Dennis Carr wrote: >OK, so today, I get a spam on the FFML, of which I have included the >headers below. > >My question is simple: how did this happen? > >-Dennis Carr > > >Return-Path: <ffml-bounces >[EMAIL PROTECTED]> X-Original-To: >[EMAIL PROTECTED] Delivered-To: >[EMAIL PROTECTED] Received: from kimba.chez-vrolet.net >(localhost.localdomain [127.0.0.1]) by kimba.chez-vrolet.net (Postfix) >with ESMTP id EF66234255 for <[EMAIL PROTECTED]>; Thu, 31 >Jan 2008 13:55:41 -0800 (PST) X-Original-To: [EMAIL PROTECTED] >Delivered-To: [EMAIL PROTECTED] >Received: from host86-128-140-151.range86-128.btcentralplus.com > (host86-128-140-151.range86-128.btcentralplus.com >[86.128.140.151]) by kimba.chez-vrolet.net (Postfix) with SMTP id >CA2C3340E4 for <[EMAIL PROTECTED]>; Thu, 31 Jan 2008 13:55:32 -0800 >(PST) Content-Return: allowed >X-Mailer: CME-V6.5.4.3; MSN >Received: (qmail 3804 by uid 548); Thu, 31 Jan 2008 09:55:39 GMT >Message-Id: ><[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]> From: <[EMAIL PROTECTED]> >MIME-Version: 1.0 >Date: Thu, 31 Jan 2008 13:55:32 -0800 (PST) >Subject: [FFML] January 77% OFF >X-BeenThere: [EMAIL PROTECTED] >X-Mailman-Version: 2.1.9 >Precedence: list >Reply-To: The Fanfiction Mailing List <[EMAIL PROTECTED]> >List-Id: The Fanfiction Mailing List <ffml.chez-vrolet.net> >List-Unsubscribe: ><http://www.chez-vrolet.net/cgi-bin/mailman/listinfo/ffml>, ><mailto:[EMAIL PROTECTED]> List-Archive: ><http://www.chez-vrolet.net/pipermail/ffml> List-Post: ><mailto:[EMAIL PROTECTED]> List-Help: ><mailto:[EMAIL PROTECTED]> List-Subscribe: ><http://www.chez-vrolet.net/cgi-bin/mailman/listinfo/ffml>, ><mailto:[EMAIL PROTECTED]> Content-Type: >text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit >Sender: [EMAIL PROTECTED] >Errors-To: [EMAIL PROTECTED] >X-UIDL: WNh"!l8@"!3Z5!!eGm!! >Status: RO
Your MUA has wrapped these headers almost beyond recognition, but I think the important one is From: <[EMAIL PROTECTED]> The sender of the spam has spoofed the list address that it sent the mail to in the From: header. Does the list accept mail from the list address. I.e. is [EMAIL PROTECTED] or a pattern matching [EMAIL PROTECTED] in accept_these_nonmembers? Or is [EMAIL PROTECTED] a list member (hopefully with delivery disabled)? If not, it is possible, that the address of a list member was the envelope sender or in a Sender: header in the original message. You can find the message in the archives/private/ffml.mbox/ffml.mbox file and look at the From_ line and Sender: header if any to see these. You can also find the envelope sender in the Postfix log entry for the original delivery to Mailman (probably /var/log/maillog). -- Mark Sapiro <[EMAIL PROTECTED]> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan ------------------------------------------------------ Mailman-Users mailing list [email protected] http://mail.python.org/mailman/listinfo/mailman-users Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ Unsubscribe: http://mail.python.org/mailman/options/mailman-users/archive%40jab.org Security Policy: http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq01.027.htp
