Skip to main content

A Paris-Based Researcher Spotted 711 million Email Accounts Lying In Plain Text Files On A Server Hosted In Netherlands


The researcher mentioned his findings in a blog post. The said server was used by a spambot known as ‘Onliner’. And the text files, amounting to 40+ GBs, also contain other details like passwords and details of the email servers used to send the spam.

It has been known that this massive “biggest of its kind” spamming campaign is a launch pad to spread a banking malware called Ursnif. As of now, more than 100,000 different infections have occurred, ZDNet reports.
It’s hard to point out the exact source from where the email accounts and data was collected. But, previous breaches like that of Linkedin did make a considerable contribution.
The unsorted list discovered by Benkow, analyzed by Troy Hunt, contained 80 million emails which were then used to send spams to another 630 million. The hackers used the SMTP servers and ports linked to these email accounts to spread the spam in a way that looks legitimate. In fact, the user credentials were verified against the SMTP servers; the one which didn’t authenticate were not used.
Online data dump 1
Image: List of data dump files.
Hunt operates the site Have I Been Pwned?. You can visit the same to know if your email is included in the breach. Hunt said that this is the “largest single set of data I’ve ever loaded into HIBP.”
“Just for a sense of scale, that’s almost one address for every single man, woman, and child in all of Europe.”
Also, a considerable number of entries from the email data was already present in HIBP’s existing database. In his blog post, Hunt says that the findings can be filtered into two categories:
  • Email addresses used to deliver the spams to.
  • Email addresses and passwords for which the hackers abused their SMTP server to deliver the spam.
There was one “uncomfortable truth” waiting for Hunt, his own email address was present in the list. Thankfully, I have not been pwned.
The irregular construct of the data, mainly sourced from the web, makes the 711 million figure “technically inaccurate” and he said the actual number of humans involved might be somewhat less.
Visit Have I Been Pwned to check your email. Read Hunt’s blog post for more details using this link.

Comments

WHAT'S HOT

Learn How To Download Videos From Popular Platforms Such As YouTube, Facebook, Twitter, Instagram And Any Others

Having trouble downloading that video your crush shared on Instagram or one of those adorable cat videos on YouTube? Refer our guide to learn how to download videos from popular platforms such as YouTube, Facebook, Twitter, Instagram and many others.

Microsoft Has Released The First Windows 10 Build 16353 For Insiders

As Fall Creators Update is nearing its release, Skip Ahead was announced last month. It enables fast ring users to continue receiving new features, though the RS_PRERELEASE

Amazon Cuts Huawei Watch 2 Price To $194.99

Huawei's latest smartwatch has received a temporary price cut in the United States. There is no word on how long the promotion will last, but those interested

Apple Has Confirmed The LTE Issues With Its New Watch Series 3

Before the product starts shipping on Friday, Apple has confirmed the existence of LTE issues with its new Apple Watch Series 3. Reviewers noted the wearable has