[Resolved] Possibly Off-Topic Question

[trifakir]

Hi Guys,

I'm not sure that this is the proper place for the question, I will contact the IEEE administrators as well. It seems that somebody had hacked the mailing lists of IEEE and is sending a lot of unsolicited e-mail messages.

The whole thing doesn't look like spam, it is in German (and I don't understand German), but from first sight it seems to be neo-nazi propaganda (there were links to some NPD websites).

Below is one of the messages (with my e-mail and mail hosts changed):

<<< quoted message begin

Return-Path: <stuart[at]silicondefense.com>

Received: from trinidad ([unix socket])

by trinidad (Cyrus v2.1.18) with LMTP; Sat, 21 May 2005 20:09:10 +0200

X-Sieve: CMU Sieve 2.2

Received: by trinidad.tobago.com (Postfix, from userid 99)

id BB994A2222; Sat, 21 May 2005 20:09:10 +0200 (CEST)

Received: from engine.ieee.org (engine.ieee.org [140.98.193.23])

by trinidad.tobago.com (Postfix) with ESMTP id 5A016A2221

for <joe[at]doe.com>; Sat, 21 May 2005 20:09:10 +0200 (CEST)

Received: from gemini3.ieee.org (gemini3.ieee.org [140.98.193.188])

by engine.ieee.org (Switch-3.1.2/Switch-3.1.2) with ESMTP id j4LI9c5s010554

for <john[at]ieee.org>; Sat, 21 May 2005 14:09:38 -0400 (EDT)

Received: from gemini3.ieee.org (localhost [127.0.0.1])

by localhost.ieee.org (Postfix) with ESMTP id D7F2939C20

for <john[at]ieee.org>; Sat, 21 May 2005 14:09:37 -0400 (EDT)

Received: from hormel4.ieee.org (hormel4.ieee.org [140.98.193.227])

by gemini3.ieee.org (Postfix) with ESMTP id 91EB439C2B

for <john[at]ieee.org>; Sat, 21 May 2005 14:09:37 -0400 (EDT)

Received: from hormel4.ieee.org (localhost.localdomain [127.0.0.1])

by hormel4.ieee.org (8.12.11/8.12.11) with ESMTP id j4LI9abc019173

for <john[at]ieee.org>; Sat, 21 May 2005 14:09:36 -0400

Received: (from defang[at]localhost)

by hormel4.ieee.org (8.12.11/8.12.11/Submit) id j4LI9arg019168

for <john[at]ieee.org>; Sat, 21 May 2005 14:09:36 -0400

X-MIMEDefang-Relay-9fd2428f5e481703021ef1ea05965b7e1a29e393: 200.121.55.89

Received: from ypmnmohk.com (client-200.121.55.89.speedy.net.pe [200.121.55.89])

by hormel4 (envelope-sender <stuart[at]silicondefense.com>) (MIMEDefang) with ESMTP id j4LI9GHA018960; Sat, 21 May 2005 14:09:36 -0400 (EDT)

From: stuart[at]silicondefense.com

To: uzisfnxefv[at]ieee.org

Date: Sat, 21 May 2005 17:56:31 UTC

Subject: Paranoider Deutschenmoerder kommt in Psychiatrie

Importance: Normal

X-Priority: 3 (Normal)

X-MSMail-Priority: Normal

MIME-Version: 1.0

Message-ID: <05ff.d459609dec7926[at]silicondefense.com>

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset="us-ascii"

X-UCE-Filter-Settings: alexander_feldman redirected to 90_OPT_OUT

X-Scanned-By: IEEE UCE Filtering Service (uce . ieee . org) on 140.98.193.227

X-spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on trinidad[at]tobago.com

X-spam-Level: *

X-spam-Status: No, score=1.6 required=5.0 tests=INVALID_DATE,MISSING_MIMEOLE,

NO_REAL_NAME,PRIORITY_NO_NAME autolearn=no version=3.0.3

Lese selbst:

http://brandenburg.rz.fhtw-berlin.de/poetschke.html

>>> quoted message end

My question is - is that spam, if it is, how shall we proceed (e.g. blacklisting IEEE ), etc. Any comment or idea is welcome.

Thanks,

-- Alex

[Wazoo]

Please see http://forum.spamcop.net/forums/index.php?showtopic=4180

[Miss Betsy]

Hi Guys,

I'm not sure that this is the proper place for the question, I will contact the IEEE administrators as well. It seems that somebody had hacked the mailing lists of IEEE and is sending a lot of unsolicited e-mail messages.

The whole thing doesn't look like spam, it is in German (and I don't understand German), but from first sight it seems to be neo-nazi propaganda (there were links to some NPD websites).

28331[/snapback]

IIUC, the German spam is a product of sober.p worm. I didn't look at the source IP, but are you sure that it is from IEEE?

spam is anything that comes that is not solicited by you. Anything that looks like it is bulk email (goes to a lot of other people not just you) can be reported including 'bounces' to your email address. The exception to this rule are confirmation emails from legit mailing lists. If you ignore them, they will not bother you again.

Miss Betsy