Re: [Evolution] [OT / Meta] Evolution list as source of spam

[Patrick O'Callaghan <poc usb ve>]

On Mon, 2019-01-14 at 23:25 +0000, Pete Biggs wrote:
> Well, sort of a source of spam.
>
> At times I've mentioned that I seem to see an increase in spam when I
> post to the evo list - mostly it's subjective and others have not seen
> it and I'm certainly willing to accept it is coincidental.
>
> However, recently I've seen lots of failed delivery attempts on my mail
> server. Nothing new about that, it's a regular occurrence. But these
> failed addresses are message IDs that have, obviously, been harvested
> from somewhere. Specifically, I'm getting log messages of the type:
>
> 2019-01-14 20:57:31 H=(mail.rentautos.eu) [85.14.240.55] F=<uslyyyy rentautos eu> rejected RCPT <1421662613 
> 17426 6 camel biggs org uk>: Unknown user
>
> (I don't think there's anything there that needs to be redacted! The
> hosts and From addresses change frequently.)
>
> Every single one of those message-ID type addresses are from mails I
> have sent to the Evolution mailing list. They are from a while ago -
> 2015 to be precise - but still, someone is obviously harvesting
> anything that even vaguely looks like an email address from an evo
> mailing list archive somewhere. 
>
> I know there's absolutely nothing anyone can do about it, and these
> things are just noise in my logs, it's just interesting that it is
> evidence that someone/something has been harvesting the list and no
> doubt our real addresses have got themselves on a list somewhere.

I've seen a few of those, though only very occasionally. Possibly my
spam filter (Gmail) is trapping them, though I'd need to look to be
sure. The archives are of course on-line, and even though they don't
directly the poster's address is (trivially) obscured it would not be
difficult to write a script to harvest this info. And of course anyone
who keeps a private archive could also be a source. Even storing old
list traffic (as I do myself) would be be vulnerable to intrusions.

poc