# list abuse - Thread: https://externals.io/message/11803 - Original archive: https://news-web.php.net/php.internals/11803 - Started by Paul G on 2004-08-02T03:10:56+00:00 - Messages: 6 - Reply by email to internals@lists.php.net - More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt --- ## #11803 — Paul G — 2004-08-02T03:10:56+00:00 URL: https://externals.io/message/11803#11803 folks, would someone with ml admin privs take a look and, if present, remove an @tgpwizards.com e-mail address subscription? the user has apparently put a sender confirmation script in place that bombards me (and i'm sure others as well) with confirmation requests. needless to say, it gets very old very fast. paul --- ## #11805 — Paul G — 2004-08-02T06:28:16+00:00 URL: https://externals.io/message/11803#11805 · In reply to: #11804 ----- Original Message ----- From: "Andrey Hristov" To: "Paul G" Cc: Sent: Monday, August 02, 2004 4:18 AM Subject: Re: [PHP-DEV] list abuse > Paul G wrote: > > […] @tgpwizards.com e-mail address subscription? the user has apparently put a sender confirmation script in place that bombards me (and i'm sure others as well) with confirmation requests. needless to say, it gets very old very fast. > > […] > > Last time I looked at the message it does spoof the original address and is being > sent from an unknown server. it is unlikely it does so intentionally. mail coming from the list has internals@ listed as the to: address, which the script obviously doesn't sanity check. regardless of whether this is malicious, the dude needs to go. paul --- ## #11804 — Andrey Hristov — 2004-08-02T08:18:48+00:00 URL: https://externals.io/message/11803#11804 · In reply to: #11803 Paul G wrote: > folks, > > would someone with ml admin privs take a look and, if present, remove an @tgpwizards.com e-mail address subscription? the user has apparently put a sender confirmation script in place that bombards me (and i'm sure others as well) with confirmation requests. needless to say, it gets very old very fast. > > paul Last time I looked at the message it does spoof the original address and is being sent from an unknown server. Andrey --- ## #11811 — Wez Furlong — 2004-08-02T08:35:57+00:00 URL: https://externals.io/message/11803#11811 · In reply to: #11803 I checked this last week; there are no people subscribed using that domain. > folks, > > would someone with ml admin privs take a look and, if present, remove an @tgpwizards.com e-mail address subscription? the user has apparently put a sender confirmation script in place that bombards me (and i'm sure others as well) with confirmation requests. needless to say, it gets very old very fast. > > paul --- ## #11820 — Andrey Hristov — 2004-08-02T13:53:02+00:00 URL: https://externals.io/message/11803#11820 · In reply to: #11805 Quoting Paul G : > > ----- Original Message ----- > From: "Andrey Hristov" > To: "Paul G" > Cc: > Sent: Monday, August 02, 2004 4:18 AM > Subject: Re: [PHP-DEV] list abuse > > > > […] > is being > > […] > > > it is unlikely it does so intentionally. mail coming from the list has > internals@ listed as the to: address, which the script obviously doesn't > sanity check. regardless of whether this is malicious, the dude needs to go. Sure it does it intentionally. I have used to check the site without the provided link and it looked like some pr0n site. Here is the source of the last message. Usually they "come" from addresses like andi@zend.com, zeev@zend.com even paul@rusko.us :) [snip] Received: from hristov by iko.gotobg.net with local-bsmtp (Exim 4.34) id 1BrTFY-0005fA-ON for php@hristov.com; Mon, 02 Aug 2004 06:12:42 +0300 Received: from [66.17.150.83] (helo=tgpnexus.com) by iko.gotobg.net with esmtp (Exim 4.34) id 1BrTFY-0007Sp-BJ for php_at_hristov_punkt_com; Mon, 02 Aug 2004 06:12:32 +0300 Received: (from root@localhost) by tgpnexus.com (8.11.6/8.11.6) id i722svi20745; Sun, 1 Aug 2004 22:54:57 -0400 Date: Sun, 1 Aug 2004 22:54:57 -0400 Message-Id: <200408020254.i722svi20745@tgpnexus.com> To: php_at_hristov_punkt_com Subject: IMPORTANT: Please Verify Your Message From: Reply-To: internals@lists.php.net [/snip] As far as I see this email has nothing to do with internals and php.net services except it spoofs that it comes from internal@lists.php.net .So the mail comes from tgpnexus.com (looks like). andrey --- ## #11826 — Paul G — 2004-08-02T14:15:59+00:00 URL: https://externals.io/message/11803#11826 · In reply to: #11820 ----- Original Message ----- From: "Andrey Hristov" To: "Paul G" Cc: Sent: Monday, August 02, 2004 9:53 AM Subject: Re: [PHP-DEV] list abuse --- snip --- > Sure it does it intentionally. I have used to check the site without the > provided link and it looked > like some pr0n site. > > Here is the source of the last message. Usually they "come" from addresses like > andi@zend.com, > zeev@zend.com even paul@rusko.us :) this is really simple, as i've stated in a previous mail. script parses message, takes the address listed first in the 'to' and uses it as 'from' for the confirmation mail. this works perfectly fine when it's a mail from person A to cluetard B, but delivers funky results (which we are seeing) when used on an account that receives mailing list traffic. this is understandable, since the author obviously never intended for it to be used that way. nekkidness or no nekkidness doesn't make a difference in this case (the website seems to be a service for adult gallery webmasters) - if they wanted to harvest e-mail addresses, they could just harvest from the archives. this is clearly a case of misconfiguration (ie confirmation script enabled on an account receiving maillist traffic). regardless, it would be nice to get rid of it. can someone on the admin side send an ID'ed test to subscribers to see where this is coming from (or is this considered a minor nuisance not worth bothering with)? paul