Subject: insidious attack on mailing lists?

From: "Randy Presuhn" <[email-masked]>
Date: Thu, 18 Mar 2004 10:30:26 -0800

Hi -

A couple of us are seeing the first signs of what appears to be
a particularly insidious attack on IETF mailing lists.  Clues are
the forged "From:" address and a set of Received: paths that
doesn't quite match up with the "old" address.  Or am I just
overly paranoid after last nights joe-job attacks on the
snmpv3 list?

Randy

> Status:  U
> Return-Path: <>
> Received: from mail9.atl.registeredsite.com ([64.224.219.83])
>  by wanamaker.mail.atl.earthlink.net (EarthLink SMTP Server) with ESMTP id 1b41Gl7qd3Nl3oJ0
>  for <[email-masked]>; Thu, 18 Mar 2004 12:51:49 -0500 (EST)
> Received: from saturn.hosting4u.net (saturn.hosting4u.net [209.35.191.120])
>  by mail9.atl.registeredsite.com (8.12.8/8.12.8) with ESMTP id i2IIpmCE019242
>  for <[email-masked]>; Thu, 18 Mar 2004 13:51:48 -0500
> Date: Thu, 18 Mar 2004 13:51:48 -0500
> Received: from saturn ([209.35.191.120]) by saturn.hosting4u.net ; Thu, 18 Mar 2004 11:51:48 -0600
> Subject: Email address has changed
> From: <[email-masked]>
> X-Rcpt-To: <[email-masked]>
> Message-ID: <[email-masked]>
> To: <[email-masked]>
> X-ELNK-AV: 0
>
> This address has moved - the new address is [email-masked] for the recipient.  This address has been removed due
to
> spam, and those of you who know me will know my firstname.lastname address.
>
> Thank You
> Carmody
>
>
>