BLOG

Who leaked my address, and when?

Providing tagged email addresses to vendors is fascinating, and at the same time disturbing. It lets me track what a particular email address is used for, but also to see where and when they’ve leaked to spammers.
I’d really like to know who leaked an email address, and when.
All my inbound mail is sorted into “spam” and “not-spam” by a combination of SpamAssassin, some static sieve rules and a learning spam filter in my mail client. That makes it fairly easy for me to look at my “recent spam”. That’s a huge amount of data, though, something like 40,000 pieces of spam a month.
Finding the needle of interesting data in that haystack is going to take some automation. As I’ve mentioned before you can do quite a lot of useful work with a mix of some little perl scripts and some commandline tools.
I’m interested in the first time a tagged address started receiving spam, so I start off with a perl script that will take a directory full of emails, one per file, find the ones that were sent to a tagged address and print out that address and the time I received the email. I can’t rely on the Date: header, as that’s under the control of the spammer, and often bogus. But I can rely on the timestamp my server adds when it receives the email – and it records that in the first Received: header in the message.

Dates and times are annoying to work with on the command line, so I also use the perl Date::Parse module to convert the timestamp in the received header into epoch time – the number of seconds since January 1st, 1970. I use some unix commandline magic to run this against my two spam mailboxes and dump the results in a file.

The end result is one line per email, with the epoch time, the tagged email address and the original format of the date and time. Something like this:

Next, I want to find the first occurrence of each tagged address.

I sort the list of addresses numerically, then use this script to display the first time each email address received spam:

That reduces the amount of data enough that I can look at it by hand. What did I find? Several interesting things, but I’m just going to mention one here.

Casemate and Codefast have only ever mailed me via iContact, so given iContact’s history it seems likely that those leaks were via iContact.
Dell, on the other hand, have mailed me directly and through several ESPs – and I don’t recall them using iContact. Looking at the timestamps (and the content of the spams) it’s clear that the Dell and Codefast tagged addresses were both sent spam for the first time as part of the same spamrun – so it’s almost certain that they leaked at the same time.
Looking for iContacts bounce domain (icpbounce.com) in my mailbox I do find that Dell used them briefly, on May 4th. So that’s pretty compelling evidence that iContact leaked all three addresses. (Which means my previous theory about Dell customer addresses leaking, based on misleading statements from Intervision, was wrong.)
There’s another thing that’s interesting… iContact has had a history of email breaches. The data I have here (and it’s matched by a couple of older data points, if I recall correctly) shows spam being sent to newly leaked addresses on the 2nd or 3rd of the month.
I wonder if iContact does a batch export to a subcontractor, or an offsite backup or something similar on the first of each month?

1 comment

  1. Peter Blair says

    Great post – always love seeing blog posts with a bit of Perl to entice us to hold senders to task with what they’re sending us! Keep it up.

Comment:

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.