Great Circle Associates List-Managers
(July 1997)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: please uns*b
From: "Mark E. Taylor" <themet @ mindspring . com>
Date: Mon, 21 Jul 1997 18:10:54 -0700
To: arielle @ taronga . com (Stephanie da Silva)
Cc: list-managers @ GreatCircle . COM
In-reply-to: <199707220041 . TAA26623 @ bonkers . taronga . com>

At 7:41 PM -0500 7/21/97, Stephanie da Silva wrote:


>Yesterday I received s*bscr*be, l*sts, and h*lp commands, four sets
>for each
>of my two lists (24 commands in all) for this address:
>buster @
 miratech .
 kiev .
 ua
>
>[.ua is in the ukraine, yes?]
>
>Everything bounced back user unknown, and given there were so many
>of them,
>I suspected a forge attack (which my server had been escaping for a
>very
>long time, but unfortunately has started happening recently).
>
>Today, I received one set each (s*b, l*sts, h*lp) for the two lists
>for
>this address: forever @
 agrobank .
 kiev .
 ua
>
>My lists are set full moderated so I ignored them.
>
>None of the other lists on my server was hit, so I suspect they used
>the
>PAML as their source document.
>
>None of the fidonet nodes shows up in my logs.

I got the following in the past few days:

Return-Path: <null @
 silverquick .
 com>
Received: from pentioum90.silverquick.com (mail.omegaweb.co.uk
[194.205.38.2])
	by camel5.mindspring.com (8.8.5/8.8.5) with SMTP id NAA02622
	for <themet @
 mindspring .
 com>; Sun, 20 Jul 1997 13:06:15 -0400
(EDT)
From: null @
 silverquick .
 com
Received: from [194.209.151.2] by pentioum90.silverquick.com (NTMail
3.02.13) with ESMTP id da175347 for <themet @
 mindspring .
 com>; Sun, 20
Jul 1997 18:10:24 +0100
Received: from agrobank.kiev.ua (156.106.192.90) by
internet.videorom.ch
 (Rockliffe SMTPRA 1.2.2) with SMTP id
<B0000237531 @
 internet .
 videorom .
 ch>;
 Sun, 20 Jul 1997 19:05:59 +0200
Date: Sun, 20 Jul 1997 19:05:59 +0200
Message-ID: <B0000237531 @
 internet .
 videorom .
 ch>
To: Listmanager @
 silverquick .
 com
Subject: Subscribe

join titanic-discuss
HELP
LISTS
-------------------------------
It is forged to make it look like a legitmate server request for
approval but of course it is fake.  I have a confirm function so of
course this request did not make it.  It looks like the same person
that hit your server tried to hit my list. The address
"internet.videorom.ch" is a Swiss internet service according to
Internic.

Mark




References:
  • please uns*b
    From: arielle @ taronga . com (Stephanie da Silva)
Indexed By Date Previous: please uns*b
From: arielle @ taronga . com (Stephanie da Silva)
Next: Re: please unsub
From: Chuq Von Rospach <chuqui @ plaidworks . com>
Indexed By Thread Previous: please uns*b
From: arielle @ taronga . com (Stephanie da Silva)
Next: Re: please uns*b
From: Chuq Von Rospach <chuqui @ plaidworks . com>

Google
 
Search Internet Search www.greatcircle.com