All the ACOR listowners are complaining of relentless spam from 4/5 email accounts over the last 3 days. I have also received my share from those ..... It is the second or third time we have seen the problem in the last 2-3 weeks. The 4 addresses are also generating error messages in the logs such as this: ------------------------------------------------------------------------------------------- 2 12/16 12/16 [log in to unmask] Last error: Mailer mx.KAAPELI.FI said: "550 <[log in to unmask]>... User unknown" 1 12/17 12/17 [log in to unmask] Last error: Mailer mx00.schlund.de said: "550 Unknown local part LadyV in <[log in to unmask]>" 1 12/17 12/17 [log in to unmask] Last error: Unavailable; DSN status was 5.1.1 1 12/14 12/14 [log in to unmask] Last error: Mailer smtp.CHINA.COM said: "550 <dave> is now disabled with SMTP service." ---------------------------------------------------------------------------------------------- Part of the header from the [log in to unmask] spam looks like this: ---------------------------------------------------------------------------------------------- Received: from wnt.dc.lsoft.com (wnt.dc.lsoft.com [209.119.1.32]) by tam.dorsai.org (8.10.2/8.10.2) with ESMTP id eBFNjZc17867 for <[log in to unmask]>; Fri, 15 Dec 2000 18:45:35 -0500 (EST) Received: from home (home.ease.lsoft.com) by wnt.dc.lsoft.com (LSMTP for Windows NT v1.1b) with SMTP id <[log in to unmask]>; Fri, 15 Dec 2000 18:43:27 -0500 Received: from 209.119.0.33 by LISTSERV.CYBERLATINA.NET (SMTPL release 1.0d) with TCP; Fri, 15 Dec 2000 18:43:26 -0500 Received: from korporate.co.uk by home.ease.lsoft.com (LSMTP for Windows NT v1.1b) with SMTP id <[log in to unmask]>; Fri, 15 Dec 2000 18:43:26 -0500 Received: from n74.OnlineToday.Com_[204.181.201.74] [204.181.201.74] by korporate.co.uk (SMTPD32-6.04) id ABB9740110; Fri, 15 Dec 2000 23:39:37 +0000 Received: from ns1.filetron.com by n74.OnlineToday.Com with ESMTP; Fri, 15 Dec 2000 16:36:26 -0800 Message-ID: <[log in to unmask]> To: <[log in to unmask]> From: [log in to unmask] Subject: Don't miss this $700 Give Away 5478 ----------------------------------------------------------------------------------------------- There is no trace of any subscription for any of these addresses. I believe that only the listowners got spammed. But it looks like the spammers used home to relay. Am I correct in my assumption? Is there any problem with LISTSERV? Gilles Frydman ACOR.org