Hacker News Reader

Comment by geocrasher | Hacker News Reader

Ok, so using a fake new gmail address the spammer used an instance hosted at mx5.messagingengine.com (probably a hacked or vulnerable mail server hosted at https://expedient.com/, cloud provider) to send mail via SMTP/gmail to a

   <list of several hundred random domestic email addresses - aol, hotmail, yahoo, icloud, gmail, etc.>

There's nothing to indicate you were specifically targeted, but rather that they guessed your email address. It didn't bounce, so they kept sending to it.

View on HN

> rather that they guessed your email address

I'm sorry, I don't see how the fact that there are a large number of recipient email addresses provides evidence for the idea that my email address was guessed. A spammer with a list of addresses bought off a marketplace could easily have done the same thing, couldn't they?

if you see the other addresses, can you check if they're registered on comcast website? https://login.xfinity.com/login to try to see if it exists

if someone got a fresh list of mail addresses, they'd probably test all the mails coming from this source at the same time, could confirm your theory

Sure, could have. But spammers are cheap. They're not going to buy addresses when they can guess them. I'm going based off what is most likely based on what I see- a typical spammer doing typical spammer things. You might go look at haveibeenpwned.com and see if your email address is listed there, to see if it's some part of a breach.

haveibeenpwned.com shows nothing, and I reached out to some of the other addresses on the email and got autoresponders and messages back from real people confirming that they used that email for their Comcast account - so, no, these addresses were not guessed.

messagingengine.com is the domain used for fastmail's mail servers.

Huh, that suggests that geocrasher doesn't actually know what they're talking about.

Reply on news.ycombinator.com