[Modus] Spammer or List Message?

[Lapo Nustrini]

* This is the modus mailing list *

What do the headers show?

Lapo

On Feb 4, 2004, at 7:24 AM, Cary Fitch wrote:

* This is the modus mailing list *

But, this message came with a [Modus] etc... subject line...like it 
went
through the list server, which would mean:

1. It did go through the list server, and was sent as "from
[EMAIL PROTECTED]" and "to [EMAIL PROTECTED] ", not very random.
or

2. It was a direct send with a faked "from [EMAIL PROTECTED]" send 
address
and a specifically faked "[Modus] ..." subject line, again not very 
random.

Cary Fitch

Attend Peering Conference for ISP's,
April 23-24, 2004, Dallas Texas
Full info: http://www.peercon.org
----- Original Message -----
From: "Yves" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, February 04, 2004 8:32 AM
Subject: [Modus] Spammer or List Message?

* This is the modus mailing list *

Listadmin is the account I use to manage the list - chances are
[EMAIL PROTECTED] is in everyone's address book.  That means 
anybody
infected with a Mydoom/Mimail/Bugbear/Sobig type of virus could be 
sending
out messages with a random name from their address book in the from/to
field
and hence, [EMAIL PROTECTED] is one of them.

--
Yves Lacombe
Vircom Technical Support
----- Original Message -----
From: "Cary Fitch" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, February 04, 2004 6:31 AM
Subject: [Modus] Spammer or List Message?

* This is the modus mailing list *

Modus trapped an email for having a forbiden attachment. of ".zip".

What is interesing is it came from "[EMAIL PROTECTED]",  with a
subject
line "[Modus] spam/virus?", and the attachment is "myphoto.zip" and
dated
Tue Feb 03, 10:58:53.  The size is only 4Kb.

Now while I have been longing for a photo of the list admin of 
Modus, I
somehow don't think this is one.  However it does seem like it could
well
be
a planned attack against the Modus list, because it purports to be 
from
the
[EMAIL PROTECTED] and has the [Modus] subject header.  Or, is it a
misdirected post by a list memeber?
Any comments?

Cary Fitch

Attend Peering Conference for ISP's,
April 23-24, 2004, Dallas Texas
Full info: http://www.peercon.org
**
To unsubscribe, send an Email to: [EMAIL PROTECTED]
with the word "UNSUBSCRIBE" in the body or subject line.


**
To unsubscribe, send an Email to: [EMAIL PROTECTED]
with the word "UNSUBSCRIBE" in the body or subject line.


**
To unsubscribe, send an Email to: [EMAIL PROTECTED]
with the word "UNSUBSCRIBE" in the body or subject line.


**
To unsubscribe, send an Email to: [EMAIL PROTECTED]
with the word "UNSUBSCRIBE" in the body or subject line.