Date   : Sun, 25 Oct 2015 08:53:27 -0700
From   : fozztexx@... (Chris Osborn)
Subject: new message

On Oct 25, 2015,@8:38 AM, Peter Coghlan <bbcmicro@...> wrote:

> I don't think this is a case of people subscribing to the list to send spams.
> 
> It appears to me the spams are resulting from one or more real list members
> machines getting compromised and being used by the malware to send out spams
> and/or having email addresses lifted from them which are then passed on to
> other spamming zombie machines.
> 
> Unfortunately, the mailing list does not seem to have any protection against
> this.

I don?t think it?s people subscribing to the list to send spam either. It 
looks more to me like the list is happily accepting messages from non-subscribers 
and forwarding them on. Even if actual subscribers were sending the messages 
to the list, they are all using the same From: address and if the list was
filtering out non-subscribers then it would be easy enough to block it by
removing the kate spam address that somehow got itself onto the list.

Going back through today?s deluge of spams, they are all coming from the
same IP stream.trouts.org ([87.117.200.61]), so it isn?t different subscribers
that are sending them, it?s all coming from a single source.

This isn?t the first time this list has been bombarded by this ?Fw: new message?
spam, it?s been happening for a couple of weeks now, and from different email
addresses.

--
Follow me on twitter: @FozzTexx
Check out my blog: http://insentricity.com