3 ms·

> I would get several messages for andrew@domain.tld, brian@domain.tld, carl@domain.tld, etc. I read about that sometimes (or well, rather the less specific on

> I would get several messages for andrew@domain.tld, brian@domain.tld, carl@domain.tld, etc. I read about that sometimes (or well, rather the less specific one where you’d get generally random spam to your domain), and in over 7 years of doing website@exmaple.org I never had this happen. I wonder what the difference between people like me, and people like you is?

digging 4y ago
I have this setup as well for the past 4 years and I always worry about the GP's problem popping up, but it hasn't yet. I am also very curious.
- deleted 4y ago
  [deleted]
AshamedCaptain 4y ago
"You never had this happen?" I have had a catch all email for over 3 decades and spammers practically try everything under the sun for the local part of the email address. It's like the usernames you see in the "random background ssh noise" of the internet. On more recent decades I have seen bots even split by separator, e.g. if prefix.suffix@example.com is published online, they will try prefix@example.com and suffix@example.com.
- Semaphor 4y ago
  So maybe it's age related? 30 years is a lot more than 5-7 (not quite sure how long) ;)
- dspillett 4y ago
  > e.g. if prefix.suffix@example.com is published online, they will try prefix@example.com and suffix@example.com That is likely someone trying to programmatically circumvent filtering based on catch-all-ish naming conventions, like gmail's support for usernamepart+anythingelse@gmail.com all going to usernamepart@gmail.com and similar facilities offered by other email services. Sending to <something1>@dom.tld and <something2>@dom.tld as well as <something1><puntuation><something2>@dom.tld seems like a potentially useful heuristic. Though it may create excess false addresses, if spammers care about that sort of thing (that depends on whether the chance hit on real addresses is worth the need to transmit many more messages that will fail/bounce and maybe help train spam identification systems).
dspillett 4y ago
It doesn't happen often that I notice, a lot of examples of it end up automatically marked as junk so I only see them if I peer in there for any reason or look at the mail server's daily/weekly/monthly incoming mail report which will list them. Perhaps your junk filtering is more efficient than mine! It may also depend upon what lists we've ended up on. If only a few junk senders are using the trick, the others deciding it isn't worth it without knowing there is a catch-all isn't worth it and deciding working out there is a catch-all with sufficiently few false positives is too much hassel, then it is quite possible it only happens to some of us. It could also be that some people have done it to pad out email lists they sell, and so most of the others aren't really using the trick but just parroting the list they have bought. Again, this would explain the issue only being seen by some. My domain is a .net that has been active for about 23 years at this point, so compared to newer domains its presence in spam mailing lists will have been subject to more fads in the junk industry over time.

digging 4y ago

I have this setup as well for the past 4 years and I always worry about the GP's problem popping up, but it hasn't yet. I am also very curious.

deleted 4y ago
[deleted]

AshamedCaptain 4y ago

"You never had this happen?" I have had a catch all email for over 3 decades and spammers practically try everything under the sun for the local part of the email address. It's like the usernames you see in the "random background ssh noise" of the internet. On more recent decades I have seen bots even split by separator, e.g. if prefix.suffix@example.com is published online, they will try prefix@example.com and suffix@example.com.

Semaphor 4y ago
So maybe it's age related? 30 years is a lot more than 5-7 (not quite sure how long) ;)
dspillett 4y ago
> e.g. if prefix.suffix@example.com is published online, they will try prefix@example.com and suffix@example.com That is likely someone trying to programmatically circumvent filtering based on catch-all-ish naming conventions, like gmail's support for usernamepart+anythingelse@gmail.com all going to usernamepart@gmail.com and similar facilities offered by other email services. Sending to <something1>@dom.tld and <something2>@dom.tld as well as <something1><puntuation><something2>@dom.tld seems like a potentially useful heuristic. Though it may create excess false addresses, if spammers care about that sort of thing (that depends on whether the chance hit on real addresses is worth the need to transmit many more messages that will fail/bounce and maybe help train spam identification systems).

dspillett 4y ago

It doesn't happen often that I notice, a lot of examples of it end up automatically marked as junk so I only see them if I peer in there for any reason or look at the mail server's daily/weekly/monthly incoming mail report which will list them. Perhaps your junk filtering is more efficient than mine! It may also depend upon what lists we've ended up on. If only a few junk senders are using the trick, the others deciding it isn't worth it without knowing there is a catch-all isn't worth it and deciding working out there is a catch-all with sufficiently few false positives is too much hassel, then it is quite possible it only happens to some of us. It could also be that some people have done it to pad out email lists they sell, and so most of the others aren't really using the trick but just parroting the list they have bought. Again, this would explain the issue only being seen by some. My domain is a .net that has been active for about 23 years at this point, so compared to newer domains its presence in spam mailing lists will have been subject to more fads in the junk industry over time.