[Mailman-Users] Weird subscriptions

[Mark Sapiro]

Richard Hill wrote:

>Lately I've received a number of subscriptions with something such as:
>
>Plausiblename at logicaladdress.net  to: wava at cleartalk.com From:
>wava at cleartalk.com BCC: mfweiss at aol.com X-GUID:
>24115997-bb5e-4683-aac1-2b1d8a6dc876 Content-Type: multipart/mixed;
>boundary=abbbbmh --abbbbmh --abbbbmh-- .
>
>All the copy above was in the simple "address" box.
>
>I approved one and it screwed up looking at the list of subscribers.  I've
>pinged the apparent subscribers, in this case
>Plausiblename at logicaladdress.net and all are bounces.
>
>Any experience in what causes this?  Or how to stop it if these are spoof
>messages?

This is only a wild guess, but possibly there is a "broken" e-mail worm
that is trying to send itself out to a group of harvested addresses
that includes your list's -join or -subscribe address and the headers
in the message it sends are run together without CRLF line breaks or
with leading white space that makes them look like one long header.

It seems that your list already requires approval for new subs, and
probably the best you can do is discard these and not worry about it.

--
Mark Sapiro <msapiro at value.net>       The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan