. And that may have dropped off because there was a concerted effort to make it harder to do that around then. In particular, that's kind of what killed qmail as an in-vogue MTA, because it wasn't being updated and you had to use awkward patches to stop backscatter.
ziddoap 4y ago
>It's not quite spam, it's not quite illegitimate, but it's not what I signed up for. If it's not what you signed up for, isn't that pretty much the definition of spam?
- bombcar 4y ago
  You usually sign up for "company updates" or some such nomenclature, but after Bob's Discount Swords pivots to Improved Plowshares™, it's not really relevant anymore. Then again, I actually fill out that little question after unsubscribing. The above I consider "legit" as long as unsubscribe works.
  - thewebcount 4y ago
    In my experience, you don't sign up for anything, but are automatically added to mailing lists against your will just for the sin of purchasing something. I never want to get emails from any company just because I purchased 1 item from them. Most people I know tell me they feel the same way, but instead of unsubscribing, they just mark it as spam and eventually it stops showing up in their inbox. If I want emails from you, I will explicitly ask to be added to your mailing list. Anything else is spam as far as I'm concerned.
    - denton-scratch 4y ago
      > just for the sin of purchasing something Ah: prior commercial relationship. That's not spam, unless they ignore your unsubscribe request. I hope you're not notifying the world that your preferred supplier of [X] is a spammer. I like to stay on good terms with my preferred suppliers.
      - aendruk 4y ago
        illegal spam ⊆ spam If I didn’t ask for it, it’s spam, regardless of whatever holes the US has punched in its definition to keep business owners happy.
- denton-scratch 4y ago

sokoloff 4y ago

Similar here. I don't recall when I started doing it, but it's been at least 20 years. I get a fair amount of spam from "well, what did you expect?" addresses (social sites, mostly) and some from addresses that are hard to pin down (paypal address might be shared to a seller; amazon address is definitely shared to sellers). The most surprising one is ongoing spam (and semi-legitimate contacts from recruiters) to an address that I only (intentionally) used at O'reilly. I just checked HIBP and that address was exposed in the July 2018 Apollo exposure.

Brian_K_White 4y ago
I'd love a wall of shame that collected all these bad examples. It would have to somehow be protected against bad actors scrubbing themselves by any other means than no longer being bad actors.

bagels 4y ago

Had the same experience when TD Ameritrade had an employee selling email addresses. My scheme is company+10 random digits, it was clearly not guessed.

saxonww 4y ago

The worst offender for me is an email address I used to get a fishing license from the state fish and wildlife group. As soon as I did that, I started getting advertisements from some outfitter/prepper type places. Not sure if they bought the address or if licensee info is public in my state.

brightball 4y ago
I made the mistake of using my primary address when I decided to get my real estate license years ago. It’s on another level now.
jimmydddd 4y ago
Probably public. In NJ, you get snail mail solicitations when you register stuff at the DMV.

pavon 4y ago

I have a similar experience. I've been using this system for about 15 years, and have to block one or two address a year due to spam. A couple were due to first party spam that I could not manage to unsubscribe from (Cooks Illustrated, I'm looking at you), and a few scraped from forums (didn't realize the email would be public when signing up). The rest appeared to be due to an account compromise (based on breadth of low quality spam) - oh and less than 1/4 of those sites notified me of a compromise. I don't think I've ever received spam from what appears to be a "legitimate" "business partner" which is what I would expect from emails that were sold. I also get a handful of spams a month from default addresses (hostmaster, etc), all of which come from Chinese IPs. I don't have any email address posted on my websites to scrape from (mailto: or otherwise), so I don't get any spam from that. The end result is pretty much no spam. I assumed when I first setup my domain I'd have to configure spam assassin at some point, but that point has never come, thankfully.

zndr 4y ago

Seconding this. And to compound this after doing a half ass job of what OP has done, I recently moved my custom google apps free domain to have a second reception domain i use JUST for this with a `.email` TLD (side note: the amount of tools that don't see modern TLD's as valid is enraging)> I made the (maybe poor) choice of donating to political campaigns before the last US election using these emails - `Biden-campaign@` - `democrats@` - `<specific local race@` All of those I've had to unsubscribe from about 2-3 dozen total OTHER email lists as those emails are literally sold/given out to other campaigns. the biden one being the worst. Also if you have your own business you'll start getting solicitations, LOTS of solicitations. And god forbid your email is on an old resume, or somewhere else. Now, is any of this "technically" spam? Maybe but not really. Do I consider it worthless? yes. But to site your last specific one. I did a search for an address I know was on a compromised product. Specifically a game Heroes of Newerth. They were hacked in I believe 2015 and the list was sold. My email was my old method `name+hon@email.domain`. I get like 20~ emails to that a year and all of them go to spam or are flagged as spam automatically.

archi42 4y ago
Yeah, HoN was the first of my catch-alls to receive spam. Idiots didn't even acknowledge that they have been compromised and insisted that obviously I did use hon@mail.mydomain.tld somewhere else. These days I'd use the opportunity to check how well GDPR works in practice.

akira2501 4y ago

I've noticed a lot of "mid size" compromises. The pizza place down the street uses a third party digital order system, that was compromised. One of the first emails I actually had to blackhole due to the insane volume of spam and attacks that started coming to it. Also.. my previous landlord. His computer or account got compromised at some point, and that was another email I had to blackhole due to the insane volume of porn spam that started coming to it.

moontear 4y ago

Exactly my experience. The leaked emails are pretty much always related to hacks/leaks of said companies. I have a couple of addresses that look to have been sold (e.g. addresses used in cheap kickstarter campaigns), but that is more rare.

ChristopherDrum 4y ago

Yes, I have been doing exactly the same for at least 15 years now and have had a wide variety of throwaway/registration emails compromised.

prawn 4y ago

Same. I get spam/phishing at a number of the custom email addresses I've used. Including adobe@, elance@, etc.