Re: Buckets of spam coming through IETF lists

01.04.2011 23:28, John R. Levine wrote:
> Some clever spambot seems to have scraped a bunch of addresses out of 
> the archives and is sending spam with multiple addresses on the From: 
> line through IETF and IRTF mailing lists.  Surely I'm not the only one 
> who's seeing it.
> Given the amount of legitimate mail with multiple From: addresses 
> (none, in practice) a quick shim in front of Mailman should deal with 
> it until someone can go fix the underlying code.
> Regards,
> John Levine, johnl(_at_)iecc(_dot_)com, Primary Perpetrator of "The Internet for 
> Dummies",
> Please consider the environment before reading this e-mail. http://jl.ly
>
> ---------- Forwarded message ----------
> Date: Thu, 31 Mar 2011 14:47:22 -0700 (PDT)
> From: gil(_at_)ISI(_dot_)EDU, jtb(_at_)ISI(_dot_)EDU, cakers(_at_)ISI(_dot_)EDU, irsg(_at_)ISI(_dot_)EDU, 
> coreyc(_at_)ISI(_dot_)EDU,
>     jeanine(_at_)ISI(_dot_)EDU, galstyan(_at_)ISI(_dot_)EDU, 
> rahul(_at_)ISI(_dot_)EDU, end2end-tf(_at_)ISI(_dot_)EDU,
>     ns-users(_at_)ISI(_dot_)EDU, ns-commits-owner(_at_)ISI(_dot_)EDU, touch(_at_)ISI(_dot_)EDU, 
> kyamada(_at_)ISI(_dot_)EDU,
>     newuser(_at_)ISI(_dot_)EDU, probing(_at_)ISI(_dot_)EDU, csd(_at_)ISI(_dot_)EDU, 
> management-request(_at_)ISI(_dot_)EDU,
>     hannes(_at_)ISI(_dot_)EDU, rbates(_at_)ISI(_dot_)EDU
> To: gil(_at_)ISI(_dot_)EDU, jtb(_at_)ISI(_dot_)EDU, cakers(_at_)ISI(_dot_)EDU, irsg(_at_)ISI(_dot_)EDU, 
> coreyc(_at_)ISI(_dot_)EDU,
>     jeanine(_at_)ISI(_dot_)EDU, galstyan(_at_)ISI(_dot_)EDU, 
> rahul(_at_)ISI(_dot_)EDU, end2end-tf(_at_)ISI(_dot_)EDU,
>     ns-users(_at_)ISI(_dot_)EDU, ns-commits-owner(_at_)ISI(_dot_)EDU, touch(_at_)ISI(_dot_)EDU, 
> kyamada(_at_)ISI(_dot_)EDU,
>     newuser(_at_)ISI(_dot_)EDU, probing(_at_)ISI(_dot_)EDU, csd(_at_)ISI(_dot_)EDU, 
> management-request(_at_)ISI(_dot_)EDU,
>     hannes(_at_)ISI(_dot_)EDU, rbates(_at_)ISI(_dot_)EDU
Such messages are not the only problem.  RFC-i list receives messages 
"from" internal Mailman addresses (*-bounces@... and *-request@...), 
that is impossible.  See, eg. this one:
> Message: 6
> Date: Fri,  1 Apr 2011 06:25:12 -0700 (PDT)
> From:<rfc-dist-bounces(_at_)rfc-editor(_dot_)org>,<rfc-dist(_at_)rfc-editor(_dot_)org>,
>         
> <rfc-interest-owner(_at_)rfc-editor(_dot_)org>,<rfc-editor(_at_)rfc-editor(_dot_)org>,
>         
> <rfc-interest(_at_)rfc-editor(_dot_)org>,<rfc-ed(_at_)rfc-editor(_dot_)org>,
>         
> <rfc-info(_at_)rfc-editor(_dot_)org>,<rfc-interest-request(_at_)rfc-editor(_dot_)org>
> To:<rfc-dist-bounces(_at_)rfc-editor(_dot_)org>,<rfc-dist(_at_)rfc-editor(_dot_)org>,
>         
> <rfc-interest-owner(_at_)rfc-editor(_dot_)org>,<rfc-editor(_at_)rfc-editor(_dot_)org>,
>         
> <rfc-interest(_at_)rfc-editor(_dot_)org>,<rfc-ed(_at_)rfc-editor(_dot_)org>,
>         
> <rfc-info(_at_)rfc-editor(_dot_)org>,<rfc-interest-request(_at_)rfc-editor(_dot_)org>
> Subject: [rfc-i] Last call for the money makers
Even provided this is the Fool Day's joke, those who dared to send 
surely has not very healthy sense of humor.
--Mykyta
> Subject: [IRSG] An offer you can't refuse
>
> _______________________________________________
> Ietf mailing list
> Ietf(_at_)ietf(_dot_)org
> https://www.ietf.org/mailman/listinfo/ietf
_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/ietf