3 ms·

Some dark hat guy could use the emails collected on site like this for targeted phishing attacks. Now that I have entered my email there, this reveals that I'm

Some dark hat guy could use the emails collected on site like this for targeted phishing attacks. Now that I have entered my email there, this reveals that I'm aware of these certain security incidents (the site reported that my email and some personal information had been compromised). Now if somebody would approach me on this topic, they might have a chance of fooling me to give some further details about myself. The benefit from this kind of targeting would be to avoid hitting the spam filters. If they just spammed their message to random addresses, people would flag them as junk mail and good email providers would quickly filter them out.

kazinator 12y ago
People who know "pwned" are probably more resistant to phishing attacks than the average schmuck. Also, a lot of the material entered into the site will be fake. This is not a good way to harvest genuine e-mail addresses. Not only is it open to fake addresses, but it is open to deliberate spam-trap addresses: addresses whose only purpose is to detect spam. I can generate a fake address "nothanks@<mydomain>" and feed it to this site (or, generally, allow this address to be widely harvested). Then, whenever an SMTP request comes in with a "RCPT to: nothanks@<mydomain>", I can drop the connection and ban the IP address for 7 days. Any use of that address is 100% spam; no legitimate sender knows this address.
- bitJericho 12y ago
  If I were to run this scam, I would only add addresses that were checked and matched a known leak. This would both give me a known good address and also an idea of what kind of person you are. If you're the type to check your email address against known leaks then I would know exactly how to attack you.
wglb 12y ago
This simply has emails from other lists that have been floating around. For example, the adobe set is from the adobe breach where emails were in the clear. The dark hat guys already have this list. And likely some passwords, which this site doesn't ask for.
- atwebb 12y ago
  That's the point OP was making. They would know that you know that they know. This means they could be very, very targeted with an email/social phishing attack to try and get a newer password or other account information by referencing the previously compromised site. It could help the bad guys establish trust. A bit tinfoily but well within the realm of possibilities if the lookups on this site are logged.

kazinator 12y ago

People who know "pwned" are probably more resistant to phishing attacks than the average schmuck. Also, a lot of the material entered into the site will be fake. This is not a good way to harvest genuine e-mail addresses. Not only is it open to fake addresses, but it is open to deliberate spam-trap addresses: addresses whose only purpose is to detect spam. I can generate a fake address "nothanks@<mydomain>" and feed it to this site (or, generally, allow this address to be widely harvested). Then, whenever an SMTP request comes in with a "RCPT to: nothanks@<mydomain>", I can drop the connection and ban the IP address for 7 days. Any use of that address is 100% spam; no legitimate sender knows this address.

bitJericho 12y ago
If I were to run this scam, I would only add addresses that were checked and matched a known leak. This would both give me a known good address and also an idea of what kind of person you are. If you're the type to check your email address against known leaks then I would know exactly how to attack you.

wglb 12y ago

This simply has emails from other lists that have been floating around. For example, the adobe set is from the adobe breach where emails were in the clear. The dark hat guys already have this list. And likely some passwords, which this site doesn't ask for.

atwebb 12y ago
That's the point OP was making. They would know that you know that they know. This means they could be very, very targeted with an email/social phishing attack to try and get a newer password or other account information by referencing the previously compromised site. It could help the bad guys establish trust. A bit tinfoily but well within the realm of possibilities if the lookups on this site are logged.