Quote from: dscotese on December 24, 2015, 09:46:56 PM

Quote from: SebastianJu on December 24, 2015, 11:39:01 AM

Quote from: dscotese on December 24, 2015, 12:10:12 AM

One strategy to distinguish between email addresses that are in use (on a particular site) and those that are not is to attempt to have a password reset email sent. Some sites will respond differently depending on whether or not the email address entered exists in their database. Better sites respond with "If your email address is in our database, we have sent you an email."

I just verified that bitstamp's response depends on whether or not the email exists in their database, so that may be what has been going on. Once the hacker gets a response indicating that the email exists, they have confirmed that they have the email address of a person with a bitstamp account.

So they would send out phishing mails or other scammails then? Since when they would try to login then my account surely would be banned for some minutes so that the automatic login tries can't be successfull. Though nothing like that happened.

I have 2FA, for all websites where i have lying something of value at one time, activated anyway.

I wonder what they want to do with it.

No, man. I don't think they would send out phishing emails afterwards, but maybe. I think it would be far more profitable to use emails that have been verified to be Bitstamp customers' emails by sending them spam advertising Bitcoin-related services.

Right, that might be. It might be they take the leaked database from the bitcointalk.org hack and check if the email addresses are still valid that way. Then they send out "double your investment hourly" emails. Cheesy