3 ms·

Ok, so using a fake new gmail address the spammer used an instance hosted at mx5.messagingengine.com (probably a hacked or vulnerable mail server hosted at http

Ok, so using a fake new gmail address the spammer used an instance hosted at mx5.messagingengine.com (probably a hacked or vulnerable mail server hosted at https://expedient.com/ https://expedient.com/, cloud provider) to send mail via SMTP/gmail to a <list of several hundred random domestic email addresses - aol, hotmail, yahoo, icloud, gmail, etc.> There's nothing to indicate you were specifically targeted, but rather that they guessed your email address. It didn't bounce, so they kept sending to it.

throw10920 4y ago
> rather that they guessed your email address I'm sorry, I don't see how the fact that there are a large number of recipient email addresses provides evidence for the idea that my email address was guessed. A spammer with a list of addresses bought off a marketplace could easily have done the same thing, couldn't they?
- geocrasher 4y ago
  Sure, could have. But spammers are cheap. They're not going to buy addresses when they can guess them. I'm going based off what is most likely based on what I see- a typical spammer doing typical spammer things. You might go look at haveibeenpwned.com and see if your email address is listed there, to see if it's some part of a breach.
  - throw10920 4y ago
    haveibeenpwned.com shows nothing, and I reached out to some of the other addresses on the email and got autoresponders and messages back from real people confirming that they used that email for their Comcast account - so, no, these addresses were not guessed.
- nonasktell 4y ago
  if you see the other addresses, can you check if they're registered on comcast website? https://login.xfinity.com/login https://login.xfinity.com/login to try to see if it exists if someone got a fresh list of mail addresses, they'd probably test all the mails coming from this source at the same time, could confirm your theory
joshwa 4y ago
messagingengine.com is the domain used for fastmail's mail servers.
- throw10920 4y ago
  Huh, that suggests that geocrasher doesn't actually know what they're talking about.

throw10920 4y ago

> rather that they guessed your email address I'm sorry, I don't see how the fact that there are a large number of recipient email addresses provides evidence for the idea that my email address was guessed. A spammer with a list of addresses bought off a marketplace could easily have done the same thing, couldn't they?

geocrasher 4y ago
Sure, could have. But spammers are cheap. They're not going to buy addresses when they can guess them. I'm going based off what is most likely based on what I see- a typical spammer doing typical spammer things. You might go look at haveibeenpwned.com and see if your email address is listed there, to see if it's some part of a breach.
- throw10920 4y ago
  haveibeenpwned.com shows nothing, and I reached out to some of the other addresses on the email and got autoresponders and messages back from real people confirming that they used that email for their Comcast account - so, no, these addresses were not guessed.
nonasktell 4y ago
if you see the other addresses, can you check if they're registered on comcast website? https://login.xfinity.com/login https://login.xfinity.com/login to try to see if it exists if someone got a fresh list of mail addresses, they'd probably test all the mails coming from this source at the same time, could confirm your theory

joshwa 4y ago

messagingengine.com is the domain used for fastmail's mail servers.

throw10920 4y ago
Huh, that suggests that geocrasher doesn't actually know what they're talking about.