[Mailman-Users] Bouncing admins

[Mark Sapiro]

Jared Rimer wrote:

>Nark and all,
>This is all we have.
>> >From: mailman at wbby.us
>> >To: Woodlake_el_school-owner at wbby.us
>> >Date: Tue, 11 Oct 2005 11:46:54 -0500
>> >X-BeenThere: Woodlake_el_school at wbby.us
>> >X-Mailman-Version: 2.1.6
>> >Sender: mailman-bounces at idea5.anoeticconcepts.com
>> >X-AntiAbuse: This header was added to track abuse, please include it
>> >with any abuse report
>> >X-AntiAbuse: Primary Hostname - idea5.anoeticconcepts.com
>> >X-AntiAbuse: Original Domain - codeamber.org
>> >X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
>> >X-AntiAbuse: Sender Address Domain - idea5.anoeticconcepts.com
>> >X-Source:
>> >X-Source-Args:
>> >X-Source-Dir:
>> >
>> >This is a Mailman mailing list bounce action notice:
>> >
>> >     List:       Woodlake_el_school
>> >     Member:     woodlake_el_school at yahoo.com
>> >     Action:     Subscription disabled.
>> >     Reason:     Excessive or fatal bounces.
>> >
>> >
>> >
>> >The triggering bounce notice is attached below.
>> >
>> >Questions? Contact the Mailman site administrator at mailman at wbby.us.
>> >
>> >MIME-Version: 1.0
>> >Content-Type: text/plain; charset="us-ascii"
>> >Content-Transfer-Encoding: 7bit
>> >Subject: Woodlake_el_school subscription notification
>> >From: mailman-bounces at wbby.us
>> >To: Woodlake_el_school-owner at wbby.us
>> >Message-ID:
>> ><mailman.0.1129049212.10043.woodlake_el_school_wbby.us at wbby.us>
>> >Date: Tue, 11 Oct 2005 11:46:52 -0500
>> >Precedence: bulk
>> >X-BeenThere: Woodlake_el_school at wbby.us
>> >X-Mailman-Version: 2.1.6
>> >Sender: mailman-bounces at wbby.us
>> >Errors-To: mailman-bounces at wbby.us
>> >
>> >bhavsar <ubhavsah71 at yahoo.com> has been successfully subscribed to
>> >Woodlake_el_school.

This message looks very suspicious (i.e.faked). What do you see in
Eudora if you open the message and click 'Blah Blah Blah' to see ALL
the headers.

The alleged triggering bounce is not a bounce at all, but a copy of a
subscribe notification.


>The address isn't even bouncing on the list.


All the more reason to think the message is a fake since the
subscription wasn't disabled.

-- 
Mark Sapiro <msapiro at value.net>       The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan