I use a different email address when ever i sign up to anything which technically doesn't exist but gets forwarded to a central one. The reason for doing this is so i can find who has sold my address/is spamming me. Then I can deal with it and block that address.

I have such an address for my empire direct account. It's never had mail sent from it and it's only ever been typed into the empire direct site. Their privacy policy states that they don't sell or pass on your details:

"EmpireDirect.co.uk takes your privacy rights as a customer seriously. This policy outlines the data we collect from our visitors and how we use it.

Any personal information provided to EmpireDirect.co.uk is used solely by Empire Direct plc, The Clock Buildings, Roundhay Rd, Leeds, LS8 2SH. "

So, interested was I when I got a phishing email this evening sent to the address. This means either:

a) empire direct have been hacked and account details stolen - potentially along with passwords and credit card info
b) empire direct sell your account details

Has anyone else who has bought AV stuff from them gotten phishing emails today? The one i got was a fake Natwest one.

[Nick_UK]

Would it be possible that someone has picked an e-mail address at random, and has come up with one of your addresses ?

I have had spammers using my domain in the "from" field of their spam, but the prefixes in front of my domain name are not ones that I ever use.

well, i can't deny that it is physically possible, however if that is the case then i'm buying lottery tickets for tomorrow's draw :D

[GBDG1]

did the phishing email relate to empire direct, or was it just a standard one?

[Nick_UK]

What spammers often do is to send out blank emails to thousands of random e-mail addresses, and the ones that don't "bounce" can then be counted as live. I thought it was a great idea to have a four-letter domain (so people could remember it easier), but the downside is that it doesn't take many random tries to come up with it.

[I use a different email address when ever i sign up to anything which technically doesn't exist but gets forwarded to a central one

if you need another.(email). if you run out go to www.cyberrights.com for email its anon and part of hushmail

As I said the chances of anyone guessing by brute force the email address in question is less than me winning the lottery this weekend. I have my own mail server and a domain that I just use for email. I have a wildcard set so all email @ automatically routes to one address, then I can specify individual addresses to be blocked or routed elsewhere. It's a very efficient way of dealing with spam, provided that your friends aren't complete dumbasses and don't type your personal address into greeting cards sites. The phishing email was a 'natwest' one - nothing to do with empiredirect.

[Nick_UK]

Is your "official" e-mail address on a web page somewhere ?

'official' ?

Originally Posted by flid

It's never had mail sent from it and it's only ever been typed into the empire direct site.

the only possible explanation for this is that either empire direct were hacked or someone from the company has sold everyone's details

[PmSonic]

Originally Posted by flid

'official' ?



the only possible explanation for this is that either empire direct were hacked or someone from the company has sold everyone's details

I disagree, comments made earlier bu Nick_UK suggest that hackers dont need to be sold / steal email addresses to send out span or phishing emails.

I can back this up by using my work email address as an example.

- I've only ever sent internal emails,
- the address isnt published on any of our litrature or on the website,
- i've never used it to register for anything online,
- we're a really small company & i work very closely with the network team so can vouch for the above statements.

Yet, i recieve spam, phishing attacks on a (fairly) regular basis. Oh, yes and its 8 letter .com domain name.

[Steve_P]

There is a 3rd option but I'm guessing it's a remote possibility as you sound pretty IT savvy... Could your own PC have been compromised as opposed to Empire Direct's info server?

S.

[Ian J]

I set my wife up with an NTL email address a couple of years that has never been used by us at all - either for sending emails or for registering details anywhere and she still gets spam

[Strobe]

There was an article which I read somewhere regarding phishing (may have been PC Pro) which stated that the most common method of 'phishing' was to use randomly generated email addresses. Those email domains with common 'tags' such as 'family' or 'home' or common names in the title 'smith', 'jones', etc are likely to get hit by 'phishing' emails more often.
Our standard email account was quite quiet on the spam front until a few months ago and it now seems to have gone ballistic!
I find the standard junk filter in outlook picks 90% of spam and phishing emails.
IE7 Beta 2 also has a 'phishing website' filter as well.

[umbongo]

Flid,

You are not alone.
I do exactly the same as you with regard to using unique email addresses, (we must have been separated at birth )
Since 26th July I have had 6 phishing attempts directed at my empiredirect address. I have not had any such attempts on any other address and since you've had them as well it really looks like somebody is getting these addresses from empiredirect somehow. Also, if people were making up random addresses I would expect to have got a lot of others directed at my domain as would you.
Did you contact empiredirect themselves about this? If so did you get any response? I just hope our CC details are safe with them!

[IronGiant]

Dave

[umbongo]

Well I suggest everybody steers well clear of them then!

Thanks for the info

[hufartd]

Originally Posted by umbongo

Flid,

I just hope our CC details are safe with them!

Maybe not see below
Sagem 56" purchasers please look in URGENT

[Rygar]

Hmm this is worrying. I bought my plasma from them recently. I also do the same with my email domain. I agree it is virtually impossible to brute force guess one of these email addys.

Had no spam/phishing emails yet. Shall keep a close eye on my credit card bill.

Security compromised or selling email addresses....neither explination is good news.

Don't want to go mud slinging just yet. But if this is prooved I for one will be posting in many popular forums and letting as many tech & news sites I can think of know about this. It's just not on.

[dimwatt]

Flid & umbongo,

I'm in the same boat as you two. For a few years I too have been using a different e-mail address for each online shop, forum, company or anything else that wants my e-mail address. I have been pleasantly surprised that I have had *no* spam, phishing or other obnoxious e-mails from any of them, other than ... Empire direct.

Last June (2006) I bought something from them, and ever since I've had a steady stream of phishing e-mails sent to the address I gave to Empire Direct (and no on else). The have all been pretending to be from English banks and building societies (Nationwide, Halifax, Lloyds, Barclays, RBS (ok, so that's Scottish, but you know what I mean), HSBC and Egg). There have also been a couple of spam e-mails to this address, but the vast majority are phishing.

The first one arrived on 11th July and I've had a couple or so each week. From the other posts I assume that Empire Direct's e-mail database was hacked/stolen/sold last July.

It's only a minor irritation (except if credit card details have also been hacked/stolen/sold), but it has put me off buying anything from them ever again.

I've seen all the comments about spam getting sent to all sorts of addresses, random e-mail address generation etc.. My mail server recieves several hundred a day, and some of the £$*&s stole my domain name to use as a source address too, so I get loads of delivery failure reports for e-mails I never sent. All of that is a nuisance , but these Empire Direct phishing attacks are in a different category - my address was definitely hacked/stolen/sold from their systems and if I can't trust them with my details then I do not want to do business with them.

Dim

[Steve.J.Davies]

if someone has lifted/sold customer details just pray its only the e-mail addresses....

[GBDG1]

You can buy the empire direct customer base with email addresses here:

http://www.listbroker.com/datacards/...?listnum=23343

[NackNack]

Well, it's presumably illegal to pass on details without consent (especially after they said they wouldn't), but allowing phising websites and people sending phising e-mails is obviously a violation of the law on either/both Empire Direct and that websites (supplying e-mail addresses and other details to other companies) behalf. Basically saying it's fine to con people, scary stuff.

As people have said, you're got more chance of winning the lottery than receiving one single e-mail (or multiple ones to the same exact address) to one specific name@yourdomain.com since there is no limit to the possible amount of addresses allowed in 'catch-all' e-mail accounts.

[Adam Shaw]

Remember, there's about 1 billion spam emails sent every single day. I think I get about 70% of them, all offering me greater potency, college lap dancers, etc... But if the remaining 300 million, it is possible someone will get your email address by pure guesswork.

[Rygar]

Originally Posted by Adam Shaw

Remember, there's about 1 billion spam emails sent every single day. I think I get about 70% of them, all offering me greater potency, college lap dancers, etc... But if the remaining 300 million, it is possible someone will get your email address by pure guesswork.

On the whole the spammers only use dictionery attacks to try and guess the part that comes before the @. They tend to stick to already known domains as they will get far, far more hits this way. So...

brute_force_this_part@btopenworld.com (or hotmail.com etc) will yield 1000's of positive hits in a matter of seconds. Whereas...

brute_force_this_part@brute_force_this_part_too.co m will take a long time to even come up with one real email address. So if you give an email address to a company such as are_empire_spammers@mydomain.com, then all of a sudden get spammed on that address, then one of two things has happened:

1. They have sold your email address.
2. You have been unlucky enough to beat odds of billions to one.

In any case after reading Lawrenzini's post above, it would seem obvious that they sell on email addresses. Having said that I bought my plasma from them about 9 months ago and have received no spam to the email address I used (my own domain).

[partyweb]

I get the same thing with 1&1 internet hosting. I used a unique email address for each of my accounts with them which is supposed to be entertered oline on a secure server page and yet I get spam from 3rd parties aimed at each unique address. And of course they flat out deny it. I recon they are probably a bunch of lying scoundrels IMHO.

[NackNack]

Originally Posted by Adam Shaw

Remember, there's about 1 billion spam emails sent every single day. I think I get about 70% of them, all offering me greater potency, college lap dancers, etc... But if the remaining 300 million, it is possible someone will get your email address by pure guesswork.

It's possible but the odds are trillions (if not higher) to one if the e-mail address is guessed once and completely at random to a random guess of a domain also.

[hufartd]

Originally Posted by partyweb

I get the same thing with 1&1 internet hosting. I used a unique email address for each of my accounts with them which is supposed to be entertered oline on a secure server page and yet I get spam from 3rd parties aimed at each unique address. And of course they flat out deny it. I recon they are probably a bunch of lying scoundrels IMHO.

I'm with 1 and 1 as well I have yet to recieve a single bit of spam to any of four addresses I have.
What exactly does Empire direct say about privacy in their T & C.

[Jenn]

Our company has it's own domain but we often get spam supposedly coming from all sorts of combinations@our domain.c om

It's just computer generated I guess and they send from and to all the addresses you can (or can't) imagine.
Addresses at hotmail and the likes get it worse I think.

But if of all the addresses you have only the one supplied to Empire Direct gets any spam, it's a bit suspiscious and maybe it's worth complaining to ED or a watchdog type organisation.

[partyweb]

Originally Posted by Jenn

...But if of all the addresses you have only the one supplied to Empire Direct gets any spam, it's a bit suspiscious and maybe it's worth complaining to ED ...

Just don't hold your breath. I complain every time 1&1 send me a customer satisfaction survey, where a ask them to contact me and they never bother.

[Rygar]

Originally Posted by Jenn

Our company has it's own domain but we often get spam supposedly coming from all sorts of combinations@our domain.c om

It's just computer generated I guess and they send from and to all the addresses you can (or can't) imagine.
Addresses at hotmail and the likes get it worse I think.

But if of all the addresses you have only the one supplied to Empire Direct gets any spam, it's a bit suspiscious and maybe it's worth complaining to ED or a watchdog type organisation.

Yeah we get spammed on our company domain too...but thats a bit different. The spammers have not guessed (or used a computer to guess) your company domain. They have got it from somewhere else...usually a web crawler, as a result of "helpfull" employees forwarding on email chain mail warnings about a new super virus that will magically cause physical damage to your hard drive...or they have entered their email address on some online form to get a free game, see a funny movie clip, join up to a forum etc.