[Dragaera] spam

[A. Craig West]

2009/8/12 David Dyer-Bennet <dd-b at dd-b.net>:
>> On Tue, August 11, 2009 19:53, Philip Hart wrote:
>>> Dear PTB, on occasion I get spam just after writing to the list from
>> [addresses removed]
>>> The subject line is "vacation reply" and the url being advertised is the
>>> amusingly-named happyhome666.com.  Maybe you could quash this?
> I found a copy of that spam in my trash (SpamAssassin had done it in).  So
> I was able to look at the headers.  It did not come through the list;
> there's no List-ID: header, or any of a bunch of List-*: headers that
> Mailman adds to messages it distributes.  Also there isn't the [Dragaera]
> tag on the subject line or the signature at the bottom.  All that is added
> by mailman when it redistributes a message.  Mailman handles it AFTER the
> subscriber does, so there's no chance to strip it off before it's
> distributed.

I suspect that what is (or was) happening is that somebody subscribed
to the list has their an autoresponder set up, so it is replying to
posters to the list directly. I haven't seen the spam myself (but soon
will, if my theory is correct) but it is quite possible that some of
the new spammer malware can set up this type of thing automatically. I
have seen this on other lists before. In that case, to track down the
spammer I needed to send a message to each subscriber, each with a
different sender address, to find out which one was responsible.
-Craig