Originally Posted by Padawan

Hi ianathuth

What you say is fair comment and I fully understand that my surfing habits could lead to my email addresses becoming know to spammers, spoofers, etc. However the baffling part for me is that I receive these and other spoof emails on addresses that I have set up but NEVER used either for incoming / outgoing email or registering with any website. Hence that I believe SOME of these emails at least must be sent out at random.

Originally Posted by Padawan

Hi everyone

Just thought I would mention that I only registered here about 10 minutes ago and I received the paypal spoof email so probably not anything to do with this site IMHO.

Incidentally, I receive upwards of 20 spoof paypal messages PER DAY, along with similar for all sorts of US banks and other institutions I have never heard of let alone got an account with.

Leads me to believe some script kiddie is just emailing to a whole host of randomly generated email addresses in the hope someone will be caught off guard and give them access to their accounts.... and I know a few who have !

Originally Posted by BootBoy

That message and its variants are being sent out every day by the million.

The point is that myself and several other people used a unique address here, which received that particular mail (probably in the same mailshot).

It's probably not a dictionary attack either. I have my own domain that has at the moment about 20 live address's in total, it's not cost effective to spam a small domain using that method. gmail, hotmail, ntlworld yes. joebloggs.com, no!

Originally Posted by dragon

you use your domain email here? we allowed to do that when i first registerd on .com i tryed to use mine and they said it had to be an isp address :(

Originally Posted by Mal

You can use any on this site, but on the .com site it did have to be an isp address...

Originally Posted by BootBoy

So, anybody any clue as to how the address's were compromised?

Originally Posted by Paul M

Clues - yes. Certainties - no.

We think it was via the nthellworld domain. A quite old copy of the vB software was still present on the old domain (which we hadn't realised) and this had a number of security holes in it that could have been used to extract addresses, if someone with the right technical knowledge had wanted.

There is no way of ever actually proving this, other than a confession from the people involved, but after three days of investigations, this seemed the most likely route. It doesn't explain why only a selection of addresses appear to have been extracted.

Needless to say, that old software has been removed (and a few other changes made).