full-disclosure - VeriSign's fake SMTP server for SiteFinder

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: geoincidents at getinfo.org (Geoincidents)
Subject: VeriSign's fake SMTP server for SiteFinder

----- Original Message ----- 

> Right now they take in the address of who you are sending to and who is
> sending. What a wonderful way to collect valid email addresses. First
> the MAIL FROM will be a correct address most of the time. The RCPT TO
> will be wrong 100% of the time, but they could employ scripts with some
> logic to see things like    user@...scpe.com is really
> user@...scape.com and such. Many typos are repeated in the same way by
> many people.
>
> Can't wait for the spam to start flowing from that list of users they

So bust them at it. Setup some email that is unguessable, send an email to
noone@...isignsucksnuts4ever.com and if your unguessble address gets spammed
you know they did it. If a number of folks here do that and all get spammed
then it's pretty clear where the information came from.

Geo.