As part of a large-scale privacy investigation, I have bought more than 100 domain names previously belonging to social welfare and justice institutions in Belgium. What I observed was unsettling.
Some emails that came in looked as if they came from vulnerable people themselves, asking for help. It may be that they haven’t received or understood the message to update their address book.
I did not interfere with any of the e-mails, as this would go beyond the objectives of this investigation, but it is concerning, to say the least, that these individuals will never receive a reply. They would not have received a response anyway, but it makes me wonder how many cries for help get lost in abandoned e-mail inboxes.
This honestly depressed me, I know firsthand many people who need help from someone who has more or less knowledge to understand something as simple as the migration of a service or an email, it is really depressing not only to know that this happens, but also that There are people who are such bastards that take advantage of this.
Could someone explain to me how the author gained access to “I forgot my password” accounts that were not his but were in his domain? I mean, I understand that it’s on his domain, but just because I have the domain mydomain@domain.com does that mean I can redirect all emails to the main domain? Excuse the dumb question.
Edit: Thanks for the clarification! Now I understand!
What you’d buy is “domain.com” and can then redirect any emails of the form “<anything>@domain.com” or even things like “<anything>@<anything>.domain.com”.
In fact, any email ending in “.domain.com” or “@domain.com”. And you could set up a wildcard to catch all emails without having to setup that specific email first.
This honestly depressed me, I know firsthand many people who need help from someone who has more or less knowledge to understand something as simple as the migration of a service or an email, it is really depressing not only to know that this happens, but also that There are people who are such bastards that take advantage of this.
Could someone explain to me how the author gained access to “I forgot my password” accounts that were not his but were in his domain? I mean, I understand that it’s on his domain, but just because I have the domain mydomain@domain.com does that mean I can redirect all emails to the main domain? Excuse the dumb question.
Edit: Thanks for the clarification! Now I understand!
What you’d buy is “domain.com” and can then redirect any emails of the form “<anything>@domain.com” or even things like “<anything>@<anything>.domain.com”.
In fact, any email ending in “.domain.com” or “@domain.com”. And you could set up a wildcard to catch all emails without having to setup that specific email first.