I know this was talked about already, but it seemed like it died down. Haven't seen any word on this in a week. I saw Acadia try to explain the business of receiving email from an address that was given ONLY to renderosity. The last conversation I saw, it seemed like the point was not clear.

I just received a SPAM. It was sent to an address that only exists in two places - my Renderosity member database entry, and my email account forwarding system. This means the database here has been compromised. I suppose you know this already. Thankfully I anticipate this kind of break-in and I did not store any real information in my user profile here. However, I recently had to enter my real info so I could use a gift certificate. Afterward, I changed all my profile info back to fakes. But I worry that somewhere in your transaction database, you have my real name, address, etc. in a computer which is compromised. I'd really like you to delete that information.

I was going to send an email from my account to admin@renderosity.com but then I worried that my real address would end up in your system somewhere. Right now, you only have an address which I can easily turn off. So I'm telling you this in a forum instead of through private communication to avoid actually giving any renderosity computer of any kind my real email address. I'm also doing it here because I think other people need to know this is happening.

This really sux. There should be sticky threads or banner announcements in every forum talking about the issue and what has been or is being done about this. Forgive me if it is on the front page or something. I don't read the front page - I go straight to the Poser forum.

Here is the SPAM - notice the subject text that says (render: message 5 of 20)

That's information from my mail forwarder that is counting messages that came to my renderosity address. Usually it is only ebots that go to that address. If I stop resetting the counter, that address will become dead and I will have to give renderosity another one since it is compromised. But I really don't want to start doing that until I know that it won't happen again. You need to plug the leak and tell me how you did it (I am a software engineer). If I'm not convinced that you've got it locked down, I'm just going to leave renderosity forever.

----- Forwarded Message ----
From: KIA MOTORS PROMOTION webmail4all2007@indiatimes.com
Sent: Thursday, November 1, 2007 6:21:50 PM
Subject: KIA PRIZE NOTIFICATION (render: message 5 of 20)

Attention!!
Your email address has emerged as one of the winner in The KIA MOTORS
Promotion  Prize attached  1,500.000.GBP.(One Million Five Hundred
Thousand Pounds)and a brand new KIA  Picanto. Contact Thomas  Lampard
Email:kia_onlineagent02@yahoo.de, Contact him with your secret pin code KIA/001/11234  and your referencenumber TYT: 2058006/06  fill  the   following information:1,:NAMES.2:ADDRESS.3:AGE ,4:OCCUPATION,5:PHONE / FAX,6:NATIONALITY.

--
My life has changed. What about yours?
Log on to the new Indiatimes Mail and Live out of the Inbox!

I forgot to mention that until this moment, my true bagginsbill email account has been 100% spam free. It has been such a pleasure to log in there and see only things I want to see. Sigh.

I've sent dozens of emails to Renderosity as per their request a page or two ago.

I feel like I'm banging my head against a wall with this. It's completely frustrating.

Some of the spam is being caught by gmail's filters while some isn't and is forwarded onto my outlook express address as I have directed gmaiil to do. 

All of the spam are phishing spam from Nigeria and "British" lotteries etc. Not your typical "Buy Viagra" spam.

What gmail has been catching is in the dozens per day! Dozens!!

But the point is that there shouldn't be any spam in that mail box at all for gmail to even have to filter. The only things that arrive in that box should be Renderosity related ebots such as notifications of wishlist items, news letters, purchase confirmations, gallery notifications and the like.

I really believe that Renderosity can't handle this on their own and need to bring in an independant contractor who knows what they are dealing with and how to fix the obvious leak where the mail servers are concerned.

* fill  the   following information:1,:NAMES.2:ADDRESS.3:AGE ,4:OCCUPATION,5:PHONE / FAX,6:NATIONALITY.

*Lol...nationality??   These ppl don't have an original bone in their body..Or maybe they just think ppl are stupid enough to believe they have to give their nationality to win a prize..lol

I hate spam too.. :(

Acadia,

I think it's worse that that. I don't think it's a mail server issue at all. I think the member database has been broken into, or sold by a dishonest employee. I talk about this all the time with colleages - security policies don't mean a thing if there are humans involved who have an interest in violating them for personal gain. As far as I'm concerned, putting your credit card info into a computer is dangerous, like having unprotected sex. The more partners you engage with, the bigger your risk. I don't do it.

I also never give any web site my real email. I have seen this sort of thing amongst my coworkers many times. We all keep our real email a secret now, and use spamgourmet.com to make forwarding addresses that we can shut off.

I verified that the SPAM I got never went through a rendo server, according to the header. It came from IndiaTimes.com - but my mail forwarder tagged that as a forgery. Frankly, the mail header is pretty easy to forge - I can fabricate a path up to the point where it finally reaches you that says it came from the US president's desk, or make it seem to come from Colonel Klink@stalag13

If you'll recall from last week, I was really nervous about putting real info into this system. I wish now that I had not done so, even for that one transaction.

Maybe 'rosity should do a poll to see how many ppl are getting spammed here and what kinds of email addresses are involved.  I know I've been here a little over a year and I've never gotten any spam here..and I use one of my regular private addresses from my ISP.... one I created just for registering at certain places..that way if it was ever  compromised it could be deleted and another one created...
I don't use any kind of online free email email addresses anymore

Just a thought.....

Since this all started I continue to get that nasty @#&$. It's a continous flow now with giant blasts of it from time to time. I just cleaned 170+ out of my in box just yesterday. That only took a day or so to get. It's now at a level I almost can't delete it often enough to keep up with it.

Quote - Acadia,

I think it's worse that that. I don't think it's a mail server issue at all. I think the member database has been broken into, or sold by a dishonest employee. I talk about this all the time with colleages - security policies don't mean a thing if there are humans involved who have an interest in violating them for personal gain.

But how would that explain an email created on October 9th or whatever which started to receive spam 2 weeks later?

I have used addresses from hotmail, gmail and even my ISP and they have all been compromised.

For example:

1)  XXXX@gmail.com is my original gmail address. I have had this address since 2002 or so when gmail first came out.  During all of that time I never used that email address anywhere. I created it and didn't bother with it because back then it didn't have POP3. 

Earlier this year when I signed up for the "Critique Club" and found that my old hotmail "spam account" which I had been using, couldn't handle all of the ebots from Renderosity (newsletter, gallery upload notifications, comment notifications, favourited notifications, wish list notifications etc), I had to find an alternate address to use.

Someone suggested gmail. So I entered XXXX@gmail.com  as the address at Renderosity. Within a couple weeks I started to receive spam to this address.  Now remember this address was completely spam free for 5 years until it was entered on Renderosity.

2)  XXXX@mts.net  is my primary ISP email address and used only for personal communication. I do not use this email on websites.  I have had this email address since March 2000. It was spam free until I used it on Renderosity earlier this year. Seven years of never having received a single spam email.

When I left the position of co-ordinator and handed back my renderosity.com email address I mistakingly entered XXXX@mts.net into the email area of Renderosity. The following week  I got a newsletter addressed to this  email address instead of the gmail address, along with spam!   I immediately went and changed the email address on Renderosity back to the XXXX@gmail.com one, hoping to control the damage.  ***Remember, ***XXXX@mts.net is my ISP email address that was only used for personal business and never on a website, and was spam free for 7 years until I used it on Renderosity.

3)   YYYYY@gmail.com is an address I created on October 9 specifically for Renderosity use.   I created it for 2 reasons.  1) I was sick of the literally hundreds of spam coming to my XXXX@gmail.com address.  2)  To see how long this new address would stay spam free once it was entered on Renderosity. It didn't say spam free for very long. It took 2 weeks for spam to start arriving at this email address after having used it on Renderosity.

4)  Poser Pros requires the use of an ISP email address on their website now. For me to continue to access their site I had to use one of my ISP accounts. I have not received any spam to that ISP account since entering it into Poser Pros. It's been about 1 or 2 years since they changed their policy about emails and that ISP email is still 100% spam free.

5)  I will also point out that I have a hotmail address that I use specifically for Daz3D. I created that email for Daz back when I first registered there. I have never used that email address for any other purpose than to login to Daz and received their news letters and ebot notifications for purchases. I think I registered with them back in 2004. I have not received a single spam email to that hotmail account, not a single one!  That's almost 4 years with a hotmail address that has been used on one website and no where else  and for no other purpose, and not a single spam received on it.

1. I also have another hotmail account that I created 2 or 3 years ago just for accessing MSN Messenger. I have never used that email address on any website, or to send emails to anyone. It's strictly there for me to use to login to MSN Messenger. Hotmail is the king of spam. But because I have never used that email address for anything but MSN Messenger and haven't shared it around the internet on websites, in the 2 or 3 years that I have had that hotmail address I have never received one single spam mailing to it. Not one. It is still 100% spam free.  There is no doubt in my mind that if I were to enter that email address on Renderosity that I would start receiving spam within a few weeks.

While Renderosity isn't sending the spam directly, there is a leak of some kind that is allowing spammers to harvest email addresses entered into Renderosity. 

My email history above where I actually have  email accounts (some of them hotmail accounts) in use for MSN Messenger or Daz have been spam free for multiple years, while brand new  addresses created and used on Renderosity are getting spam,  prove that there is a problem at Renderosity's end. Spammers are somehow able to harvest emails from Renderosity specifically.  Daz and Poser Pros do not have this problem.

I don't know about the credit card data base. I hope that is more secure than the email server.  I also don't think that anyone has been selling email addresses to spammers. I really does seem to me to be a back door problem of some kind which is allowing spammers access to the email addresses.

I could go and change my email address again, but what's the point?" As it is now it would just start getting spam in it too. :(

It's random. It happens. I get spam to my email address which isn't even my email addrress, if that makes any sense. As much as i'd love to blame Renderosity for some security leak, it's more likely the spam has some other way of finding you.
For every spam email that hits a target, there are probably thousands which miss. Random character generators and all that.
The best defense is to never reply to any of it, lest your email become classified as active.

Quote - It's random. It happens. I get spam to my email address which isn't even my email addrress, if that makes any sense. As much as i'd love to blame Renderosity for some security leak, it's more likely the spam has some other way of finding you.
For every spam email that hits a target, there are probably thousands which miss. Random character generators and all that.
The best defense is to never reply to any of it, lest your email become classified as active.

Mike,

Please don't be insulted, but you should not play "armchair computer scientist", especially when talking to someone (such as myself) who actually is a computer scientist. What you describe is so implausible, according to the rules of information theory, that it is ludicrous.

The user name part of the email address that I constructed for my Renderosity account is 17 characters long, consisting of letters, digits, and periods (.). The letters do not form words that are in the dictionary of any human language. In addition, there are literally millions of mail server names that would have to be attacked to find my full address, but we don't even need to consider that issue.

Letters, digits, and periods give us 37 different characters that could be in each of the 17 character positions of my email name. The total number of possible 17 character email names that can be made that way is:

456,487,940,826,035,155,404,146,917

That's 456+ million billion billion. This is a very, very large number.

Suppose a spammer was trying randomly to find an address as you describe. Suppose that they come from an extremely powerful alien race that has a computer which can generate and test these at a rate of 1 billion addresses per second. (This is more than impossible based on the speed of the internet, but let's just assume it for the sake of argument.)

How long would it take for them to have a 1% chance of finding my address? The answer is over 140 million years.

This address has only existed for 2 years. And as Acadia points out, other addresses have been compromised within 2 weeks. That is not literally impossible, according to the laws of information theory and thermodynamics, but the odds of it happening are so astonishingly low that you are more likely to spontaneously burst into flame than to find my email address that way.

@Acadia,

You asked how does what I say explain the situation. Perhaps you don't understand the difference between a mail server and a database. You cannot ask a mail server to tell you the addresses it knows. It is specifically set up to not do that. But a database is specifically designed to answer questions based on stored information. Renderosity has a database of every user in the system somewhere. This database specifically exists to answer questions for applications, such as this forum or the Renderosity store. Inside the company, you only need to know one administrator username and password to be able to query that database and get a list of every user name, email address, street address, phone number, credit card info, purchase history, etc. In other words, there is a table somwhere with all that information. My concern is that if somebody has discovered a way to break into that database to get my email address, then they also have access to all that other information.

The mail server's job is to store, retrieve, and forward mail messages, based on email user names alone. You cannot ask it to tell you those addresses. You have to know them already. And if somebody somehow managed to hijack those servers and make them do their bidding, then I would see some evidence of a renderosity-owned server in the email header that describes the path by which the message came to me. There is nothing in the header indicating the renderosity mail servers were hijacked.

The database's job is to store and retrieve EVERYTHING renderosity knows. The fact that your address was pulled within weeks of your entering it into your profile (and therefore the database) indicates that the database is open to somebody who should not be able to see that stuff.

It's no concidence that this has all happened after the site changed over to php!

I understand what Mike is talking about..spammers "generate" email addresses just by using the isp...in other words (for non techies) everything after the @ sign.  If your email user name is simple enough they can get lucky and you get an email from them.  Example: mike @ hotmail.com.....the spammers use @hotmail.com and generate thousands of names to put in front of it and mike or john or whoever gets spam.  They are only looking to get ppl to respond so they will know if the address is legitimate.  And when they do this..they do it in bulk so when you get the email you don't even see your address because they either BC'd it or it's so far down the CC list that you have to go to the properties of the email to even attempt to find it.
But rest assured..its there somewhere.
Another thing ppl forget is that if you put your email on a page..ANYWHERE where ppl can see and read it or use it..You open it to the bots that do nothing but scan pages and harvest email addresses....that's why I seperated the address above..the bots won't recognize it and I'm sure there is a mike at hotmail somewhere..lol
For instance if you have a blog or a webpage and you put your email address within a link that says 'contact me'  a bot can get it unless you alter it in such a way as to not look like an address..and I find that using a java button hides it too...the address is within a code that is assigned to the button to make it work...and not "out there" for the bot to recognize.

And like I said before..I've been here for over a year..bought stuff from the marketplace..sent and recieved mails within the site. ..my last name starts with a D and so is at the top of lists usually..and I've never had a problem with spam...but I also don't put my address "out there" anywhere in its real form.
So, if someone here is doing this...they are choosing who they are doing it to..and I find that very hard to believe.  If the database is compromised...it would be affecting everyone I would think.

There is a connection.  I started getting tons of spam at my domain address I use here.  When I changed my email here to my gmail account, the spam went down from 40+ spams a day to 2 or 3 and the spam increased 10 fold in my gmail account.   And while it used to be just "penis enlargement" or "you won the UK lottery" it's getting worse and more vulgar.  I shouldn't have to open my email account and see "F*** her f****** hard in her ****!"

The only change was to change my email here.   There is a connection and it needs to be looked into and I'm getting pissed that nothing has been done yet.

Attached Link: http://market.renderosity.com/mod/forumpro/showthread.php?thread_id=2704078

You're making great points, but none of them are responsive to what I've told you. I created a unique 17 character email address. It does not contain my username. It has numbers in it and periods. It is impossible to guess. It does not go to a well known site like yahoo or gmail. I have never posted it anywhere in any public forum of any kind. It exists only in this site's database. The only way it could be discovered would be if there is a security breach here or at my mail forwarding service. Since the entire and only reason for the existence of that mail server is to eat spam and is extremely secure. None of my other 40 addresses has been compromised. This strongly points to the Renderosity database as the source of the leakage of my address.

The mail server it goes to is a forwarding service that hides my true email address. That server says the headers in the spam I got were forged (not telling the truth), meaning that the IP address that sent the mail did not match the stated host name according to the internet Domain Name Service. That indicates that the sender wanted to hide their true identity, which indicates fraud.

The actual email itself was a phishing message, hoping I'd be stupid and answer it and get sucked into some financial scam.

So - we have a sender who wishes to hide his identity, using an address that is impossible to guess and could only come from Renderosity, sending me a message whose only purpose is to engage me in an attempt to take money from me.

I can't understand why this is not being taken seriously, or why a couple of you are trying to convince me that this happens all the time. It does not happen all the time, but often enough that I have taken the precaution of never giving my real email address to any web site or any retailer. I have also taken the precaution of not leaving any true personal information on this website database.

I have been the victim of identity theft TWICE. One time, it was because a retailer's customer database (TJ MAXX) was broken into by hackers, who then performed over $2000 of cash advances from my credit card, even though I had told the CC company to disable cash advances on my account. The second time was when some idiot at the Boston Globe accidentally printed all the accounts, including credit card numbers, of all the Boston area subscribers. These printouts were then mistakenly used to wrap bundles of newspapers and sent to retailers all over Massachusetts. One of those bundles had my name and info on its wrapper.

So far, all that has happened, largely because I'm cautious, is that I got some spam. I have a simple means to stop that without any great inconvenience to me. This will not be the case for the vast majority of Renderosity members. That concerns me.

Once I understand that Renderosity has plugged the leak, I will make a new address and shut off the old one. But so far, nobody has officially responded. Given that the good folks at Rendo usually respond instantly to anything (good or bad) that I post that concerns them, I gather from the continued silence that they are pretty upset about this and are working very hard to figure out what to do. Until they say something that is technically sound with regard to a mitigation of this problem, I'm going to continue to assume that the Renderosity database is visible to somebody and be careful with my information.

As to who it is affecting, or whether it is odd that I was affected and you were not, that doesn't really matter to me. I don't need to worry less just because only a few dozen people have spoken up about it. Remember, the only people who would suspect Renderosity got breached are those like myself who are certain that the address which was used was unique to Renderosity. There are probably another 100,000 subscribers who put their real email address here and can't tell the difference between general spam and spam that's a result of a breakin here.

Remember, too, that it even if they missed you that proves nothing. Follow to the linked thread. Dozens of people are talking about being affected, and Rendo knows there is a problem.

There is a lot of confusion - people talking about individuals having trojans, about spoofing and making email look like it was sent from Rendosity. Do not get confused. These emails don't look like they were sent by or through Renderosity. That is not the issue. The issue is they were sent to unguessable addresses which are ONLY stored here at Renderosity.

I also believe there is a connection..I just don't think its as serious as someone selling information..I tend to think it has more to do with the bots and how good your email spam filters are.  It doesn't seem to affect everyone and that's what makes me think it has as much to do with personal settings as it does site vulnerability.

I do agree that something needs to be done but first the problem has to be found and I'm sure that they are working on it.

Maybe ppl would feel better if someone from renderosity gave e'one an update??

I see that bagginsbill is conserned about,

SPAM

... and that he got an eMail to,

an address that only exists in two places - my Renderosity member
database entry, and my email account forwarding system.

Did you check with the admin for your eMail forwarding system? 

I get some SPAM that does not actually have my eMail address ...
it seems that some rogue eMail programs are able to 'trick' my ISP's
POP3 server into accepting such SPAM eMails. 

HTH, but YMMV

--
Martin

I'm sorry bagginsbill {love that name] but I was really trying to explain to Mike how he got the spam without seeing his email address.  I don't think I could tell you anything you don't already know about your situation.  You're much more experienced.

I'm sure there is a problem..if there wasnt we wouldn't be here talking about it...and I'm not suggesting that anyone in particular is at fault..just trying to put facts together that may lead to a solution..kind of like a mystery..get the clues together and see where they point.

It does matter that I don't get spam here..it means that everyone isn't affected..but it does not make your problem unimportant...it is important and you deserve the peace of mind of being able to do business without worrying about everything.
Its the not knowing that makes the victims feel helpless to do anything to stop it.

Thanks Annie.

Hey on this issue that's been raised about getting spam to an address that isn't yours...

This is very simple. I am very familiar with the SMTP protocol that handles internet mail. There is a very silly thing in that protocol. The "TO:" field that you see in your message has NOTHING whatsover to do with who the mail was sent to. That is just informational. This is because the message header is supposed to show the target recipients as a virtual entry and can be a nickname or the name of a mailing list or anything you like. There is a separate field, which you can only see if you look into the full exchange going on behind the scenes, that has the real address that the message was addressed to.

Have you ever seen received a message that was "To: All Employees" or "To: Soccer Moms" or whatever? That's not your name, right? Your real user name was exchanged behind the scenes. When somebody mails to a list, everybody on the list gets an individual copy but they all say "To: Admins" or "To: Sales". 

The same is true of the "From:" field. The sender gets to put anything they want in there. If you reply, that's not where you reply to. There is a hidden field that actually controls where your reply goes. So you'll see "From: Town Council" or some such, but if you reply it really goes to an individual.

It is merely a convention, and not a required one, that the true From and To fields are actually displayed in your message.

I myself, once discovered the true identity of a spammer, because he was an idiot and was unclear how to hide his identity in the headers. So I knew his real address. I then sent him (through software I wrote) 10,000 messages with fictitious from and to fields so he wouldn't be able to sort and select and delete them. Every message was different, with a different subject, and a different body, all generated by software with real English sentences, no two alike. That was a delicious moment. I also signed him up for a couple dozen Penis enlargement newsletters.

Quote - Did you check with the admin for your eMail forwarding system? 

LOL Are we still not paying attention?

The email forwarding system I use is SpamGourmet.com. They EAT spam on your behalf. The whole point of it is that they let you make up unique addresses so you can give them to legit companies (like Renderosity) and still receive your email. But, as has precisely happened here, if the address gets stolen and used for spam - you just turn it off. 

I think it would be completely pointless to contact the admins at SpamGourmet - since the only reason they EXIST is to deal with the situation that has actually happened here. You don't contact them and ask if they have a leak - they could not possibly have a leak, otherwise what would be the point of their existence?

They specifically wrote their software themselves. It is not like Bondware or other PHP servers that are loaded with security holes. They designed their software to be absolutely bullet proof, and they never have to upgrade it at all, because all it does it keep a counter and forward email to your real address, unless and until you let the counter go to 0. Since it is not evolving, there is no chance that new bugs are introduced.

Everybody should try their service. It is free and only takes like 1 minute to set up. And - here's the cool part, when you make up a new address, you don't even have to tell them. It's completely magically automatic. Very clever.

Please do not make any more suggestions that the address was leaked from there. 

Think about this - what are the odds that I and hundreds of other Renderosity users who have unique addresses assigned to Renderosity, are seeing spam to this Renderosity private addrses and ONLY to this Renderosity address. 

If SpamGourmet was the culprit, then ONLY SpamGourmet customers would be affected, and ALL our SpamGourmet addresses, including my one true address, would be receiving spam. Also, it would be necessary that all the other Renderosity users used SpamGourmet addresses. They did not - it's happening to yahoo and gmail and other addresses. 

The only common thing among the victims is that the address is stored at Renderosity and nowhere else, other than the actual mail destination. In my case, that destination is, thankfully, SpamGourmet.com and I can turn it off without having to close my real email account.

Lol...that's funny!  
And yes..I did know all of that.  I've been online since '95 and still, everytime I think I've seen it all...some idiot comes up with some new way to scam ppl.  It's the 'unprotected sex' statement...You MUST learn everything you can to protect yourself and even then spammers and phishers will find a way around it and you have to educate yourself on the new scam.
The worst part is how confusing it is to soooo many ppl who have no idea how it's happening and therefor don't know what to do to stop it.

FYI: - A few items from the SpamGourmet FAQ

Pay particular attention to "I don't trust you enough to create an account with you using my email address"
 

Q. How does spamgourmet stop spam?
A. Simple. We delete all of our users' email.

Q. Do you really delete all the mail?
A. OK, there are a couple of exceptions. See below.

Q. Is it free?
A. Yes. All we want is your spam. Your copious spam! (for statistics - the spam is deleted)

Q. Are you going to send me any email?
A. No. That is, unless you email us, in which case somebody will probably reply. Seriously - you can expect a confirmation message when you sign up, a password changing message if you need to recover your password, and that's it (we don't, for instance, send a message saying that your password was changed successfully). We will never send you a message with an attachment!!! There are a lot of viruses running around impersonating email system adminstrators, including us. If you get a message you weren't expecting, it's almost certainly not from us. If it has an attachment, don't open it

Q. I don't trust you enough to create an account with you using my email address.
A. That's not really a question, but here are some things you could consider: a) Go away -- if you change your mind, come back; b) Consider our track record -- we've been here for over 5 years (since late 2000), have never sent even one message to our user list (and no one else has access to it), and have tens of thousands of happy users; c) If you have time, create a free webmail account somewhere and use that to try us out -- be sure to use a really long username with that account, so that you don't get dictionary spam and think it came from us; d) use a disposable email service that doesn't require you to supply a forwarding address. There are several of them out there, and one of them might be just what you want -- be prepared to do more work than you would if you'd signed up here, though, since you'll have to repeatedly go to their sites to read your messages.

Q. Really, how does this site make money?
A. It doesn't. This is a non-commercial service created by folks who've been driven rabid by spam. If you're really concerned, donate, buy a t-shirt, or a mug, or something. Or don't. It really doesn't matter because the service actually costs very little to run, and there are plenty of people lined up to take over paying the tiny hosting fee, if the need ever arises. Nobody has money tied up in the service -- nobody is expecting a return on investment from the service. If you'd like to discuss this, visit this thread

Q. Will spamgourmet stop spam from coming straight to my email address?
A. No. Spamgourmet only gets involved when the sender uses a disposable address that you've given out. When this happens, the message first comes to spamgourmet, then (maybe) to you. If someone sends a message straight to your real email address, spamgourmet isn't involved at all.

Upon seeing that bagginsbill bragged about sending a mailbomb to
a spammer, I have unsubscribed from this thread. 

--
Martin

Yeah well I just received another spam, addressed to my Renderosity account.

So I'm about to set the counter to 0 and effectively unsubscribe from all threads.

Too bad no admins responded to here with what is going on.

bill, I daresay they're taking it seriously, but the fix may be so daunting and expensive that they can't afford it. just identifying the disgruntled employee(s) who hacked the database will no doubt require a subpoena process and all the expense that entails. one "white hat" service I called asked for a $$,$$$ fee, which may give one an idea of the cost involved in stopping this.

I have another clue (which I also posted in that other thread.) For me, I never had spam until I made my first purchase in the RMP last week. They may mean nothing, or it could mean something. It might explain why some people are not affected, including myself until now. If you don't buy anything, then the RMP doesn't know about you. If it is the RMP that is compromised, then that is very scary.

if the marketplace is affected, I agree. it may well be worth the $$,$$$ necessary to fix this.

I am locking this thread since we already have a long thread in this same forum right above this one and it has the most information so there is no need to start a totally different thread on the same topic.  Information gets lost this way.

Thanks