malware email is so common i normally do not warn of it. but, in this
case, the attacker is extracting quotes from nanog and luring folk into
clicking. e.g.
I get quite a bit of spam that is a "reply" to old NANOG posts (some dating back a year or more). Seems to only happen on some specific threads, dunno why though.
Definitely recommend using a nanog-specific alias and auto-spam-folder'ing anything to that alias that isn't CC nanog@nanog, that seems to get rid of it.
Matt
I started noticing this a few months ago when I began receiving them, and just ignored them and reported them as spam. Didn’t think that anyone else was getting them, but I guess I thought wrong.
Brothers the latest thread is direct reference to ROGERS - CANADA -July 08 2022 outage… and My Ref in General…
NANOG can be considered " Com Pro Mised"… sad… but … True!
I've been getting messages like those described on again and off again for quite a while. -- I've been reporting them like spam.
I've seen similar for other mailing lists. I didn't think that NANOG was special in any way.
P.S.A. Please do cripple URLs in questionable messages. Let's at least make it so that people have to actively stab themselves and can't simply fall on a knife.
Grant. . . .
I’ve been getting them for a while. I just delete them so I have no history.
i did not think i was special, and assumed everybody is getting them.
but i figured that if i kept one or three people from falling for the
trap it was worth the pollution.
randy
Yep, been getting SPAM from the list for quite a while now. 
Rather from someone harvesting from the list.
Dennis Burgess, Mikrotik Certified Trainer
MTCNA, MTCRE, MTCWE, MTCTCE, MTCINE, MTCSE, HE IPv6 Sage, Cambium ePMP Certified
Author of "Learn RouterOS- Second Edition”
Link Technologies, Inc -- Mikrotik & WISP Support Services
Office: 314-735-0270 Website: http://www.linktechs.net
Need to Automate MikroTik Backups: https://cloud.linktechs.net
Create Wireless Coverage’s with www.towercoverage.com
I've also gotten these, ironic that it was in "reply" to my
"Not sure if this is a phishing E-mail or real..." thread.
I initially thought someone was spamming the whole list,
it took a while before I looked close enough to realize it
was directly to the address I use for the mailing list and
not through the mailing list. (Which explained why it
wasn't showing up in the list archive on the web.) Also
continued much after the thread died out in my case too.
I've done quite a bit of looking into this, tying to prevent it. It's not
being pulled from the archives.
The basic premise of it:
1. send email only to direct posters to the list, never through the list.
2. subscribe using a gmail account as a normal member for harvesting
3. scrape the new posts and use email in from: header to send spam to
4. wait some $TIME after the post and send the spam
5. The spam will never be able to be linked to the subscribed account
I've been able to track these "ingestion" accounts and kill them when found,
but it's impossible to do it without false positives. VERP is used for the
list emails, but short of a bounce, that doesn't really help.
About the only supported option that would mitigate this is wrapping all posts
through the list as from the list. This still would expose the email
addresses in the email, and we could rewrite them, but it breaks more than it
fixes.
I've seen proposals where all messages get wrapped and each individual email
address found in the message is re-written to a unique address via a mail
forwarding domain, but i can't see this working with such a diverse list.
This also would break after some time. This is also not something supported
off the shelf in most mailman or other MLMs.
I'd love to kill this spam, but the openness of the email discussion list
format makes it hard to do. If anyone has ideas on how we can kill this I'd
love to shut it down.
Oh, just dont bother. The battle is over and we lost it, because
good people are too soft.
The only interesting action I ever saw was:
"Shutting down email spam factory"; where some network was depeered
from internet completly. Well done.
(Somehow I cannot find post about that anymore).
The only sane action I see is go virtual. I mean, create overlay
virtual network, make VPN PoPs and put services there.
Looks kinda over kill maybe, but at least, we get back the control.
* borg@uu3.net (borg@uu3.net) [Sat 22 Jul 2023, 10:24 CEST]:
The only interesting action I ever saw was:
"Shutting down email spam factory"; where some network was depeered from internet completly. Well done.
(Somehow I cannot find post about that anymore).
AGIS: Apex Global Internet Services - Wikipedia
-- Niels.
Thats not it.. But I finally found it: