Data-backup-store

Question

I have a site on godaddy that has a section where you can leave your name, email and a message. Since adding this feature, I've gotten a few entries from [e-mail]. Does anyone know what this is?

I've scoured the internet seeing what it is but haven't found much.

Intrastate

I just noticed that the last 20 subscribers in my MailChimp account all had this type of email. Did some googling on Bing and found this reddit thread with a lot of people discussing it. It seems to be bot-based submissions sniffing for auto-replies on certain domains 🙄 – Lustre

Answer 1

I have been seeing this also in subscriptions at our website since late January. They have been getting past our honeypot robot detection system which up to this point was working well. I don't know if it's related, but we're also seeing a flurry of email addresses with bizarre capitalization. We have been hand-suppressing all email addresses that look suspicious. Very annoying.

Clos

Answer 2

Seeing the same thing here! Super annoying! 2 months ago, we got weird capitalized email addresses to enter our list, as well as emails ending in "data-backup-store.com"... We've added extra protection on our forms, but that doesn't seem to stop them in their tracks.

These are actual email addresses, because some people reach out to our mailings, saying they never subscribed. Plus, I can't ban the IP because each IP is unique... It looks like real people.

Astylar

Answer 3

I recently got {random string}-{sitename}@data-backup-store.com email subscription, not sure what they're up to,

I looked them up on Whois

https://www.whois.com/whois/data-backup-store.com

1. It's is registered by NICENIC INTERNATIONAL GROUP CO., LIMITED. Looks like it's Chinese company?
2. Remember that they are including your domain name in the email stored which means they could potentially track your CRM / mailing list. So if you sell or your CRM gets hacked they'll know where they got the email / list from.

My opinion: I'd purge these types emails from your system. It's what I'll be doing with mine.

Tapestry

Answer 4

I get them in my Contact Us mailboxes. That's really stupid, as surely everyone just deletes spam from there.

The IP address is located in Moscow.

As I get nothing of interest from Russia, I am just blocking their IP 45.143.201.87, and see if that stops them.

Confidante

Answer 5

This a fix I have I did it for #nodejs.
1- Add the list of disposable email disposable-email-domains.json here is a file with 121577 disposable email domains to block it quickly.
2- Add this line const disposable_email_domains = new Set(require("./disposable-email-domains.json")); 3- Add middleware to check if the email domain is disposable. Example:

exports.check_for_disposable_email = (req, res, next) => {
    const { email } = req.body; // Extract the email from the request body
    const emailDomain = email.split("@").pop().toLowerCase(); // Get the domain from the email and convert it to lower case

    // Check if the email domain is in the set of disposable domains
    if (disposable_email_domains.has(emailDomain)) {
        // If the domain is disposable, return an error message and do not proceed with registration
        return res.status(400).render("index", {
            message: "Please use a permanent email address."
        });
    } else {
        next(); // If the domain is not disposable, proceed to the next middleware
    }
};

Desdamonna