We host over 600 lists and have about 250,000 subscribers. List owners have been asking me about how particular subscribers were able to subscribe to their lists. Well, in some cases, the list had open subscription. However, in almost all cases, the subscribers were from zeusmail.org. I did a scan of the subscribe logs and found over 800 subscribed addresses using zeusmail.org domain. Interestingly, all subscriptions come from the same IP address. Looking at the addresses, it is obvious that they are bogus, though they are interesting and rather humorous names that when all are put together, show a pattern of automated subscriptions. I checked the post logs and found that none from that domain had posted.
So, I have done a couple of things. 1) blocked the ip at the firewall, 2) created a Postfix filter to not allow that domain to be able to send through the mail server, 3) added a robots.txt file to specifically block that domain, and 4) unsubscribed all zeusmail.org subscribers using the script Mark provided. It seems that zeusmail.org is a legitimate and non-blacklisted domain, but it just reeks of spammers. If there is a problem with the few that may be legitimate, they can easily be reinstated. On Mon, Jan 4, 2010 at 4:34 PM, Christopher Adams <adam...@gmail.com> wrote: > A spammer has subscribed completely unique addresses from the same domain > to many of the mailing lists that we host. Is there a way to unsubscribe > everything from this domain without writing a script that will do it? > > -- > Christopher Adams > adam...@gmail.com > -- Christopher Adams adam...@gmail.com ------------------------------------------------------ Mailman-Users mailing list Mailman-Users@python.org http://mail.python.org/mailman/listinfo/mailman-users Mailman FAQ: http://wiki.list.org/x/AgA3 Security Policy: http://wiki.list.org/x/QIA9 Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ Unsubscribe: http://mail.python.org/mailman/options/mailman-users/archive%40jab.org
