In a one-hour period overnight, our Listserv server received nearly 400 suspicious INFO requests like the one below. I may be mistaken, but it appears to me that the 'from' line in this message was forged, and I suspect that is true for all of the others, as well. Listserv processed most of the requests, thus making this site - and about 50 others - an unwitting accomplice in this net.vandalism incident. Listserv messages to a few of the addresses bounced with 'unknown user' errors, while messages to one address bounced with 'mailbox full' errors. I would appreciate any assistance in determining the real origin of these messages and the method used to generate so many in such a short time frame. pdr --------------------------> Original Message <-------------------------- >Return-Path: <[log in to unmask]> >Received: from IRISHVMA (NJE origin SMTP@IRISHVMA) by VMA.CC.ND.EDU (LMail > V1.2a/1.8a) with BSMTP id 0412; Thu, 20 Feb 1997 22:32:04 -0500 >Received: from krunk2.xmission.com by VMA.CC.ND.EDU (IBM VM SMTP V2R2) with > TCP; Thu, 20 Feb 97 22:32:00 EST >Received: (from nobody@localhost) by krunk2.xmission.com (8.8.4/8.7.5) id > UAA11648; Thu, 20 Feb 1997 20:19:00 -0700 (MST) >Date: Thu, 20 Feb 1997 20:19:00 -0700 (MST) >Message-Id: <[log in to unmask]> >Received: from darkmatter.infonex.com by www.xmission.com with HTTP; > Thu, 20 Feb 1997 20:19:00 MST >To: [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask], [log in to unmask], > [log in to unmask] >From: <[log in to unmask]> > >info REFcard >info FAQ >info PResent >info GENintro >info KEYwords >info AFD >info FILEs >info LPunch >info JOB >info DISTribute >info FILEOwner >info DATABASE >info OWNers >info PUT > ----------------------> End of Original Message <----------------------- * -------------------------------------------------------------------- * * Paul Russell * Senior Systems Programmer * University of Notre Dame * * Email: [log in to unmask] * Web: http://vma.cc.nd.edu/~prussell * * -------------------------------------------------------------------- *