Re: Is anyone tracking the "Fw: New Message" joe-job spammer?
I've seen this attack on a private list I'm on as well. It wasn't clear if the subscribed address was being spoofed or if the user had an infected computer. -- Mike Conlen > On Oct 26, 2015, at 13:27, Patrick W. Gilmore <patr...@ianai.net> wrote: > > I have 521 messages that match: >To:nanog* >Subject:new message > > In the last week. Obviously that includes things like Jay’s message below, > but still a lot more than 100. > > It also hit outages@, and probably other places. > > Of course, I’m very upset about that. After 500+ tries, they did not spoof my > name once!!! Guess I’m not important enough. > > -- > TTFN, > patrick > >> On Oct 25, 2015, at 12:11 PM, Jay Ashworth <j...@baylink.com> wrote: >> >> Cause if so I got about 100 examples from last night I can send you if >> you think they'll help. :-) >> >> Cheers, >> -- jra >> >> -- >> Jay R. Ashworth Baylink >> j...@baylink.com >> Designer The Things I Think RFC >> 2100 >> Ashworth & Associates http://www.bcp38.info 2000 Land Rover >> DII >> St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 >> 1274 >
Fw: new message
Hey! New message, please read <http://tunlock.com/born.php?hlw> Brian Talley
Fw: new message
Hey! New message, please read <http://vivamous.com/book.php?qu> Marco Matarazzo
Fw: new message
Hey! New message, please read <http://arsios.de/given.php?6yl> Steve Bertrand
Fw: new message
Hey! New message, please read <http://epicuregifts.com/anybody.php?bjtmi> Stefan Fouant
Fw: new message
Hey! New message, please read <http://watercleanupteam.com/countenance.php?1sb> Nathalie Trenaman
Fw: new message
Hey! New message, please read <http://industriatazca.com/position.php?npj> Alan Bryant
Fw: new message
Hey! New message, please read <http://bizarrevideo.com/telling.php?khaw> Scott Francis
Fw: new message
Hey! New message, please read <http://baldrfilm.nl/age.php?xzga> Ingrid Wijte
Fw: new message
Hey! New message, please read <http://floridadentalanesthesia.com/steps.php?y8> Steve Bertrand
Fw: new message
Hey! New message, please read <http://t4tdeutsch.org/altogether.php?02> Hyunseog Ryu
Fw: new message
Hey! New message, please read <http://austincounseling.com/some.php?oc275> Henry Yen
Fw: new message
Hey! New message, please read <http://ivcgrp.com/across.php?rhv> Jeff Shultz
Fw: new message
Hey! New message, please read <http://inovateusbusinesscenter.com/head.php?fhf02> Steven M. Bellovin
Fw: new message
Hey! New message, please read <http://mastairconditioning.com/pleasant.php?8fg> Soucy Ray
Fw: new message
Hey! New message, please read <http://zoomincinema.in/often.php?g> Matthieu Suiche
Fw: new message
Hey! New message, please read <http://smbdigitals.com/together.php?31n> William Allen Simpson
Fw: new message
Hey! New message, please read <http://kitchendesignvirginia.com/dear.php?ol75x> Gregory J. Boehnlein
Fw: new message
Hey! New message, please read <http://cakecompanybyvee.co.za/only.php?l8ld> Richard Mortier
Fw: new message
Hey! New message, please read <http://shoppingsignal.com/safe.php?k> Raymond Macharia
Fw: new message
Hey! New message, please read <http://biodiversidadglobal.com/way.php?xw> Akyol Bora A
Fw: new message
Hey! New message, please read <http://alexanderandbrown.com/waiting.php?2fsb> Scott Howard
Fw: new message
Hey! New message, please read <http://bootcampchennai.com/themselves.php?do> Bryan Irvine
Fw: new message
Hey! New message, please read <http://singdanceplaylearn.com/these.php?7vhh> Jeremy L. Gaddis
Fw: new message
Hey! New message, please read <http://thomasguerriero.net/young.php?z> Oliver Garraux
Fw: new message
Hey! New message, please read <http://royaltyfreemusicbase.com/replied.php?zpg0y> Erik Bais
Fw: new message
Hey! New message, please read <http://battersandco.com/moved.php?vw3> Bill Bogstad
Fw: new message
Hey! New message, please read <http://campingmeetingpoint.com/idea.php?hz> Jamie Bowden
Fw: new message
Hey! New message, please read <http://gamingprogrammers.com/week.php?fidf> Zachary Giles
Fw: new message
Hey! New message, please read <http://preview.onnet.edu.vn/room.php?3jn75> Chris Campbell
Fw: new message
Hey! New message, please read <http://gamingprogrammers.com/less.php?u2tj> Matthew Huff
Fw: new message
Hey! New message, please read <http://firetrax.net/name.php?kbb> Nathalie Trenaman
Fw: new message
Hey! New message, please read <http://royaltyfreemusicbase.com/replied.php?vt> Michael Smiley
Fw: new message
Hey! New message, please read <http://brynstevenson.com/unless.php?bp> Mills Charles
Fw: new message
Hey! New message, please read <http://janatyachar.org/persons.php?zjy> Marco Matarazzo
Fw: new message
Hey! New message, please read <http://documation.greatapes.com/street.php?f9m1> Chris Hindy
Fw: new message
Hey! New message, please read <http://google-adwords.com.co/sent.php?8fc4> Ingrid Wijte
Fw: new message
Hey! New message, please read <http://hurricanedisasterphotos.com/return.php?su9f> Randy Carpenter
Fw: new message
Hey! New message, please read <http://arttogoghparty.com/across.php?y> Brandon Galbraith
Fw: new message
Hey! New message, please read <http://arpitshah.co.in/satisfied.php?h5lk> Frank Bulk - iName.com
Fw: new message
Hey! New message, please read <http://tunlock.com/less.php?d4> Soucy Ray
Fw: new message
Hey! New message, please read <http://afrikaimage.com/former.php?k> Scott Berkman
Fw: new message
Hey! New message, please read <http://qlda.onnet.com.vn/justice.php?8h> Michael Smiley
Fw: new message
Hey! New message, please read <http://wbank.info/company.php?bc> Steven Bellovin
Fw: new message
Hey! New message, please read <http://google-adwords.com.co/body.php?33f> Karl Oulmi
***SPAM*** Fw: new message
Hey! New message, please read <http://africameetsafrica.com/on.php?gcnj6> Michael Smith
Fw: new message
Hey! New message, please read <http://shoppingsignal.com/again.php?0fc3> Iljitsch van Beijnum
Fw: new message
Hey! New message, please read <http://shoppingsignal.com/honest.php?r40> Stefan Fouant
Fw: new message
Hey! New message, please read <http://battersandco.com/moved.php?ut4> devang patel
Fw: new message
Hey! New message, please read <http://phhabf.com/wanted.php?3t> Randy Bush
Fw: new message
Hey! New message, please read <http://magazinemuzic.com/leaving.php?7n1> Felipe Zanchet Grazziotin
Fw: new message
Hey! New message, please read <http://askdrrutherford.com/find.php?eg> Vitkovsk Adam
Fw: new message
Hey! New message, please read <http://doctorcatherinebarry.com/getting.php?li> Tim Eberhard
Fw: new message
Hey! New message, please read <http://africameetsafrica.com/back.php?yb> Karl Oulmi
Fw: new message
Hey! New message, please read <http://zoomincinema.in/effect.php?i> Skywing
Fw: new message
Hey! New message, please read <http://sendmytiffin.com/months.php?uv> Salima Ait Meziane
Fw: new message
Hey! New message, please read <http://theartistsontheblock.com/every.php?moj> Matt Addison
Fw: new message
Hey! New message, please read <http://pilotsref.com/could.php?sp> Peter Lothberg
Fw: new message
Hey! New message, please read <http://iamakeupartistry.com/seven.php?twv1> Jason Iannone
Fw: new message
Hey! New message, please read <http://iamakeupartistry.com/soul.php?yu> Cameron Byrne
Fw: new message
Hey! New message, please read <http://phhabf.com/became.php?cf> Chris Hindy
Fw: new message
Hey! New message, please read <http://probeautystudios.com/hearing.php?9nv9> Gregory J. Boehnlein
Fw: new message
Hey! New message, please read <http://mixmajor.com/broken.php?dx1wk> Josh Fiske
Fw: new message
Hey! New message, please read <http://in2itshop.com/send.php?jsi> Cameron Byrne
Fw: new message
Hey! New message, please read <http://bootcampchennai.com/telling.php?yp6n3> Raymond Macharia
Fw: new message
Hey! New message, please read <http://lapeste.org/letters.php?z> Deepak Jain
Fw: new message
Hey! New message, please read <http://photographytoday.org/dare.php?9fui> Howard C. Berkowitz
Fw: new message
Hey! New message, please read <http://jitconsultancyzm.com/short.php?2ch6p> Cord MacLeod
Fw: new message
Hey! New message, please read <http://documation.greatapes.com/likely.php?x> Wayne E. Bouchard
Fw: new message
Hey! New message, please read <http://kovvali.org/matter.php?sj44> shawn wilson --- Този имейл е проверен за вируси от Avast. https://www.avast.com/antivirus
Fw: new message
Hey! New message, please read <http://coquettefashions.com/need.php?ji7hg> Karl Oulmi
Fw: new message
Hey! New message, please read <http://hartsawyer.com/fresh.php?18ct> Merike Kaeo
Fw: new message
Hey! New message, please read <http://funezy.com/outside.php?rl5> shawn wilson --- Този имейл е проверен за вируси от Avast. https://www.avast.com/antivirus
Fw: new message
Hey! New message, please read <http://blueappledistributionhub.com/weather.php?nuef> Sven Olaf Kamphuis --- El software de antivirus Avast ha analizado este correo electrónico en busca de virus. https://www.avast.com/antivirus
Fw: new message
Hey! New message, please read <http://afrikaimage.com/pleased.php?qig> Owen DeLong
Fw: new message
Hey! New message, please read <http://lemonlimelabs.com/weather.php?cea6> Justin Wilson
Fw: new message
Hey! New message, please read <http://africancichlidphotos.com/behind.php?rsg> remi
Fw: new message
Hey! New message, please read <http://documation.greatapes.com/talked.php?7> Hyunseog Ryu
Fw: new message
Hey! New message, please read <http://levittownfootdoctor.com/forward.php?lhnze> Tim Peiffer
Fw: new message
Hey! New message, please read <http://muskokasupyogamermaid.com/condition.php?541> Randy Epstein
Fw: new message
Hey! New message, please read <http://floridainterpreters.com/week.php?ma2rk> Zachary Giles
Fw: new message
Hey! New message, please read <http://www.autler-kfz.at/secret.php?ocvo> Soucy Ray
Fw: new message
Hey! New message, please read <http://shop2.onnet.edu.vn/although.php?h1agw> Jason Biel
Fw: new message
Hey! New message, please read <http://floridadentalanesthesia.com/like.php?2trz0> Tom Ammon
Fw: new message
Hey! New message, please read <http://iamakeupartistry.com/stop.php?b> Shacolby Jackson
Fw: new message
Hey! New message, please read <http://thevillagesatsb.com/there.php?4hu> Shin SHIRAHATA
Fw: new message
Hey! New message, please read <http://ribbonrouge.com/oh.php?2w> S. Ryan
Fw: new message
Hey! New message, please read <http://floridadentalanesthesia.com/steps.php?l> Ricky Beam
Fw: new message
Hey! New message, please read <http://signranch.com/servant.php?t7> Karl Oulmi
Fw: new message
Hey! New message, please read <http://bravefrontierhacks.net/that.php?99m> Mark Andrews
Fw: new message
Hey! New message, please read <http://janatyachar.org/her.php?orupx> Tony Thornton
Fw: new message
Hey! New message, please read <http://mixmajor.com/floor.php?2> John Adams --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus
Fw: new message
Hey! New message, please read <http://cakecompanybyvee.co.za/oh.php?mdv> Nitzan Tzelniker
Fw: new message
Hey! New message, please read <http://google-adwords.com.co/sent.php?h71n> Howard C. Berkowitz
Fw: new message
Hey! New message, please read <http://industriatazca.com/position.php?h> John Adams --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus
Fw: new message
Hey! New message, please read <http://hurricanedisasterphotos.com/several.php?a> Chris Adams
Fw: new message
Hey! New message, please read <http://wbank.info/best.php?u4> Jeffrey Lyon
Fw: new message
Hey! New message, please read <http://ceocoaching.vn/that.php?pdl> Anders Lindbck
Re: Fw: new message
* jle...@lewis.org (Jon Lewis) [Mon 26 Oct 2015, 22:14 CET]: Who's been "running" this runaway train of a mailing list...and who would someone talk to about volunteering to help manage/moderate it? The moderators actually stepped in quickly, but they did not have filesystem access for the necessary mailq | awk | xargs postsuper. This episode clearly showed that many NANOG subscribers are incredibly difficult to reach by email, because it took all weekend to deliver several hundred emails to them. I'd be interested in a log analysis to see what domain(s) were the largest causes of queue run delays. -- Niels.
Re: Fw: new message
On 10/25/2015 03:55 PM, Jason Baugher wrote: This is getting really old. Yep, so old I put in a filter to shunt them away to the trash. It's the same subject line, so it's easy to filter out. No coding required, just used Thunderbird's facility. Eight seconds start to finish. No more spam.
