I’m very careful with privacy and security so I was surprised I got an obvious phishing email from “American Express”. I reported the email and moved on only to get another one today. I checked haveibeenpwned and it came back clear. I have never gotten a phishing email before the other day. As for the senders, they all came from generic IT sounding email addresses. They obviously weren’t American Express.
This is gonna sound silly but check here:
Might have some info if you’ve had creds leak or get exposed somewhere.
Nvm, just re-read your post and saw you already did. Leaving this up for the link for others. Sorry to bother!
I’ve used that website in the past with no problem but a heads up I had to turn on js and off antifingerprinting to get it to load this time. For all those more security conscious than I
It works fine for me in Librewolf and Mull. What browser are you using? Just curious.
When I sign up somewhere, I often use
my.emailaddress+service@gmail.com
And then occasionally spam comes into my mailbox “hi person, you singed up for spam service” send to my.emailaddress+spotify@gmail.com
and well, now I know who sold it
also also, type your email into haveibeenpwnd.com to find if it’s leaked somewhere
Probably a breach that’s not on have I been pwned yet.
If you have signed up on dubious websites with questionable privacy policy, many of them legally sell this data to “data brokers” who then sell it to anyone willing to pay. This happens more than you’d think, for example in 2019 it was reported California DMV makes $50 million a year selling users information. https://www.caranddriver.com/features/a32035408/dmv-selling-driver-data/
One neat trick is to signup for services with an email like name+website@domain.com, that way if you ever get spam you’ll know where you have been compromised.
Information might also be leaked through data breaches. An email is not a particularly hard thing to find, or even guess.
A spammer could easily just have a computer iterate through all possible combinations of emails and usernames, and shotgun it.
Especially for a name like OP’s. If their email is a similar name, it wouldn’t be difficult for generate one that is also two words.
I’ve used this many times before. But this is so well known I wonder, why wouldn’t spammers/scammers just remove the “+” and trailing characters before “@“?
True. A more reliable way to achieve this is to buy a domain and use addresses in the form websitename@your.domain.
