Received spam email to my github-only email address

[steve-tregidgo]

Select Topic Area

Question

Body

Hi. It's possible I don't understand something here, and maybe need to change settings.

I received a spam email to an address which is used only for github (a site-unique local part with a domain that I control). If I visit my profile anonymously I don't see the email address. If I sign in and check settings, the email address is marked as Primary, Not visible in emails, and Receives notifications. There are no notifications to match the email.

How could this spam email have been sent to this private email address? The body is github-focussed (we are impressed with your github profile so please buy our website services; the company is Combinatronics) so presumably the address was found in a github context.

Has there been a general email leak at some point? (I'm aware there was a leak from another site in 2016 which exposed github addresses, but a search on HIBP doesn't show my address in that.) Is my address perhaps exposed in a way I don't know about, that I would be able to change?

Thanks,
Steve

[qalmurri]

I have experienced something like that, block spam emails from your account and your problem is solved. If there is spam again, it means your email is exposed to the public and who knows?

[steve-tregidgo]

I can block spam in my mail client but that's not the point of the post. The point is that, as you say, the email address is exposed to the public -- but as far as I can tell, github is the only context where it's used (since I use a unique email address for nearly all sites I register with) so I don't think it should be exposed.

So maybe there's a data breach, or maybe I've made a mistake in my profile settings, or maybe the address could be out there for some other reason (eg could it be exposed by somebody having a checkout of my project?).

[qalmurri]

maybe

[wopian]

At least you're (hopefully) not getting an email from them every 2-3 hours 😂

They've been 100% of the spam folder emails for the past week non-stop...

[kno10]

I also got the "Github + Combinatronics" SPAM, four times in the last 48h 8 times in ~72h.
It is sent via Amazon SES (forward headers to email-abuse@amazon.com), but unfortunately Github does have a functional spam report contact where we could report such abuse.
In my opinion, Github should take legal measures against Combinatronics for abusing their trademark.

[sidney]

I'm also getting the Github Combinatronics spam, many times recently. It is sent to an address I use for commits to a certain repo, but it is not the email address I use for github login. I've resorted to adding info@combinatronics.org to the spam filter blocklist at my ISP.

I suspect that the email address they use is extracted from commit logs.

In your repo, click on any commit hash and then append ".patch" to the link
The page it shows in the browser in the format of an email with a From address of the email address that you used when you made the git commit.

I can see what looks like your github-specific email address when I do that in your repo.

See this from
https://stackoverflow.com/questions/12686545/how-to-leave-a-message-for-a-github-com-user

"For the privacy conscious: To avoid a personal email from showing per any of the answers here, Github users can go to Settings->Emails and check the box for Keep my email address private. Then, they must use git config user.email or git config --global user.email to set their local git email to the Github private email address (@users.noreply.github.com) All of their commits - from then on - will include only the private "noreply" email. Note that any prior commits/local repo commits with the personal email set will still show it."

[steve-tregidgo]

Thanks, that's very helpful. Glad to know how the address got exposed.