Subject: Bot collector??

From: "Tom-PT Taylor" <[email-masked]>
Date: Thu, 01 Sep 2005 09:24:17 -0400

This talk about address collection by spammers has roused me to ask 
general opinion about a continuing mystery on the Megaco list.  I have a 
subscriber, address:

    [email-masked]

Every single message to the Megaco list prompts an auto-reply from 
superbig to megaco-bounces.  This has been going on for years.  I have 
sent messages to this address, pointing out their behaviour and asking 
what's going on.  No response.

Would I be doing the right thing as list administrator to delete the 
subscriber or disable the address for a while to see what happened?

Tom Taylor

---

From: James Carlson <[email-masked]>
Date: Thu, 1 Sep 2005 10:14:31 -0400

> what's going on.  No response.

I'd say that after a single ignored "are you a real subscriber?"
message, you're well within bounds for removing the subscription.

> subscriber or disable the address for a while to see what happened?

Letting 'bots linger on the lists isn't really doing anyone any
favors.  It's remotely possible that someone has set up a legitimate
archive or reflector here, and there's just nobody who can handle the
messages you're sending.  But I doubt it.

Given an arbitrary sample the available information:

  http://www.newsadmin.com/cgi-bin/top100stat?n+16+050815
  http://www.toastedspam.com/spambots/disptext/211.75.91.19_0001
  http://lists.freebsd.org/pipermail/freebsd-hackers/2004-February/005927.html
  http://www.wpa.net/spamtest.html
  http://www.kloth.net/internet/spam/spambots.php#spam030922

it's a rough neighborhood.

-- 
James Carlson, KISS Network                    <[email-masked]>
Sun Microsystems / 1 Network Drive         71.232W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.496N   Fax +1 781 442 1677

---

From: Dean Willis <[email-masked]>
Date: Fri, 2 Sep 2005 00:47:33 -0500

On Sep 1, 2005, at 8:24 AM, Tom-PT Taylor wrote:

> general opinion about a continuing mystery on the Megaco list.  I have 
> a subscriber, address:
>
I'd have set the address to nomail by about the third time I noticed a 
bounce and never thought about it again.

If the bounce message is correctly formatted, mailman will do this for 
you automatically, so I don't see a problem with doing it 
administratively.

--
Dean