>Return-Path: [EMAIL PROTECTED]
>Received: from mail.advancelink.com ([207.214.173.11] verified)
>   by mx.4pi.com (Stalker SMTP Server 1.8b9d10)
>   with ESMTP id S.0000243257 for <[EMAIL PROTECTED]>; Fri, 21 Sep 2001
>17:02:27 -0400
>Received: (from root@localhost)
>       by mail.advancelink.com (8.8.5/8.8.5) id MAA29885;
>       Fri, 21 Sep 2001 12:05:00 -0700 (PDT)
>Date: Fri, 21 Sep 2001 12:05:00 -0700 (PDT)
>Message-Id: <[EMAIL PROTECTED]>
>From: [EMAIL PROTECTED] (Cron Daemon)
>To: [EMAIL PROTECTED]
>Subject: Cron <coccust@mail> csh -x ~/bin/get-dist > get-dist.log
>X-Cron-Env: <SHELL=/bin/sh>
>X-Cron-Env: <HOME=/usr/home/coc/coccust>
>X-Cron-Env: <LOGNAME=coccust>
>X-Cron-Env: <USER=coccust>
>
>cd /usr/home/coc/coccust
>grep [a-z] /usr/home/coc/cocinfo/MAILING-LISTS/CURRENT-LIST.txt
>chown coccust .forward
>chown: Command not found.
>chown coc .forward
>chown: Command not found.
>chmod 664 .forward
>exit

We've been hit by it 12 times in the last hour. Normally I would stop 
it in the obvious way, but we've *also* gotten responses from *other 
people* saying 'stop sending this'. It appears that they respond to 
advancelink.com and their responses also get sent out to us 
(everyone?) again.

I'm ready to blacklist it but I was curious if anyone had ever seen 
something like this. It hardly looks like spam as much as someone has 
a misconfigured mailing list or something on their *nix box...

I don't want anyone looking slightly down further in the headers and 
deciding we (4pi.com) is the source of the spam.


Stefan Jeglinski

#############################################################
This message is sent to you because you are subscribed to
  the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to  <[EMAIL PROTECTED]>

Reply via email to