3

I have received two unsolicited advertisements to an address that has never been given to anyone except Stack Exchange (SE), and they are not from SE. The address hasn't even been used to log into SE because all the conflicting instructions I've found for making the change refer to links or buttons that no longer exist.

I'm asking about what can be done in terms of SE, not a general response to spam. (I know about detection and filtering methods and ways to report, etc.) I won't be surprised if the answer is "nothing", but it "doesn't hurt to ask."

Improve this question
  • How easily guessable is your address? Spammers do just run through every common permutation – ArtOfCode Jul 22 '16 at 12:25
  • SE at a domain that has very little traffic and zero content pertinent to SE nor to the spamvertised service. Oddity is that it is a service aimed at I.T. people. I'd think that they would understand that spamming such people is a good way to make enemies, not get business. – WGroleau Jul 22 '16 at 12:27
  • I dunno about that... wgroleau@google.com! – user1228 Jul 22 '16 at 12:51
  • @Won't: Dunno about what? Are you saying that you guessed my address? If so, (1) that address is not mine; and (2) if it were, what would that prove about anything else above? – WGroleau Jul 22 '16 at 17:05
  • Then why did you email me back at that address and say, "Yeah, you got me, bro. I owe you a hundred bucks like you said in that email. What's your paypal?" Huh? Tell me THAT! – user1228 Jul 22 '16 at 17:33
  • I have no idea whether you are lying or whether the address is real and whoever owns it actually responded. Again, it is not my address. Nor does it have any resemblance to the address the spammer used. – WGroleau Jul 22 '16 at 17:36
4

You have a five year old account, and appear to be using the default Gravatar image for your avatar. Those have had some issues (See Is Gravatar a privacy risk?, Is using Gravatar a security risk?, and others in the top-voted section of the tag). Since about three years ago, Stack Exchange takes some effort to prevent your e-mail leaking this way, but they didn't swap out existing avatars for anyone that had already signed up. This could easily be the way your e-mail address leaked.

Improve this answer
  • So the default image is actually taken from Gravatar? I did not know; thought it was just some graphic. I will promptly change it! Although, your second link says something about having a Gravatar account, which I don't. – WGroleau Jul 22 '16 at 17:08
  • @WGroleau Yeah, you should be able to right-click the image on your profile page, hit Properties or whatever similar option your browser has, and see the image's URL. Has the md5 of your email address right there. It's how I verified you were still on Gravatar before posting this answer. – Billy Mailman Jul 22 '16 at 17:09
  • So, when I attempted to change my e-mail address in late 2014 or early 2015, SE sent the new address to Gravatar and got that MD5 in reply? And the MD5 is reversible to determine address? – WGroleau Jul 22 '16 at 17:14
1

Not much to do. I guess you have been hit by some 'check all possible email addresses and their permutations' spam bot. I really doubt if this is related to SE at all. SE does not give email addresses of their users to third parties. Never!

So judging the above, either SE has to be hacked, which is unlikely since you seem to be the only one receiving such mail, or they have guessed your email address correctly 'by accident'.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .