Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Ask HN: What is the scam here (random email from dating site)?
2 points by CharlieDigital on Dec 10, 2024 | hide | past | favorite | 7 comments
Over the last week, I've received random emails from two dating sites.

On 12/09, I received one from CoffeeMeetBagel addressed to "Michael" (but using my email). I've never heard of this site and certainly I am far removed from the dating scene.

It was curious, but I checked my Gmail activity log and there was nothing suspicious; all IPs match my location.

Then today, I received another one from Match addressed to "John".

Again, there's no odd activity for my Gmail account and no confirmation email from either of these platforms.

I'm wondering if this is happening in anyone else's inbox and what the motive is? Why use a random person's email to register accounts on dating sites? Are there other signs I should look for for signals of compromise? What's the scam here?

The origin emails look legit as do the target URLs in the email.



Did you put the email and its full headers in the google email analyzer [1] and does it show anything odd or interesting? Another option is to put the email and headers into Spamcop [2] and let them decide if it should be blocked.

As to what game they are playing, it's probably just a poorly configured or broken spam script. Assume malfeasance, report them, block them and ignore. If you are feeling adventurous, create a throw away email, wipe all cookies and contact the "company" they are spamming but do not give them your email address or name ... but I would not expect to learn anything.

[1] - https://support.google.com/mail/answer/29436?hl=en

[2] - https://www.spamcop.net/anonsignup.shtml


Looks normal to my somewhat-trained eyes (removed some long b64 text):

    Delivered-To: c*****c@gmail.com
    Received: by 2002:a05:622a:2a0c:b0:467:591a:6631 with SMTP id hc12csp2364502qtb;
            Tue, 10 Dec 2024 08:59:35 -0800 (PST)
    X-Google-Smtp-Source: AGHT+IGHrx0n0rF34Mu5kFPt6JBe+K2y/C7fx97S3yJLeeI6O3G9Gg1Ub3IyU1ODpk70l0PnDSPI
    X-Received: by 2002:a05:6808:1987:b0:3e6:3860:596b with SMTP id 5614622812f47-3eb66db44b0mr4523293b6e.8.1733849975341;
            Tue, 10 Dec 2024 08:59:35 -0800 (PST)
    ARC-Seal: i=1; a=rsa-sha256; t=1733849975; cv=none;
            d=google.com; s=arc-20240605;
            b=TL9EfEp...
    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
            h=content-transfer-encoding:mime-version:to:date:subject:reply-to
             :from:message-id:feedback-id:dkim-signature;
            bh=sE8MV1f4/vzfiOpmJ7EPLrcEfzhKlTbS2yRqcgTnH9M=;
            fh=h+pPFj8nziLrXl60oePqBIUnnD7yPF5agewzKiyZPmQ=;
            b=Il17BTPkoUGrYNB...;
            dara=google.com
    ARC-Authentication-Results: i=1; mx.google.com;
           dkim=pass header.i=@connect.match.com header.s=102022s2048 header.b=BkIa29w2;
           spf=pass (google.com: domain of bounces-ma-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com designates 208.83.243.178 as permitted sender) smtp.mailfrom=bounces-MA-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com;
           dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=connect.match.com
    Return-Path: <bounces-MA-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com>
    Received: from f.mx.connect.match.com (f.mx.connect.match.com. [208.83.243.178])
            by mx.google.com with ESMTPS id 5614622812f47-3eb46cb80b6si3776262b6e.262.2024.12.10.08.59.35
            for <c*****c@gmail.com>
            (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
            Tue, 10 Dec 2024 08:59:35 -0800 (PST)
    Received-SPF: pass (google.com: domain of bounces-ma-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com designates 208.83.243.178 as permitted sender) client-ip=208.83.243.178;
    Authentication-Results: mx.google.com;
           dkim=pass header.i=@connect.match.com header.s=102022s2048 header.b=BkIa29w2;
           spf=pass (google.com: domain of bounces-ma-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com designates 208.83.243.178 as permitted sender) smtp.mailfrom=bounces-MA-1-18-73cfea26-0421-45d2-a15f-684ab32f822e@connect.match.com;
           dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=connect.match.com
    DKIM-Signature: v=1; a=rsa-sha256; d=connect.match.com; s=102022s2048; c=relaxed/simple; q=dns/txt; i=@connect.match.com; t=1733849975; h=From:Subject:X-Campaign-Data:Date:Feedback-ID; bh=sE8MV1f4/vzfiOpmJ7EPLrcEfzhKlTbS2yRqcgTnH9M=; b=BkIa29w2wCbzGaez/BjEjdxmnmDlaxErYRZS/eY15ltL7Xo2XWaawSuj02QmP4Qo v7Ufl/zYOYDKHZH3MznKkC6Lq3ameafr0dC4WIjJIR1mJDZinrCE3DZfgxs14Yy3 WyGCzvUANAwMKxnIAKCmBGaFcGgSUYSSpWip+mY0QNvWvMb6GUrUqWe2Av+emMx4 HDVkErbJBBGm+fFJbgYZ2qVw73uRPD30IiprRtLtfAoDhb9w6nJaGnJg1QBwknXZ KPA/j6Ww2V1x3FihwktWoOE4T8c2+syPNP8mjgjbLXEi5jAU/N62kaWexNf4z855 xxFyz/LACPmXE/4rb0jsTA==;
    X-MSFBL: eeQIKvrWqPIJKHYeRzxby9MXM3txIzTV313rEeS8Mpw=|eyJiIjoiVm...
    Received: from [10.20.29.93] ([10.20.29.93:39710] helo=wa3mama103) by f.mx.connect.match.com (envelope-from <mailer@connect.match.com>) (ecelerity 4.6.0.20098 r(msys-ecelerity:tags/4.6.0-ga^0)) with ESMTP id 6F/2B-01369-77378576; Tue, 10 Dec 2024 10:59:35 -0600
    Feedback-ID: MA-1-ENS-18:Matchcom
    Message-ID: <6F.2B.01369.77378576@wa3shml023.iacp.dc>
    X-EmailID: 73cfea26-0421-45d2-a15f-684ab32f822e
    X-eType: emailens
    X-Campaign-Data: MA-1-12102024-3-ENS-18-73cfea26-0421-45d2-a15f-684ab32f822e-T105935
    From: Match <mailer@connect.match.com>
    Reply-To: donotreply@connect.match.com
    Subject: John, we’re glad you’re here.
    Date: Tue, 10 Dec 2024 10:59:35 -0600
    To: "c*****c@gmail.com" <c*****c@gmail.com>
    MIME-Version: 1.0
    Content-Type: text/html; charset=utf-8
    Content-Transfer-Encoding: base64
    
    DQoNCg0KDQoNCg0KICAgIA0KICAgIA0KICAgIA0KDQogICAgICAgIA0KICAgICAgICANCiAgICAg...
I wouldn't classify it as spam as it is clearly coming from their domains in both cases and look like legitimate account creation emails.

I've emailed both companies to notify them that their account creation process seems to be omitting an email verification step (possibly verifying only the phone number).


Ah Match... I used to support their backend long long ago. It is likely someone running a script to set up fake accounts using email addresses they acquired. That script probably has an error and re-used an email address. I would just block emails from their domain if you have the option I don't use gmail.

You may with to edit your comment to remove the headers all together as they are legit headers from Match.


Does the process not verify email address ownership?

    > ...someone running a script to set up fake accounts
To what end? How does this scam work (even if I'm not involved?)


Does the process not verify email address ownership?

It did not used to for the initial account creation and that is likely all they need. They create a fake profile and put links to some malicious site or other shenanigans that affect Match users. The scam does not actually involve you at all. They will not be able to have a paid account unless something changed but they likely do not need it. There are other things that could be going on but then I would be at risk of defaming people running the site and that's a much longer story. All I can legally say is that you should just block anything coming from them unless you plan on being one of their members.

Now if on the other hand you see something from their company on your credit card statement, get your bank and the Federal government involved and not the state of Texas but I do not expect that to happen. Let the feds engage the state. I am not a lawyer and this is not legal advice. There is nothing more I can add to this.


I have a couple of first name second name Gmail accounts and I regularly get odd emails (like about my new bike bought in New York - never been there). It seems to be mostly either transcription errors or people trying to see if there is a verification process. Never had any actual problems, though a pet may yet still not have had it's treatment (I did my best).


depends on how obvious it is...whats your email address?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: