All the ACOR listowners are complaining of relentless spam from 4/5 email
accounts over the last 3 days.
I have also received my share from those .....
It is the second or third time we have seen the problem in the last 2-3 weeks.


The 4 addresses are also generating error messages in the logs such as this:
-------------------------------------------------------------------------------------------
2 12/16 12/16 [log in to unmask]
Last error: Mailer mx.KAAPELI.FI said: "550
<[log in to unmask]>... User  unknown"
1 12/17 12/17 [log in to unmask]
Last error: Mailer mx00.schlund.de said: "550 Unknown local
part LadyV in <[log in to unmask]>"
1 12/17 12/17 [log in to unmask]
Last error: Unavailable; DSN status was 5.1.1
1 12/14 12/14 [log in to unmask]
Last error: Mailer smtp.CHINA.COM said: "550 <dave> is now
disabled with SMTP service."
----------------------------------------------------------------------------------------------

Part of the header from the [log in to unmask] spam looks like this:

----------------------------------------------------------------------------------------------
Received: from wnt.dc.lsoft.com (wnt.dc.lsoft.com [209.119.1.32])
by tam.dorsai.org (8.10.2/8.10.2) with ESMTP id eBFNjZc17867
for <[log in to unmask]>; Fri, 15 Dec 2000 18:45:35 -0500 (EST)
Received: from home (home.ease.lsoft.com) by wnt.dc.lsoft.com (LSMTP for
Windows NT v1.1b) with SMTP id <[log in to unmask]>; Fri, 15 Dec
2000 18:43:27 -0500
Received: from 209.119.0.33 by LISTSERV.CYBERLATINA.NET (SMTPL release 1.0d)
with TCP; Fri, 15 Dec 2000 18:43:26 -0500
Received: from korporate.co.uk by home.ease.lsoft.com (LSMTP for Windows NT
v1.1b) with SMTP id <[log in to unmask]>; Fri, 15 Dec
2000 18:43:26 -0500
Received: from n74.OnlineToday.Com_[204.181.201.74] [204.181.201.74] by
korporate.co.uk
(SMTPD32-6.04) id ABB9740110; Fri, 15 Dec 2000 23:39:37 +0000
Received: from ns1.filetron.com by n74.OnlineToday.Com with ESMTP; Fri, 15 Dec
2000 16:36:26 -0800
Message-ID: <[log in to unmask]>
To: <[log in to unmask]>
From: [log in to unmask]
Subject: Don't miss this $700 Give Away 5478

-----------------------------------------------------------------------------------------------


There is no trace of any subscription for any of these addresses.

I believe that only the listowners got spammed.
But it looks like the spammers used home to relay.
Am I correct in my assumption?
Is there any problem with LISTSERV?


Gilles Frydman
ACOR.org