Hacker News Reader

abuse@, postmaster@, hostmaster@ mails were meant to be present for this, but nothing is enforcing s domain to serve email.

View on HN

Not enforced no, but this works a lot of the time though (include info@ as well). In whois data you can also always find an email contact for abuse notifications

(To be fair, I was a bit annoyed by a recent AI bro spamming about fifteen such prefixes on my domain with a false positive vulnerability report. The PoC did not work and the field they were injecting was already correctly escaped. But it is an effective contact method if you're facing a bulk problem like this I suppose. Maybe try just one prefix at a time until an email is accepted)

Surely those addresses are compromised in most cases where the server itself is compromised?

Very few people host email, and even fewer in the same VM as where their website is. I would be surprised if this is the case for even 1% of the sites, and attackers probably are exploiting sites by the hundreds, not babysitting and monitoring the email traffic of one of them to quickly delete any vulnerability reports coming in

Reply on news.ycombinator.com