Mailing List SIMS@mail.stalker.com Message #8962
From: Stefan Jeglinski <jeglin@4pi.com>
Subject: anybody getting this cron job?
Date: Fri, 21 Sep 2001 17:40:19 -0400
To: SIMS Discussions <SIMS@mail.stalker.com>
Return-Path: root@mail.advancelink.com
Received: from mail.advancelink.com ([207.214.173.11] verified)
  by mx.4pi.com (Stalker SMTP Server 1.8b9d10)
  with ESMTP id S.0000243257 for <sales@4pi.com>; Fri, 21 Sep 2001
17:02:27 -0400
Received: (from root@localhost)
by mail.advancelink.com (8.8.5/8.8.5) id MAA29885;
Fri, 21 Sep 2001 12:05:00 -0700 (PDT)
Date: Fri, 21 Sep 2001 12:05:00 -0700 (PDT)
Message-Id: <200109211905.MAA29885@mail.advancelink.com>
From: root@mail.advancelink.com (Cron Daemon)
To: coccust@mail.advancelink.com
Subject: Cron <coccust@mail> csh -x ~/bin/get-dist > get-dist.log
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/usr/home/coc/coccust>
X-Cron-Env: <LOGNAME=coccust>
X-Cron-Env: <USER=coccust>

cd /usr/home/coc/coccust
grep [a-z] /usr/home/coc/cocinfo/MAILING-LISTS/CURRENT-LIST.txt
chown coccust .forward
chown: Command not found.
chown coc .forward
chown: Command not found.
chmod 664 .forward
exit

We've been hit by it 12 times in the last hour. Normally I would stop it in the obvious way, but we've *also* gotten responses from *other people* saying 'stop sending this'. It appears that they respond to advancelink.com and their responses also get sent out to us (everyone?) again.

I'm ready to blacklist it but I was curious if anyone had ever seen something like this. It hardly looks like spam as much as someone has a misconfigured mailing list or something on their *nix box...

I don't want anyone looking slightly down further in the headers and deciding we (4pi.com) is the source of the spam.


Stefan Jeglinski
Subscribe (FEED) Subscribe (DIGEST) Subscribe (INDEX) Unsubscribe Mail to Listmaster