4 ms·

To answer this, I'd need to see the header to the email, excluding your actual email address of course. The header would allow me to see the context surrounding

To answer this, I'd need to see the header to the email, excluding your actual email address of course. The header would allow me to see the context surrounding it, which might offer some insight. Otherwise, who knows. They might have just sent spam to millions of generated addresses, and tracked the ones that didn't bounce.

turkeygizzard 4y ago
Just curious because I don't know enough about this stuff - what kind of fingerprint would you be looking for in the header that could tell you whether they knew the address ahead of time?
- geocrasher 4y ago
  I wouldn't be able to tell that specifically, but instead it would provide context to the emails that may yield other clues about the sender and their overall methods.
throw10920 4y ago
I have a few dozen of these email addresses and very rarely get spam to any of them - then received two spams to the same address within the span of a few days. It seems relatively unlikely that it was just guessing. I'll try to provide redacted headers within the next day or two so that interested parties can take a look anyway.
throw10920 4y ago
I have retrieved the headers: Return-Path: <barrywvarneyh952@gmail.com> Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by sloti44n40 (Cyrus 3.7.0-alpha0-935-ge4ccd4c47b-fm-20220914.001-ge4ccd4c4) with LMTPA; Fri, 23 Sep 2022 09:14:21 -0400 X-Cyrus-Session-Id: sloti44n40-1663938861-1037676-2-16521453121443000607 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-sender-reputation: 500 (none) X-Spam-score: 0.1 X-Spam-hits: DCC_REPUT_13_19 -0.1, FREEMAIL_ENVFROM_END_DIGIT 0.25, FREEMAIL_FROM 0.001, HTML_MESSAGE 0.001, ME_SENDERREP_NEUTRAL 0.001, RCVD_IN_DNSWL_NONE -0.0001, RCVD_IN_MSPIKE_H2 -0.001, SPF_HELO_NONE 0.001, SPF_PASS -0.001, TVD_SPACE_RATIO 0.001, T_FREEMAIL_DOC_PDF 0.01, LANGUAGES unknown, BAYES_USED none, SA_VERSION 3.4.6 X-Spam-source: IP='209.85.219.49', Host='mail-qv1-f49.google.com', Country='US', FromHeader='com', MailFrom='com' X-Spam-charsets: plain='UTF-8', html='UTF-8' X-Attached: Details (3).pdf X-Resolved-to: <throw10920 address> X-Delivered-to: <throw10920 address> X-Mail-from: barrywvarneyh952@gmail.com Received: from mx5 ([10.202.2.204]) by compute4.internal (LMTPProxy); Fri, 23 Sep 2022 09:14:21 -0400 Received: from mx5.messagingengine.com (localhost [127.0.0.1]) by mailmx.nyi.internal (Postfix) with ESMTP id 634BF2720140 for <throw10920 address>; Fri, 23 Sep 2022 09:14:21 -0400 (EDT) Received: from mx5.messagingengine.com (localhost [127.0.0.1]) by mx5.messagingengine.com (Authentication Milter) with ESMTP id 56AEB231292; Fri, 23 Sep 2022 09:14:21 -0400 ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=fm2; t= 1663938861; b=qDtS28CDS2y28h3ycCzz2olah3lAZcdJBi4/I894gWSs2KZIOj vNX/FQ+GrIpNZJv8kS+8EDKztM5Uk72CdkDUs9SIeTt+Xujswj1PxeW3Pt1y8wtw edscLRzagS8u88INStmdmu+BELCeckywd/Zd1+6Dx9FUbgMRioGWZfVr1A3WOK3z WQjw7G4LoAA+rd62+3B1gfYQq1CgMYq+2hDH8+w+k21PZXbgcfGdLh5UKSRjZsvJ NXfpYl+q7b6CMTp7+G+rwJKQAYNB11ZFCyyZXapRsPLuwDqxD3zpyrHJbkdRT8CU WXBsFU0+Upmf/MhRfEnivF/RqrH0qmdPXUAg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=mime-version:from:date:message-id:subject :to:content-type; s=fm2; t=1663938861; bh=mgoaWyWp1yTWBa0JtRKZ3J G3oT/BJWrtmRX+y6Pw8Ig=; b=sNMnMvPQYLl9OhPIu+/FvA4GQcAIPIxBNTNyIE tGDrOjDD85df2gsz5dqBQgbLhWWHG6BSROCVxolcMciApfSwo0IFL31MMxLlFyOT FjVMXTnvnUbqb74pyJAva3DzEBzAg6iEz7gROUmJhxI9TI1jICx8a4t1brm5cmXU oUOmMASTfD9/PhDsuMD1tilvHzbrjfPOI8T10aPHHcijmmHUGvuy+IozlVVTzfxX Q9XuwDLs6NiUCNV1nXRa0fW7GK3U/vXqKxa5jYYQ7YxbQSqJ3SVlSimBVZfSxuRa Vsisua3ZCkDsb7THQ7ZajWcDR7lvADeKST24899ukfXWVHcA== ARC-Authentication-Results: i=1; mx5.messagingengine.com; x-csa=none; x-me-sender=none; x-ptr=pass smtp.helo=mail-qv1-f49.google.com policy.ptr=mail-qv1-f49.google.com; bimi=skipped (DMARC Policy is not at enforcement); arc=none (no signatures found); dkim=pass (2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=h/YxiNwR header.a=rsa-sha256 header.s=20210112 x-bits=2048; dmarc=pass policy.published-domain-policy=none policy.published-subdomain-policy=quarantine policy.applied-disposition=none policy.evaluated-disposition=none (p=none,sp=quarantine,d=none,d.eval=none) policy.policy-from=p header.from=gmail.com; iprev=pass smtp.remote-ip=209.85.219.49 (mail-qv1-f49.google.com); spf=pass smtp.mailfrom=barrywvarneyh952@gmail.com smtp.helo=mail-qv1-f49.google.com X-ME-Authentication-Results: mx5.messagingengine.com; x-aligned-from=pass (Address match); x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=iv6O/RRb; x-return-mx=pass header.domain=gmail.com policy.is_org=yes (MX Records found: alt4.gmail-smtp-in.l.google.com,gmail-smtp-in.l.google.com,alt2.gmail-smtp-in.l.google.com,alt1.gmail-smtp-in.l.google.com,alt3.gmail-smtp-in.l.google.com); x-return-mx=pass smtp.domain=gmail.com policy.is_org=yes (MX Records found: alt2.gmail-smtp-in.l.google.com,alt1.gmail-smtp-in.l.google.com,alt3.gmail-smtp-in.l.google.com,alt4.gmail-smtp-in.l.google.com,gmail-smtp-in.l.google.com); x-tls=pass smtp.version=TLSv1.3 smtp.cipher=TLS_AES_256_GCM_SHA384 smtp.bits=256/256; x-vs=clean score=0 state=0 Authentication-Results: mx5.messagingengine.com; x-csa=none; x-me-sender=none; x-ptr=pass smtp.helo=mail-qv1-f49.google.com policy.ptr=mail-qv1-f49.google.com Authentication-Results: mx5.messagingengine.com; bimi=skipped (DMARC Policy is not at enforcement) Authentication-Results: mx5.messagingengine.com; arc=none (no signatures found) Authentication-Results: mx5.messagingengine.com; dkim=pass (2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=h/YxiNwR header.a=rsa-sha256 header.s=20210112 x-bits=2048; dmarc=pass policy.published-domain-policy=none policy.published-subdomain-policy=quarantine policy.applied-disposition=none policy.evaluated-disposition=none (p=none,sp=quarantine,d=none,d.eval=none) policy.policy-from=p header.from=gmail.com; iprev=pass smtp.remote-ip=209.85.219.49 (mail-qv1-f49.google.com); spf=pass smtp.mailfrom=barrywvarneyh952@gmail.com smtp.helo=mail-qv1-f49.google.com X-ME-VSCause: gggruggvucftvghtrhhoucdtuddrgedvfedrfeefiedgieefucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdggtfgfnhhsuhgsshgtrhhisggvpdfu rfetoffkrfgpnffqhgenuceurghilhhouhhtmecufedttdenucenucfjughrpegghfffkf fuvfgtsehmtderredttdejnecuhfhrohhmpeeurghrrhihficugggrrhhnvgihhhcuoegs rghrrhihfihvrghrnhgvhihhleehvdesghhmrghilhdrtghomheqnecuggftrfgrthhtvg hrnhepjeetueehudejtddtueejvdehledttdelieeviefgueelleetvddutdfgleduvdev necukfhppedvtdelrdekhedrvdduledrgeelnecuvehluhhsthgvrhfuihiivgeptdenuc frrghrrghmpehinhgvthepvddtledrkeehrddvudelrdegledphhgvlhhopehmrghilhdq qhhvuddqfhegledrghhoohhglhgvrdgtohhmpdhmrghilhhfrhhomhepoegsrghrrhihfi hvrghrnhgvhihhleehvdesghhmrghilhdrtghomheq X-ME-VSScore: 0 X-ME-VSCategory: clean X-ME-CSA: none Received-SPF: pass (gmail.com ... _spf.google.com: Sender is authorized to use 'barrywvarneyh952@gmail.com' in 'mfrom' identity (mechanism 'include:_netblocks.google.com' matched)) receiver=mx5.messagingengine.com; identity=mailfrom; envelope-from="barrywvarneyh952@gmail.com"; helo=mail-qv1-f49.google.com; client-ip=209.85.219.49 Fastmail-MaskedEmail: id=masked-REDACTED; state=enabled Received: from mail-qv1-f49.google.com (mail-qv1-f49.google.com [209.85.219.49]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx5.messagingengine.com (Postfix) with ESMTPS for <throw10920 address>; Fri, 23 Sep 2022 09:14:21 -0400 (EDT) Received: by mail-qv1-f49.google.com with SMTP id l1so563450qvu.11 for <throw10920 address>; Fri, 23 Sep 2022 06:14:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date; bh=mgoaWyWp1yTWBa0JtRKZ3JG3oT/BJWrtmRX+y6Pw8Ig=; b=h/YxiNwRagpULPH2dAAP84uSef6zj0R4UealQrN2jHF5wheHgY9FPOOFuxaZze8sgy NKx67McMjDbaLZI4Ybqr9I99R5qvJyAGYQaTmz2brz4yXtqeoMA641ekxGmRjsrv82yf W6ipUTNohrTsAAcvNeE9QUfN7dn7iWgiUzRulWbWIBGWR8JSIA4NN3HWx3vRO/4n/qyi 1ynine1dxG7Qe4PX/HHQobCVaslG+oo1ogNecu8Rq2R0u7yIoB+v28zc98pFF5IszMMA 4L/FhOXU7+L7GbQ0JPoxix790cy4p1rUDLPESDHP2Xcssf9dmPuI8jXlGyjNHwNJOe7n ZWfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date; bh=mgoaWyWp1yTWBa0JtRKZ3JG3oT/BJWrtmRX+y6Pw8Ig=; b=iv6O/RRbuHD9TQOCuJMwNBdCabYm1I1KsEjfD8W4IxA9Gbd5ZAa2BPQqzZKRAYeZ85 8l1ZZeaS8aAmehs7jRwGOJT5DfK0MZMPQHkOvWrtG8hUexT5A42CA6qzcucKeotzyD1+ /H2C78zxdDSOj4T313h2hHZe+QgeFUCKa47Agm5Hg7YWS4Ivk/GN5q+rPgf96qiMFjPZ NjUpUt+oaTx5QYEBl1VFg/s2bllSIxAs+avSIATVr6Kk5qkRcGkcB4l7RQ5/MdydVqzn GBWqOH/3tGa/PcoFWWyQHK5Awp0RCl51874ieWHzEsTbw4vxY4NdWXMhEbVdYNnx1a6E Og3A== X-Gm-Message-State: ACrzQf0w3TsrGRPOEfDzfdBI2/rmC0zGH0WSziUrRNf8THrMDa6ThD3J W026gpn0qliT/A0JT6eA19P1+TbIkepxud+rpCg= X-Google-Smtp-Source: AMsMyM4jCwL+QF3C+JZWnSqkWjbmCkW7hpRxCD40bhCGLWRp+46CIb2DL4OPAS0OePSQitgavYsgfYNlBUfx7RU31jQ= X-Received: by 2002:a0c:f18d:0:b0:4ad:1149:3975 with SMTP id m13-20020a0cf18d000000b004ad11493975mr7062648qvl.24.1663938859522; Fri, 23 Sep 2022 06:14:19 -0700 (PDT) MIME-Version: 1.0 From: Barryw Varneyh <barrywvarneyh952@gmail.com> Date: Fri, 23 Sep 2022 18:44:07 +0530 Message-ID: <CA+AZ9Gv3P8JtiMhte5LpG2=AnRJi-3BzFGGrpq+wxhqSVtuwHQ@mail.gmail.com> Subject: invoice To: <list of several hundred random domestic email addresses - aol, hotmail, yahoo, icloud, gmail, etc.>
- geocrasher 4y ago
  Ok, so using a fake new gmail address the spammer used an instance hosted at mx5.messagingengine.com (probably a hacked or vulnerable mail server hosted at https://expedient.com/ https://expedient.com/, cloud provider) to send mail via SMTP/gmail to a <list of several hundred random domestic email addresses - aol, hotmail, yahoo, icloud, gmail, etc.> There's nothing to indicate you were specifically targeted, but rather that they guessed your email address. It didn't bounce, so they kept sending to it.
  - throw10920 4y ago
    > rather that they guessed your email address I'm sorry, I don't see how the fact that there are a large number of recipient email addresses provides evidence for the idea that my email address was guessed. A spammer with a list of addresses bought off a marketplace could easily have done the same thing, couldn't they?
    - geocrasher 4y ago
      Sure, could have. But spammers are cheap. They're not going to buy addresses when they can guess them. I'm going based off what is most likely based on what I see- a typical spammer doing typical spammer things. You might go look at haveibeenpwned.com and see if your email address is listed there, to see if it's some part of a breach.
      - throw10920 4y ago
        haveibeenpwned.com shows nothing, and I reached out to some of the other addresses on the email and got autoresponders and messages back from real people confirming that they used that email for their Comcast account - so, no, these addresses were not guessed.
    - nonasktell 4y ago
      if you see the other addresses, can you check if they're registered on comcast website? https://login.xfinity.com/login https://login.xfinity.com/login to try to see if it exists if someone got a fresh list of mail addresses, they'd probably test all the mails coming from this source at the same time, could confirm your theory

turkeygizzard 4y ago

Just curious because I don't know enough about this stuff - what kind of fingerprint would you be looking for in the header that could tell you whether they knew the address ahead of time?

geocrasher 4y ago
I wouldn't be able to tell that specifically, but instead it would provide context to the emails that may yield other clues about the sender and their overall methods.

throw10920 4y ago

I have a few dozen of these email addresses and very rarely get spam to any of them - then received two spams to the same address within the span of a few days. It seems relatively unlikely that it was just guessing. I'll try to provide redacted headers within the next day or two so that interested parties can take a look anyway.

throw10920 4y ago

I have retrieved the headers: Return-Path: <barrywvarneyh952@gmail.com> Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by sloti44n40 (Cyrus 3.7.0-alpha0-935-ge4ccd4c47b-fm-20220914.001-ge4ccd4c4) with LMTPA; Fri, 23 Sep 2022 09:14:21 -0400 X-Cyrus-Session-Id: sloti44n40-1663938861-1037676-2-16521453121443000607 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-sender-reputation: 500 (none) X-Spam-score: 0.1 X-Spam-hits: DCC_REPUT_13_19 -0.1, FREEMAIL_ENVFROM_END_DIGIT 0.25, FREEMAIL_FROM 0.001, HTML_MESSAGE 0.001, ME_SENDERREP_NEUTRAL 0.001, RCVD_IN_DNSWL_NONE -0.0001, RCVD_IN_MSPIKE_H2 -0.001, SPF_HELO_NONE 0.001, SPF_PASS -0.001, TVD_SPACE_RATIO 0.001, T_FREEMAIL_DOC_PDF 0.01, LANGUAGES unknown, BAYES_USED none, SA_VERSION 3.4.6 X-Spam-source: IP='209.85.219.49', Host='mail-qv1-f49.google.com', Country='US', FromHeader='com', MailFrom='com' X-Spam-charsets: plain='UTF-8', html='UTF-8' X-Attached: Details (3).pdf X-Resolved-to: <throw10920 address> X-Delivered-to: <throw10920 address> X-Mail-from: barrywvarneyh952@gmail.com Received: from mx5 ([10.202.2.204]) by compute4.internal (LMTPProxy); Fri, 23 Sep 2022 09:14:21 -0400 Received: from mx5.messagingengine.com (localhost [127.0.0.1]) by mailmx.nyi.internal (Postfix) with ESMTP id 634BF2720140 for <throw10920 address>; Fri, 23 Sep 2022 09:14:21 -0400 (EDT) Received: from mx5.messagingengine.com (localhost [127.0.0.1]) by mx5.messagingengine.com (Authentication Milter) with ESMTP id 56AEB231292; Fri, 23 Sep 2022 09:14:21 -0400 ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=fm2; t= 1663938861; b=qDtS28CDS2y28h3ycCzz2olah3lAZcdJBi4/I894gWSs2KZIOj vNX/FQ+GrIpNZJv8kS+8EDKztM5Uk72CdkDUs9SIeTt+Xujswj1PxeW3Pt1y8wtw edscLRzagS8u88INStmdmu+BELCeckywd/Zd1+6Dx9FUbgMRioGWZfVr1A3WOK3z WQjw7G4LoAA+rd62+3B1gfYQq1CgMYq+2hDH8+w+k21PZXbgcfGdLh5UKSRjZsvJ NXfpYl+q7b6CMTp7+G+rwJKQAYNB11ZFCyyZXapRsPLuwDqxD3zpyrHJbkdRT8CU WXBsFU0+Upmf/MhRfEnivF/RqrH0qmdPXUAg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=mime-version:from:date:message-id:subject :to:content-type; s=fm2; t=1663938861; bh=mgoaWyWp1yTWBa0JtRKZ3J G3oT/BJWrtmRX+y6Pw8Ig=; b=sNMnMvPQYLl9OhPIu+/FvA4GQcAIPIxBNTNyIE tGDrOjDD85df2gsz5dqBQgbLhWWHG6BSROCVxolcMciApfSwo0IFL31MMxLlFyOT FjVMXTnvnUbqb74pyJAva3DzEBzAg6iEz7gROUmJhxI9TI1jICx8a4t1brm5cmXU oUOmMASTfD9/PhDsuMD1tilvHzbrjfPOI8T10aPHHcijmmHUGvuy+IozlVVTzfxX Q9XuwDLs6NiUCNV1nXRa0fW7GK3U/vXqKxa5jYYQ7YxbQSqJ3SVlSimBVZfSxuRa Vsisua3ZCkDsb7THQ7ZajWcDR7lvADeKST24899ukfXWVHcA== ARC-Authentication-Results: i=1; mx5.messagingengine.com; x-csa=none; x-me-sender=none; x-ptr=pass smtp.helo=mail-qv1-f49.google.com policy.ptr=mail-qv1-f49.google.com; bimi=skipped (DMARC Policy is not at enforcement); arc=none (no signatures found); dkim=pass (2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=h/YxiNwR header.a=rsa-sha256 header.s=20210112 x-bits=2048; dmarc=pass policy.published-domain-policy=none policy.published-subdomain-policy=quarantine policy.applied-disposition=none policy.evaluated-disposition=none (p=none,sp=quarantine,d=none,d.eval=none) policy.policy-from=p header.from=gmail.com; iprev=pass smtp.remote-ip=209.85.219.49 (mail-qv1-f49.google.com); spf=pass smtp.mailfrom=barrywvarneyh952@gmail.com smtp.helo=mail-qv1-f49.google.com X-ME-Authentication-Results: mx5.messagingengine.com; x-aligned-from=pass (Address match); x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=iv6O/RRb; x-return-mx=pass header.domain=gmail.com policy.is_org=yes (MX Records found: alt4.gmail-smtp-in.l.google.com,gmail-smtp-in.l.google.com,alt2.gmail-smtp-in.l.google.com,alt1.gmail-smtp-in.l.google.com,alt3.gmail-smtp-in.l.google.com); x-return-mx=pass smtp.domain=gmail.com policy.is_org=yes (MX Records found: alt2.gmail-smtp-in.l.google.com,alt1.gmail-smtp-in.l.google.com,alt3.gmail-smtp-in.l.google.com,alt4.gmail-smtp-in.l.google.com,gmail-smtp-in.l.google.com); x-tls=pass smtp.version=TLSv1.3 smtp.cipher=TLS_AES_256_GCM_SHA384 smtp.bits=256/256; x-vs=clean score=0 state=0 Authentication-Results: mx5.messagingengine.com; x-csa=none; x-me-sender=none; x-ptr=pass smtp.helo=mail-qv1-f49.google.com policy.ptr=mail-qv1-f49.google.com Authentication-Results: mx5.messagingengine.com; bimi=skipped (DMARC Policy is not at enforcement) Authentication-Results: mx5.messagingengine.com; arc=none (no signatures found) Authentication-Results: mx5.messagingengine.com; dkim=pass (2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=h/YxiNwR header.a=rsa-sha256 header.s=20210112 x-bits=2048; dmarc=pass policy.published-domain-policy=none policy.published-subdomain-policy=quarantine policy.applied-disposition=none policy.evaluated-disposition=none (p=none,sp=quarantine,d=none,d.eval=none) policy.policy-from=p header.from=gmail.com; iprev=pass smtp.remote-ip=209.85.219.49 (mail-qv1-f49.google.com); spf=pass smtp.mailfrom=barrywvarneyh952@gmail.com smtp.helo=mail-qv1-f49.google.com X-ME-VSCause: gggruggvucftvghtrhhoucdtuddrgedvfedrfeefiedgieefucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdggtfgfnhhsuhgsshgtrhhisggvpdfu rfetoffkrfgpnffqhgenuceurghilhhouhhtmecufedttdenucenucfjughrpegghfffkf fuvfgtsehmtderredttdejnecuhfhrohhmpeeurghrrhihficugggrrhhnvgihhhcuoegs rghrrhihfihvrghrnhgvhihhleehvdesghhmrghilhdrtghomheqnecuggftrfgrthhtvg hrnhepjeetueehudejtddtueejvdehledttdelieeviefgueelleetvddutdfgleduvdev necukfhppedvtdelrdekhedrvdduledrgeelnecuvehluhhsthgvrhfuihiivgeptdenuc frrghrrghmpehinhgvthepvddtledrkeehrddvudelrdegledphhgvlhhopehmrghilhdq qhhvuddqfhegledrghhoohhglhgvrdgtohhmpdhmrghilhhfrhhomhepoegsrghrrhihfi hvrghrnhgvhihhleehvdesghhmrghilhdrtghomheq X-ME-VSScore: 0 X-ME-VSCategory: clean X-ME-CSA: none Received-SPF: pass (gmail.com ... _spf.google.com: Sender is authorized to use 'barrywvarneyh952@gmail.com' in 'mfrom' identity (mechanism 'include:_netblocks.google.com' matched)) receiver=mx5.messagingengine.com; identity=mailfrom; envelope-from="barrywvarneyh952@gmail.com"; helo=mail-qv1-f49.google.com; client-ip=209.85.219.49 Fastmail-MaskedEmail: id=masked-REDACTED; state=enabled Received: from mail-qv1-f49.google.com (mail-qv1-f49.google.com [209.85.219.49]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx5.messagingengine.com (Postfix) with ESMTPS for <throw10920 address>; Fri, 23 Sep 2022 09:14:21 -0400 (EDT) Received: by mail-qv1-f49.google.com with SMTP id l1so563450qvu.11 for <throw10920 address>; Fri, 23 Sep 2022 06:14:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date; bh=mgoaWyWp1yTWBa0JtRKZ3JG3oT/BJWrtmRX+y6Pw8Ig=; b=h/YxiNwRagpULPH2dAAP84uSef6zj0R4UealQrN2jHF5wheHgY9FPOOFuxaZze8sgy NKx67McMjDbaLZI4Ybqr9I99R5qvJyAGYQaTmz2brz4yXtqeoMA641ekxGmRjsrv82yf W6ipUTNohrTsAAcvNeE9QUfN7dn7iWgiUzRulWbWIBGWR8JSIA4NN3HWx3vRO/4n/qyi 1ynine1dxG7Qe4PX/HHQobCVaslG+oo1ogNecu8Rq2R0u7yIoB+v28zc98pFF5IszMMA 4L/FhOXU7+L7GbQ0JPoxix790cy4p1rUDLPESDHP2Xcssf9dmPuI8jXlGyjNHwNJOe7n ZWfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date; bh=mgoaWyWp1yTWBa0JtRKZ3JG3oT/BJWrtmRX+y6Pw8Ig=; b=iv6O/RRbuHD9TQOCuJMwNBdCabYm1I1KsEjfD8W4IxA9Gbd5ZAa2BPQqzZKRAYeZ85 8l1ZZeaS8aAmehs7jRwGOJT5DfK0MZMPQHkOvWrtG8hUexT5A42CA6qzcucKeotzyD1+ /H2C78zxdDSOj4T313h2hHZe+QgeFUCKa47Agm5Hg7YWS4Ivk/GN5q+rPgf96qiMFjPZ NjUpUt+oaTx5QYEBl1VFg/s2bllSIxAs+avSIATVr6Kk5qkRcGkcB4l7RQ5/MdydVqzn GBWqOH/3tGa/PcoFWWyQHK5Awp0RCl51874ieWHzEsTbw4vxY4NdWXMhEbVdYNnx1a6E Og3A== X-Gm-Message-State: ACrzQf0w3TsrGRPOEfDzfdBI2/rmC0zGH0WSziUrRNf8THrMDa6ThD3J W026gpn0qliT/A0JT6eA19P1+TbIkepxud+rpCg= X-Google-Smtp-Source: AMsMyM4jCwL+QF3C+JZWnSqkWjbmCkW7hpRxCD40bhCGLWRp+46CIb2DL4OPAS0OePSQitgavYsgfYNlBUfx7RU31jQ= X-Received: by 2002:a0c:f18d:0:b0:4ad:1149:3975 with SMTP id m13-20020a0cf18d000000b004ad11493975mr7062648qvl.24.1663938859522; Fri, 23 Sep 2022 06:14:19 -0700 (PDT) MIME-Version: 1.0 From: Barryw Varneyh <barrywvarneyh952@gmail.com> Date: Fri, 23 Sep 2022 18:44:07 +0530 Message-ID: <CA+AZ9Gv3P8JtiMhte5LpG2=AnRJi-3BzFGGrpq+wxhqSVtuwHQ@mail.gmail.com> Subject: invoice To: <list of several hundred random domestic email addresses - aol, hotmail, yahoo, icloud, gmail, etc.>

geocrasher 4y ago
Ok, so using a fake new gmail address the spammer used an instance hosted at mx5.messagingengine.com (probably a hacked or vulnerable mail server hosted at https://expedient.com/ https://expedient.com/, cloud provider) to send mail via SMTP/gmail to a <list of several hundred random domestic email addresses - aol, hotmail, yahoo, icloud, gmail, etc.> There's nothing to indicate you were specifically targeted, but rather that they guessed your email address. It didn't bounce, so they kept sending to it.
- throw10920 4y ago
  > rather that they guessed your email address I'm sorry, I don't see how the fact that there are a large number of recipient email addresses provides evidence for the idea that my email address was guessed. A spammer with a list of addresses bought off a marketplace could easily have done the same thing, couldn't they?
  - geocrasher 4y ago
    Sure, could have. But spammers are cheap. They're not going to buy addresses when they can guess them. I'm going based off what is most likely based on what I see- a typical spammer doing typical spammer things. You might go look at haveibeenpwned.com and see if your email address is listed there, to see if it's some part of a breach.
    - throw10920 4y ago
      haveibeenpwned.com shows nothing, and I reached out to some of the other addresses on the email and got autoresponders and messages back from real people confirming that they used that email for their Comcast account - so, no, these addresses were not guessed.
  - nonasktell 4y ago
    if you see the other addresses, can you check if they're registered on comcast website? https://login.xfinity.com/login https://login.xfinity.com/login to try to see if it exists if someone got a fresh list of mail addresses, they'd probably test all the mails coming from this source at the same time, could confirm your theory