2 ms·
Ask HN: Ongoing attack on Mailman mailing lists?
I have been receiving confirmation messages for subscription requests from Mailman-based mailing lists at a variety of domains, mostly academic. Some of these lists aren't even public, according to the Mailman web interface at the corresponding domains, which makes me wonder how the attacker is finding them. The vast majority of these malicious subscription requests are coming from 91.90.120.173. Is anyone else getting confirmation emails like these? Are any Mailman list administrators here seeing this attack?
- h2odragon 5y agoI've got about 250 of those "confim" emails on the address I use here, in the past couple days. That IP address and a couple others I've noticed, but most from that one. Its an open squid proxy in Greenland from a quick sniff.
- mwcampbell 5y agoThank you! So, not a targeted attack against me. Any suggestions on how to fight back, if that's possible?
- h2odragon 5y agoCrack the relays they're using, hunt for evidence of the previous system they're going through, lather rinse repeat :) I dunno if "fight back" is necessary or desirable here; the places sending the "confirm" messages obviously have a from out somewhere that accepts an address; they'll have seen spurious use of it before and have their own level of concern about that. I dunno who the target would be, if there is one; this could be someone fucking around and thinking they're raining misery or it could be an unconsidered side effect of something so silly we'll never comprehend it. its easy enough to filter and mitigate the impact it has on us.
- mwcampbell 5y agoI decided to try emailing the abuse contact for that IP range, abuse@m247.ro. I realize that the most authentic evidence of the attack would have to come from the Mailman administrators, but I'm doing what I can. I got a prompt response from the abuse team telling me that they forwarded the report to the customer that's using that IP address, and to let them know if it's not resolved within 48 hours. So let's see what happens.
- LinuxBender 5y agoNot to sound negative but they aren't going to do anything. That's a boiler plate response to dismiss complaints. That network has been allowing open proxies, spammers and skiddies since forever.
- LinuxBender 5y agoThat IP is in a subnet with many entries in the firehol [1] ip blocklist. That is a known spammer network. Spammers use data from search engines, chat rooms, irc logs and shodan [2] to find sites. There are many other sources. Has anyone ever mentioned your private mailing list URL's on a chat server? Specifically: grep -c "^91.90.120." * 2>/dev/null|grep -v ":0" firehol_abusers_30d.netset:6 stopforumspam.ipset:6 stopforumspam_180d.ipset:15 stopforumspam_30d.ipset:3 stopforumspam_365d.ipset:26 stopforumspam_7d.ipset:2 stopforumspam_90d.ipset:6 tor_exits_30d.ipset:1 [Revised after a git update] [1] - https://github.com/firehol/blocklist-ipsets.git https://github.com/firehol/blocklist-ipsets.git [2] - https://www.shodan.io/ https://www.shodan.io/