On Fri, 7 Jul 1995 10:33:25 -0400 Mario Rups said: >Poster: Mike Ramundo <[log in to unmask]> >>Overnight I had almost 30 sub/command/posting attempts from someone: >> Mr. Stumble <[log in to unmask]> ( "User unknown" ) >>Would REALLY be nice if I could provide that postmaster more info ! >Another list just got subscriptions from the following rather suspicious >addresses: >>[log in to unmask] Mr Vortex >>[log in to unmask] Mr Stumble >>[log in to unmask] Mr Nimbus >>[log in to unmask] Mr Fiend >>[log in to unmask] Mr Sheik > >You might want to check for those names / addresses as well ... sounds like >something's up. Same here - I had subscriptions for ALL of our public lists for the above addresses, plus <[log in to unmask]> and <[log in to unmask]>. One "wave" of subscription requests around 1:00 AM EDT was rejected since no name was specified, the next wave arrived between 2:00-4:30 AM EDT. Apparently a mass "subscription spam" was sent to LISTSERV@BROWNVM to accomplish this mess as all of the console entries show that the mail requests were forwarded from LISTSERV@BROWNVM (and given the propagation delays in Bitnet, it would explain the length of time involved): 7 Jul 1995 04:21:15 From LISTSERV@BROWNVM: X-FOR FWDED=2 [log in to unmask] SUBSCRIBE 7 Jul 1995 04:21:16 To [log in to unmask]: You have been added to the HP3000-L list. 7 Jul 1995 04:21:16 Sent information mail to [log in to unmask] 7 Jul 1995 04:21:17 Sent information mail to JEFF@UTCVM 7 Jul 1995 04:21:17 Sent information mail to [log in to unmask] I am sending a copy of this mail to BROWNVM's postmaster/Listserv owner and hope they can find something in their logs to indicate the true origin of this attack. The files DID come from BROWNVM (received by Listserv from RSCS, MAILER was not involved and thus no mail spoof here). I'm tempted to contact the victims to see if they have a common enemy, but given what their mailboxes must look like this morning, I think not. [\] Jeff Kell <[log in to unmask]> UTC.EDU Postmaster/Listserv owner +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ | Jeffrey R Kell, Dir Tech Services | Internet: [log in to unmask] | | Admin Computing, 117 Hunter Hall | or [log in to unmask] | | Univ of Tennessee at Chattanooga | Voice: (615)-755-4551 | | Chattanooga, TN 37403-2598 | FAX: (615)-755-4025 | +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+