Re: [Full-Disclosure] Mailing lists and unsolicited/malicious spam

On Fri, 26 Nov 2004 16:51:27 GMT, n3td3v said:

> Yahoo! Groups, a fully featured user group and mailing list has taken
> steps to prevent malicious users harvesting new e-mail addresses to
> add to spam list databases. They (Yahoo) cut the e-mail address on the
> website, so harvesting becomes impossible by only showing the user
> side of the e-mail address. Example "n3td3v@...".

So you take that left-hand side, and do this:

for i=1 to 100
        send_spam("leftside@" || common_domain[i]);
done;

OK, so for 95 of them it generates a bogus address, and you might even miss
the actual domain of the person you targeted, but if you get 5 accidental
matches..

(And yes, they do this - when you have 40K zombies, trying 100 million addresses
in the hopes of hiting 100K actual addresses is a sensible way to do things...)

pgpH35q671f9a.pgp
Description: PGP signature