Everything

php

list abuse

php.internals

Paul G

22 years ago

folks,

would someone with ml admin privs take a look and, if present, remove an @tgpwizards.com e-mail address subscription? the user has apparently put a sender confirmation script in place that bombards me (and i'm sure others as well) with confirmation requests. needless to say, it gets very old very fast.

paul

Andrey Hristov

22 years ago

Paul G wrote:

> folks,
>
> would someone with ml admin privs take a look and, if present, remove an @tgpwizards.com e-mail address subscription? the user has apparently put a sender confirmation script in place that bombards me (and i'm sure others as well) with confirmation requests. needless to say, it gets very old very fast.
>
> paul

Last time I looked at the message it does spoof the original address and is being
sent from an unknown server.

Andrey

Paul G

22 years ago

----- Original Message -----
From: "Andrey Hristov" <php@hristov.com>
To: "Paul G" <paul@rusko.us>
Cc: <internals@lists.php.net>
Sent: Monday, August 02, 2004 4:18 AM
Subject: Re: [PHP-DEV] list abuse

> Paul G wrote:
> > folks,
> >
> > would someone with ml admin privs take a look and, if present, remove an

@tgpwizards.com e-mail address subscription? the user has apparently put a
sender confirmation script in place that bombards me (and i'm sure others as
well) with confirmation requests. needless to say, it gets very old very
fast.

> >
> > paul
>
> Last time I looked at the message it does spoof the original address and

is being

> sent from an unknown server.

it is unlikely it does so intentionally. mail coming from the list has
internals@ listed as the to: address, which the script obviously doesn't
sanity check. regardless of whether this is malicious, the dude needs to go.

paul

Andrey Hristov

22 years ago

Quoting Paul G <paul@rusko.us>:

>
> ----- Original Message -----
> From: "Andrey Hristov" <php@hristov.com>
> To: "Paul G" <paul@rusko.us>
> Cc: <internals@lists.php.net>
> Sent: Monday, August 02, 2004 4:18 AM
> Subject: Re: [PHP-DEV] list abuse
>
>
> > Paul G wrote:
> > > folks,
> > >
> > Last time I looked at the message it does spoof the original address and
> is being
> > sent from an unknown server.
>
>
> it is unlikely it does so intentionally. mail coming from the list has
> internals@ listed as the to: address, which the script obviously doesn't
> sanity check. regardless of whether this is malicious, the dude needs to go.

Sure it does it intentionally. I have used to check the site without the
provided link and it looked
like some pr0n site.

Here is the source of the last message. Usually they "come" from addresses like
andi@zend.com,
zeev@zend.com even  paul@rusko.us :)

[snip]
Received: from hristov by iko.gotobg.net with local-bsmtp (Exim 4.34)
id 1BrTFY-0005fA-ON
for php@hristov.com; Mon, 02 Aug 2004 06:12:42 +0300
Received: from [66.17.150.83] (helo=tgpnexus.com)
by iko.gotobg.net with esmtp (Exim 4.34)
id 1BrTFY-0007Sp-BJ
for php_at_hristov_punkt_com; Mon, 02 Aug 2004 06:12:32 +0300
Received: (from root@localhost)
by tgpnexus.com (8.11.6/8.11.6) id i722svi20745;
Sun, 1 Aug 2004 22:54:57 -0400
Date: Sun, 1 Aug 2004 22:54:57 -0400
Message-Id: <200408020254.i722svi20745@tgpnexus.com>
To: php_at_hristov_punkt_com
Subject: IMPORTANT: Please Verify Your Message
From: <internals@lists.php.net>
Reply-To: internals@lists.php.net
[/snip]
As far as I see this email has nothing to do with internals and php.net services
except it spoofs
that it comes from internal@lists.php.net  .So the mail comes from tgpnexus.com
(looks like).


andrey

Paul G

22 years ago

----- Original Message -----
From: "Andrey Hristov" <php@hristov.com>
To: "Paul G" <paul@rusko.us>
Cc: <internals@lists.php.net>
Sent: Monday, August 02, 2004 9:53 AM
Subject: Re: [PHP-DEV] list abuse


--- snip ---

> Sure it does it intentionally. I have used to check the site without the
> provided link and it looked
> like some pr0n site.
>
> Here is the source of the last message. Usually they "come" from addresses

like

> andi@zend.com,
> zeev@zend.com even  paul@rusko.us :)

this is really simple, as i've stated in a previous mail. script parses
message, takes the address listed first in the 'to' and uses it as 'from'
for the confirmation mail. this works perfectly fine when it's a mail from
person A to cluetard B, but delivers funky results (which we are seeing)
when used on an account that receives mailing list traffic. this is
understandable, since the author obviously never intended for it to be used
that way.

nekkidness or no nekkidness doesn't make a difference in this case (the
website seems to be a service for adult gallery webmasters) - if they wanted
to harvest e-mail addresses, they could just harvest from the archives. this
is clearly a case of misconfiguration (ie confirmation script enabled on an
account receiving maillist traffic).

regardless, it would be nice to get rid of it. can someone on the admin side
send an ID'ed test to subscribers to see where this is coming from (or is
this considered a minor nuisance not worth bothering with)?

paul

Andi Gutmans

22 years ago

I get lots of "spam" from people on this list. It's just that spamers are
getting smarter and smarter and fake their emails well. Zeev sends lots of
Viagra to me :)

Andi

At 04:53 PM 8/2/2004 +0300, Andrey Hristov wrote:

George Schlossnagle

22 years ago

On Aug 2, 2004, at 2:25 PM, Andi Gutmans wrote:

> I get lots of "spam" from people on this list. It's just that spamers
> are getting smarter and smarter and fake their emails well. Zeev sends
> lots of Viagra to me :)

You too?  I thought he was trying to tell me something....

George

Paul G

22 years ago

----- Original Message -----
From: "Andi Gutmans" <andi@zend.com>
To: "Andrey Hristov" <php@hristov.com>; "Paul G" <paul@rusko.us>
Cc: <internals@lists.php.net>
Sent: Monday, August 02, 2004 2:25 PM
Subject: Re: [PHP-DEV] list abuse

> Zeev sends lots of
> Viagra to me :)

too.. much... information..

paul

Wez Furlong

22 years ago

I checked this last week; there are no people subscribed using that domain.

On Sun, 1 Aug 2004 23:10:56 -0400, Paul G <paul@rusko.us> wrote: