urs6_ma

Has anybody else gotten a weird SPAM entitled "You should have been careful..."

This SPAM suggested that I had clicked on a **** site and wanted me to send some money...

Um, no.

The weird thing is that this SPAM was sent to the email address I created and used only for correspondence with VW regarding my Touareg buyback...

I think that somewhere along the line, that process was compromised. There's no other way anyone could have gotten this particular email address..

I'll be checking with VW shortly...but it would be helpful to know if others have gotten similar SPAM...

If you've gotten a similar SPAM, call the Dieselgate hotline and let them know!

Redd

Could they have simply recreated the same email address form a dictionary attack?

That is, they'll take a list of a million known names or common prefixes and add "@xyz.com" to them, and spam all the addresses knowing that for any given domain name there's a "papabear@, sweetjane@" and anything else you have already found you couldn't register as a user name because it was already in use.

Of course someone at VW might have been approached to sell a list of correspondents, that's been happening forever too.

urs6_ma

Yep, that happens a lot.

In this case, the email prefix is subject specific to the use case, and the domain is a private one under my control, with no commercial usage visible.

For example, if I register for an upcoming fall marathon, I'll use Harwichmarathon2018 @ [personaldomain].org. That specific email will never appear anywhere else, nor would I ever send email with it, only use it to receive and may use it as the user id to log onto the related systems...

So, it's highly unlikely that a dictionary attack would have created this address...

Mythdoc

urs6_ma

Um, no.

billm0066

How would looking at **** give up an email address? It would need to be typed in.

Redd

" It would need to be typed in. "
Not so. Most folks have some kind of active scripting enabled (Java, JavaScript. Active-X, whatever) on their browser. And the problem is, all of those can be manipulated to leave bits of code running on the system, so at least in theory they could look for a list of primary email clients (Outlook, Gmail, Yahoo, Exchange, Thunderbird, etc.) and score the account names, the "send from" addresses from there.
There are all sorts of "That could never happen!" subtle security issues that have been either found in the wild, or proven to be possible (which means, it just isn't common YET).

To have anything on the computer really secure, you've got to button it down so hard that you also can't reach or use many web sites. And, spend a lot of time studying up on IT security.

MurrayA4

Maybe companies targeting people who look at **** will finally get our attention and cause us to revolt and insist our governments do their job and snuff this out.

billm0066

Sorry never heard of any **** site taking email addresses from people without it being typed in. Or any site for that matter.

Also you know you can click the quote button rather than copy and pasting what someone types? See how I quoted you? It has your name so you know who is quoted.