Yes, we sent the inbox to a blackhole but keep in mind, Mailinator does not and can not actually "Send" any email.
It's a receive-only service. As always, any email "from" @mailinator.com has had it's reply-to forged (which is pretty trivial).
Also - even before we blackholed the email, it's unlikely any email in that inbox (i.e. hhhh..) was read. Each box has a 50 email limit (FIFO) which was immediately overwhelmed. You couldn't click fast enough between seeing the inbox list and clicking an email.
Mailinator is simply a "receiver" in all of this but we have no indication our servers were otherwise involved.
I don't see a TXT record for _dmarc.mailinator.com. If you created a DMARC reject policy all the major webmail providers would block messages "from" mailinator.com
DMARC basically doesn't work, many mailservers don't look at it and those that do frequently ignore the policy -- even setting a REJECT policy typically results in mail being passed through like nothing happened.
BCC recipients can't see (or contact) each other to mitigate the spread. If you look at the source code, it BCCs 99 contacts from the infected account per message.
When I received a copy of the email 9 hours ago, I tried loading that h^16 mailinator inbox a few times. It was showing as empty except every few minutes a response to the virus email would come in. I saw "stop phishing" and "suck it!" and a couple of others. The virus email itself wasn't showing there.
> it's unlikely any email in that inbox (i.e. hhhh..) was read.
Any way you can tell for sure?
Do you have any logs that could be used to graph the spread of this? E.g. if you were able to find the earliest email to that mailbox you should be able to tell when it started, and with who.
Yes, we sent the inbox to a blackhole but keep in mind, Mailinator does not and can not actually "Send" any email.
It's a receive-only service. As always, any email "from" @mailinator.com has had it's reply-to forged (which is pretty trivial).
Also - even before we blackholed the email, it's unlikely any email in that inbox (i.e. hhhh..) was read. Each box has a 50 email limit (FIFO) which was immediately overwhelmed. You couldn't click fast enough between seeing the inbox list and clicking an email.
Mailinator is simply a "receiver" in all of this but we have no indication our servers were otherwise involved.