Authors CurseForge

Hi,

today, I received a Blizzard scam mail (which was impressively well made). I only recognized it as scam when I discovered that it was sent to a mail address which I solely use for Curse / WowAce.

AFAIK, the mail address should not be visible to other users or non-users, right? Or did I mess up something in my settings (didn't find an option, though).

Regards,
nyyr

Nope, it's a private domain, so most certainly no guessing.

Thank you for checking, though. Probably just something we have to live with.

I can confirm that I have received quite a few attempted phishes to an address that absolutely 100% was never used for anything but interacting with curse. I'm guessing that there was some kind of hole - a sql injection or whatnot - that was exploited rather than curse selling our info.

At one point (no idea if it's still happening) curse.com addon pages were auto-filling logged-in users' email addresses into the newslettwer box on the side and then subsequently caching the page meaning further page loads were showing another user's email address until the cache got invalidated. It stands to reason that someone could have scraped these from cached pages.