Just got this apparently fake NANOG invoice - Looks phishy

Mailman List Mirror (Read Only)
1

Apparent MS-Word doc attached. Be careful out there.

Return-Path: <cb2004097@bristol.lu>
Received: from cross6.lu-visp.net (cross6.lu-visp.net [62.182.179.184])
  by lenny.gizmopartners.com (8.14.7/8.14.7) with ESMTP id 08LJIMld018071
  for <cboyd@gizmopartners.com>; Mon, 21 Sep 2020 19:18:25 GMT
Message-Id: <202009211918.08LJIMld018071@lenny.gizmopartners.com>
Received: from [161.132.101.74] (unknown [161.132.101.74])
  by cross4.lu-visp.net (Postfix) with ESMTPSA id 54FDC8808
  for <cboyd@gizmopartners.com>; Mon, 21 Sep 2020 21:13:53 +0200 (CEST)

2

Can we please send this stuff to the admins and not the whole list?

3

Both the list admin account in the headers and the geeks@nanog.org is
monitored and responded to. If you don't get a reply, you all have my email too.

What's happening here is a subscription comes in from a valid email bot using
gmail or $BIGHOST (google doesn't give af) and that doesn't send email. The
list posters are then spammed from third party address(es).

It's frankly hard to track down as only posters get the spams, not the whole list.

That said, the geeks team knows what to look for to kill this when it happens.
Forward the entire email including _FULL_HEADERS_ to geeks@nanog.org. We
will kill it and ban them from the list.

Thanks,

4

Hi,

What's happening here is a subscription comes in from a valid email bot using
gmail or $BIGHOST (google doesn't give af)

I'm old enough to remember the Usenet Death Penalty. That used to be pretty effective
in dealing with sources of net-abuse.

Thanks,

Sabri