General : Are @ntlworld email addresses compromised?

[bigwib]

Has anyone started to receive lots of spam on your @ntlworld.com email address? I suspect many of these addresses have recently fallen in to the hands of scammers.

I have recently started to receive a lot of lurid spam emails to the email address to which my VM account is registered. This rang an alarm bell for me because this email address is dedicated to my account only, and not used for any other email or login purpose. The address domain is a @ntlworld.com from my original account set-up 14+ years ago and until now has not received any incoming mail.

I noticed that the recent spam I have received has been cc'd to many other email addresses, and every one was @ntlworld.com.

[Mr K]

Originally Posted by bigwib

Has anyone started to receive lots of spam on your @ntlworld.com email address? I suspect many of these addresses have recently fallen in to the hands of scammers.

I have recently started to receive a lot of lurid spam emails to the email address to which my VM account is registered. This rang an alarm bell for me because this email address is dedicated to my account only, and not used for any other email or login purpose. The address domain is a @ntlworld.com from my original account set-up 14+ years ago and until now has not received any incoming mail.

I noticed that the recent spam I have received has been cc'd to many other email addresses, and every one was @ntlworld.com.

Think there was a leak a few years ago thanks to a careless VM employee. Still.kept mine but now mainly use Gmail.

[daveeb]

Originally Posted by bigwib

Has anyone started to receive lots of spam on your @ntlworld.com email address? I suspect many of these addresses have recently fallen in to the hands of scammers.

I have recently started to receive a lot of lurid spam emails to the email address to which my VM account is registered. This rang an alarm bell for me because this email address is dedicated to my account only, and not used for any other email or login purpose. The address domain is a @ntlworld.com from my original account set-up 14+ years ago and until now has not received any incoming mail.

I noticed that the recent spam I have received has been cc'd to many other email addresses, and every one was @ntlworld.com.

If you haven't already try ..

https://haveibeenpwned.com/
I have several email addys, including gmail, proton mail, Sky, BT and the only ones on "the list" are NTL/Virgin media ones.

My NTL address is in several breach lists, but all from years ago now.

[Taf]

No spam here, but the layout of https://mail.virginmedia.com/appsuite/ has changed a bit.

[Itshim]

Originally Posted by Taf

No spam here, but the layout of https://mail.virginmedia.com/appsuite/ has changed a bit.

Fail to see why ! Can see my initials are reversed but other than that?

[Taf]

Originally Posted by Itshim

Fail to see why ! Can see my initials are reversed but other than that?

The method to select emails has changed. I now get a drop-down menu with various options.

[Itshim]

Originally Posted by Taf

The method to select emails has changed. I now get a drop-down menu with various options.

Hadn't even noticed that ,not sure what it was before !

[punkrock101]

Not surprised when Virgin Media's password requirements are very lax.

Length must be between 8-10 characters
Must start with a letter
Must contain a number
Must not contain any spaces or any characters that aren't numbers or letters.

asking to be hacked to be honest. every other ISP and email provider on the planet has better requirements, just Virgin Media's systems seem to be stuck in the 90s would not surprise me if the system there are using was inherited from ntl: Telewest.

[roughbeast]

Originally Posted by bigwib

Has anyone started to receive lots of spam on your @ntlworld.com email address? I suspect many of these addresses have recently fallen in to the hands of scammers.

I have recently started to receive a lot of lurid spam emails to the email address to which my VM account is registered. This rang an alarm bell for me because this email address is dedicated to my account only, and not used for any other email or login purpose. The address domain is a @ntlworld.com from my original account set-up 14+ years ago and until now has not received any incoming mail.

I noticed that the recent spam I have received has been cc'd to many other email addresses, and every one was @ntlworld.com.

I'm not with VM any longer, so my NTLworld email is defunct. However, my BTinternet address, retained since I was with BT, is also getting more SPAM than usual. Various filters normally stop all junk, but recently I have had a rash of Phishing emails get through. No such problems with my Gmail or Outlook address, although I use them less, so crooks and spammers may not have those addresses in their data base.

My guess is that spammers have deployed new technologies and the main email providers haven't found ways to block them yet.

[BenMcr]

Originally Posted by punkrock101

Not surprised when Virgin Media's password requirements are very lax.

Length must be between 8-10 characters
Must start with a letter
Must contain a number
Must not contain any spaces or any characters that aren't numbers or letters.

asking to be hacked to be honest. every other ISP and email provider on the planet has better requirements, just Virgin Media's systems seem to be stuck in the 90s would not surprise me if the system there are using was inherited from ntl: Telewest.

Not any more. It was updated last weekend and you can now have 8 to 64 characters and special characters are allowed.

[Qtx]

If you genuinely only used that email address for the Virgin site and never gave it to anyone else or used it anywhere, there are a few options as to how a spammer could have it.

Your pc/whatever could have gotten infected and the email gotten from your browsers saved logins or malware could have sent it to its owners as you typed/entered it it in to a login form on a website.

Sometimes there are tricks to enumerate valid users from email servers or simply brute force which ones are valid by reading the servers response.

The mail server or Virgin site you signed up could have been compromised and all the email addresses exfiltrated. There have been some nasty exploits for a common mail server in 2020 and also some Apache Struts/Adobe AEM/Some other Adobe web stuff that VM used to was also vulnerable. While they try and filter exploitation using network and waf rules, its far from foolproof.

Lastly, an employee could have taken them to sell/backed them up for legitimate reasons and stored somewhere that got compromised or left on a USB stick that got lost/stolen.

So its never black or white.

Also the spammer may have just CC'ed ntworld addresses together as they know a way past their spam filter without giving up some of their better tricks that they can save for later. That same simple trick might get caught by another ISP's filter so they will be less sure of what percent got through if they sent to multiple email providers at once.

There last week there has been a huge increase in spam everywhere

[Itshim]

Originally Posted by Qtx

If you genuinely only used that email address for the Virgin site and never gave it to anyone else or used it anywhere, there are a few options as to how a spammer could have it.

Your pc/whatever could have gotten infected and the email gotten from your browsers saved logins or malware could have sent it to its owners as you typed/entered it it in to a login form on a website.

Sometimes there are tricks to enumerate valid users from email servers or simply brute force which ones are valid by reading the servers response.

The mail server or Virgin site you signed up could have been compromised and all the email addresses exfiltrated. There have been some nasty exploits for a common mail server in 2020 and also some Apache Struts/Adobe AEM/Some other Adobe web stuff that VM used to was also vulnerable. While they try and filter exploitation using network and waf rules, its far from foolproof.

Lastly, an employee could have taken them to sell/backed them up for legitimate reasons and stored somewhere that got compromised or left on a USB stick that got lost/stolen.

So its never black or white.

Also the spammer may have just CC'ed ntworld addresses together as they know a way past their spam filter without giving up some of their better tricks that they can save for later. That same simple trick might get caught by another ISP's filter so they will be less sure of what percent got through if they sent to multiple email providers at once.

There last week there has been a huge increase in spam everywhere

Not arguing with you at all however the ntl address I use for this site only has been compromised . Understand it's the leak from some years ago block spam as and when I see it . Which is longer ago than I can recall