In a one-hour period overnight, our Listserv server received nearly 400
suspicious INFO requests like the one below. I may be mistaken, but it
appears to me that the 'from' line in this message was forged, and I
suspect that is true for all of the others, as well. Listserv processed
most of the requests, thus making this site - and about 50 others - an
unwitting accomplice in this net.vandalism incident. Listserv messages
to a few of the addresses bounced with 'unknown user' errors, while
messages to one address bounced with 'mailbox full' errors.

I would appreciate any assistance in determining the real origin of
these messages and the method used to generate so many in such a short
time frame.

pdr

--------------------------> Original Message <--------------------------
>Return-Path: <[log in to unmask]>
>Received: from IRISHVMA (NJE origin SMTP@IRISHVMA) by VMA.CC.ND.EDU (LMail
>          V1.2a/1.8a) with BSMTP id 0412; Thu, 20 Feb 1997 22:32:04 -0500
>Received: from krunk2.xmission.com by VMA.CC.ND.EDU (IBM VM SMTP V2R2) with
>   TCP; Thu, 20 Feb 97 22:32:00 EST
>Received: (from nobody@localhost) by krunk2.xmission.com (8.8.4/8.7.5) id
>          UAA11648; Thu, 20 Feb 1997 20:19:00 -0700 (MST)
>Date: Thu, 20 Feb 1997 20:19:00 -0700 (MST)
>Message-Id: <[log in to unmask]>
>Received: from darkmatter.infonex.com by www.xmission.com with HTTP;
>        Thu, 20 Feb 1997 20:19:00 MST
>To: [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask], [log in to unmask],
>        [log in to unmask]
>From: <[log in to unmask]>
>
>info REFcard
>info FAQ
>info PResent
>info GENintro
>info KEYwords
>info AFD
>info FILEs
>info LPunch
>info JOB
>info DISTribute
>info FILEOwner
>info DATABASE
>info OWNers
>info PUT
>
----------------------> End of Original Message <-----------------------

* -------------------------------------------------------------------- *
* Paul Russell * Senior Systems Programmer * University of Notre Dame  *
* Email: [log in to unmask] * Web: http://vma.cc.nd.edu/~prussell  *
* -------------------------------------------------------------------- *