The past 24 hours or so I've received two messages with debian-powerpc@lists.debian.org as the forged return address, probably in response to posts I made on the list. Both messages contain suspicious attachments, though I presume gmail did not recognize them as known worms. One originated from 59.93.78.40 and one from 59.93.76.161.
I'm mentioning it so folks can be on the lookout, and I'm copying listmaster because the mail header points out that there's no SPF so gmail can't verify whether the originating IPs are legitimate. > Received: from user1 ([59.93.78.40]) > by mx.gmail.com with SMTP id 15si1349995nzn.2006.03.08.04.41.48; > Wed, 08 Mar 2006 04:42:19 -0800 (PST) > Received-SPF: neutral (gmail.com: 59.93.78.40 is neither permitted nor denied > by manual fallback record for domain of debian-powerpc@lists.debian.org)