4 ms·

Wait, how reporting spam can leak the address? Asking for gmail of course.

by seqizz 4y ago

nomadrat 4y ago
he's probably saying about clicking "unsubscribe" which usually leads to spammer website. in return they know now that this email is active
- tux2bsd 4y ago
  A website, can just be a URL of, well... nothing. As long a web server is sitting there logging the requests. spammer.douch.nozzle/collect_request/JoeShmo_1x1-transparent-UUID_0se9a009fjwljwlfl2f.gif but all the info the douch needs is in the "UUID", the rest is easily obfuscated. If your email client renders renders images willy nilly, the image is enough to confirm a valid target (clicking "unsubscribe" isn't necessary to become victim but is a hard lock-in mechanism (A human is on the hook...)).
  - jenny91 4y ago
    And that's exactly why you don't load random web resources in emails.
- Semaphor 4y ago
  > he's probably saying about clicking "unsubscribe" No. I’m talking about abuse-mails, I’ll reply to the top-level comment
5e92cb50239222b 4y ago
I don't get much spam, so I don't remember the last time I reported it, but IIRC when you do it on Gmail, it shows something to the effect of "thanks for the report, we'll try to unsubscribe you". I reckon they might be using this: https://www.rfc-editor.org/rfc/rfc8058 https://www.rfc-editor.org/rfc/rfc8058 This is pure speculation since I have no visibility into their inner workings, but it might just be possible that they would send a POST request on your behalf, at least to domains on some sort of a pre-approved list.
deleted 4y ago
[deleted]
Semaphor 4y ago
At work, we sometimes got abuse mails (the mails mention FBL: Feedback Loop [0]) which, while they do not contain addresses, contain message-id’s which can then be linked to the original mail. But looking at the list of addresses we blacklisted because of them, I now realize that those are actually all web.de and gmx.de (crappy German freemailers), so it seems the leaks only happen with them. [0]: https://en.wikipedia.org/wiki/Feedback_loop_(email) https://en.wikipedia.org/wiki/Feedback_loop_(email)
adql 4y ago
It tells the adversary someone reads the emails on that mailbox.

Wait, how reporting spam can leak the address? Asking for gmail of course.

by seqizz 4y ago

Wait, how reporting spam can leak the address? Asking for gmail of course.

he's probably saying about clicking "unsubscribe" which usually leads to spammer website. in return they know now that this email is active

tux2bsd 4y ago
A website, can just be a URL of, well... nothing. As long a web server is sitting there logging the requests. spammer.douch.nozzle/collect_request/JoeShmo_1x1-transparent-UUID_0se9a009fjwljwlfl2f.gif but all the info the douch needs is in the "UUID", the rest is easily obfuscated. If your email client renders renders images willy nilly, the image is enough to confirm a valid target (clicking "unsubscribe" isn't necessary to become victim but is a hard lock-in mechanism (A human is on the hook...)).
- jenny91 4y ago
  And that's exactly why you don't load random web resources in emails.
Semaphor 4y ago
> he's probably saying about clicking "unsubscribe" No. I’m talking about abuse-mails, I’ll reply to the top-level comment

5e92cb50239222b 4y ago

I don't get much spam, so I don't remember the last time I reported it, but IIRC when you do it on Gmail, it shows something to the effect of "thanks for the report, we'll try to unsubscribe you". I reckon they might be using this: https://www.rfc-editor.org/rfc/rfc8058 https://www.rfc-editor.org/rfc/rfc8058 This is pure speculation since I have no visibility into their inner workings, but it might just be possible that they would send a POST request on your behalf, at least to domains on some sort of a pre-approved list.

deleted 4y ago

[deleted]

Semaphor 4y ago

At work, we sometimes got abuse mails (the mails mention FBL: Feedback Loop [0]) which, while they do not contain addresses, contain message-id’s which can then be linked to the original mail. But looking at the list of addresses we blacklisted because of them, I now realize that those are actually all web.de and gmx.de (crappy German freemailers), so it seems the leaks only happen with them. [0]: https://en.wikipedia.org/wiki/Feedback_loop_(email) https://en.wikipedia.org/wiki/Feedback_loop_(email)

adql 4y ago

It tells the adversary someone reads the emails on that mailbox.