That was an incredible read. Terrifying actuality. So obvious once you think about it.
I own my old ISP’s domain. less than twenty email addresses active. Everything else is rejected. I ran it for a week with a catch all bucket and I can tell you now many of those people should be thankful I have and not some unscrupulous scammer. Things like cellphone, social media and medical records accounts all still linked to a ISP domain that has been dead for nearly a decade. The place where I host it sent me a email recently and asked me what had happened to that domain. The user websites are still regularly queried and I’ve considered doing a goatse or tubgirl on all the linked images. Fortunately I’m not in my twenties anymore and decided not to share the chaos.
Good read. Makes sense and not even that complex, good that they did this experiment anyway just to prove it out to those less technical and try to get prevention steps out there.
This needs a government / IEEE / domain registrar policy of some sort. Maybe it should simply be that all expired domains are put into stasis for 10 years.
If you want to buy it and have access to it sooner, then you need to run (and pay for) a program of works to catch and proactively kill all linked accounts, and build a register of embargoed existing email addresses that must be set to bounce.
I knew this was a problem, but wow, had no idea it was this bad…
Because I have a firstname.lastname@popularcloudemail.domain type email, I get SOOO many people signing up for accounts with my email, forgetting that theirs had some number suffix. I get peoples phone bills, pizza receipts, Amazon orders, parking meter e-receipts, Xbox live accounts, Dropbox logins, you name it.
I NEVER thought of what that would look like at a domain level!
I read a great post where a guy bit-squatted (bought a domain that was 1 flipped bit away) Google and managed to replace the Google logo on google.com for millions of people. He did the same for facebook and ended up getting thousands of post requests with user data which normally would have failed to resolve or just timed out.
There is still plenty of unexpected fun to be had with domains.
Some emails that came in looked as if they came from vulnerable people themselves, asking for help. It may be that they haven’t received or understood the message to update their address book.
I did not interfere with any of the e-mails, as this would go beyond the objectives of this investigation, but it is concerning, to say the least, that these individuals will never receive a reply. They would not have received a response anyway, but it makes me wonder how many cries for help get lost in abandoned e-mail inboxes.
This honestly depressed me, I know firsthand many people who need help from someone who has more or less knowledge to understand something as simple as the migration of a service or an email, it is really depressing not only to know that this happens, but also that There are people who are such bastards that take advantage of this.
Could someone explain to me how the author gained access to “I forgot my password” accounts that were not his but were in his domain? I mean, I understand that it’s on his domain, but just because I have the domain mydomain@domain.com does that mean I can redirect all emails to the main domain? Excuse the dumb question.
Edit: Thanks for the clarification! Now I understand!
What you’d buy is “domain.com” and can then redirect any emails of the form “<anything>@domain.com” or even things like “<anything>@<anything>.domain.com”.
In fact, any email ending in “.domain.com” or “@domain.com”. And you could set up a wildcard to catch all emails without having to setup that specific email first.
