For the last few days, I have been seeing bounce messages which seem to
indicate that someone is sending commands to our Listserv server using
forged - and mostly bogus - addresses. The addresses and domains vary,
but the sender's name remains the same: Fredrik Williamsberg. I seem to
remember having seen this name on other bounce messages in the past, so
I searched all of our lists and found several subscriptions with the
same name, but with different addresses. An explicit probe of those
addresses has revealed that at least half of them are invalid.

I searched the Dejanews archive for "Fredrik Williamsberg", and got a
number of hits in two newsgroups in the alt. hierarchy. The majority of
the messages are long lists of 'subscribe' commands for thousands of
Listserv lists, including several hosted at this site. The list was
originally posted in Dec 96, in response to a question from someone
looking for a mailbomb program for the Mac. The poster also provided
instructions for using the list to subscribe an intended victim to
thousands of Listserv lists. I have no idea why it was reposted last
month.

I would like to be able to filter this trash, but the forged addresses
are on a wide variety of domains, including large providers like aol.com
and msn.com, so filtering by address or domain is virtually impossible.

Presumably, someone reading this will have had similar experiences. If
you have found a way to filter this trash, or - better yet - you have
determined the real identity of the perpetrator(s), I would like to hear
from you.

Graffiti goofballs, mailbox bashers, and other real-world vandals can
see the results of their efforts, but the idiots who do this stuff have
nothing to show for it, so what keeps them going?

I am including one set of headers from each group of Dejanews messages.

Headers from Dec 97 message:

>Subject:      ************TO SPIKE********** PART TWO
>From:         [log in to unmask]:P (Captain Busternaut)
>Date:         1997/12/06
>Message-ID:   <[log in to unmask]>
>Organization: Army of the Renegade Revolutionary Emu Regime
>Newsgroups:   alt.alt.life.the-universe.and-everything

Headers from Dec 96 message:

>Subject:      Re: is there a working mailbomber for the mac?
>From:         [log in to unmask] ([log in to unmask])
>Date:         1996/12/16
>Message-ID:   <[log in to unmask]>
>Distribution: world
>Organization: magnet Online Service
>Reply-To:     [log in to unmask]
>Newsgroups:   alt.hackintosh

* ----------------------------------------------------------------------
* Paul D. Russell * Senior Systems Engineer * University of Notre Dame
* Email: [log in to unmask] * Web: http://vma.cc.nd.edu/~prussell
* ----------------------------------------------------------------------