Yes, I agree with Charani's assessment of how it would work. There is no confirmation process if the subscription is manually processed by the admin (approved manually). The bouncing welcome message wouldn't trigger any notice to the admin and it would take at LEAST 5 days of posts coming to the list (from susbcribers) to result in the spammer being bounced from the list and that is the first time the admin would be notified by MailMan of the bounces. This is all assuming that the admin handles new subs manually AND approves the subscription of the spammer...if the subscriptions are automatic and the address is not valid...as Charani noted the spammer wouldn't get subbed in the first place because they would not get or respond to the confirmation notice. Joan In a message dated 4/28/2013 2:08:00 P.M. Eastern Daylight Time, charani.b@gmail.com writes: Deloris Williams wrote: > Joan, > I have a question. > Is there a default setting that once a subscription request is approved, > whether it is automatic, or if the administrator authorizes it, which allows > that new subscriber to then become a member of a List? Is there something in > Mailman that can identify when an address is not legit if a Subscribe > request is sent through them and then authorized? As I understand it, if it's by confirmation and the address is not operational, then the confirmation mail will bounce back. If it's by approval, the spammer would become a member but the welcome mail would bounce back if the address is not genuine. Even if the welcome mail bounces, the spammer would remain on the list. Any list mails would bounce back and the address would be bounced off the list in the same way a legitimate subscriber would be bounced off if their account was closed or the inbox was overfull. The more active the list the quicker it will happen. -- Charani (UK) OPC for Walton, Ashcott, Shapwick, Greinton and Clutton, SOM http://wsom-opc.org.uk ------------------------------- To unsubscribe from the list, please send an email to LISTOWNERS-request@rootsweb.com with the word 'unsubscribe' without the quotes in the subject and the body of the message

Thanks Charani, That's what I wanted to know. Deloris -------------------------------------------------- From: "Charani" <charani.b@gmail.com> Sent: Sunday, April 28, 2013 1:05 PM To: "Deloris Williams" <del_williams@comcast.net>; <listowners@rootsweb.com> Subject: Re: [LO] Handling Subscription Requests > Deloris Williams wrote: >> Joan, >> I have a question. >> Is there a default setting that once a subscription request is approved, >> whether it is automatic, or if the administrator authorizes it, which >> allows >> that new subscriber to then become a member of a List? Is there something >> in >> Mailman that can identify when an address is not legit if a Subscribe >> request is sent through them and then authorized? > > As I understand it, if it's by confirmation and the address is not > operational, then the confirmation mail will bounce back. If it's by > approval, the spammer would become a member but the welcome mail would > bounce back if the address is not genuine. > > Even if the welcome mail bounces, the spammer would remain on the list. > Any list mails would bounce back and the address would be bounced off the > list in the same way a legitimate subscriber would be bounced off if their > account was closed or the inbox was overfull. The more active the list the > quicker it will happen. > > -- > Charani (UK) > OPC for Walton, Ashcott, Shapwick, > Greinton and Clutton, SOM > http://wsom-opc.org.uk >

Joan, I have a question. Is there a default setting that once a subscription request is approved, whether it is automatic, or if the administrator authorizes it, which allows that new subscriber to then become a member of a List? Is there something in Mailman that can identify when an address is not legit if a Subscribe request is sent through them and then authorized? I was trying to recall what the process is, so I sent a Subscribe request to one of my mailing lists through one of my other email addresses, and once I clicked that Approve button, that email address went immediately onto the list as a member. The only thing that came to the address I subscribed, was the "Welcome" after it had been approved. And of course, I received notification that a new address had been subscribed via my regular address. So, what I am wondering is, if this is what happens if a non-legit address, such as the current spammer, sends in a Request? Deloris Williams

Good Lord, I hate spammers and hackers. They need to get a real job and put their skills to better use. :-( David E. Cann decann@infionline.net -----Original Message----- From: listowners-bounces@rootsweb.com [mailto:listowners-bounces@rootsweb.com] On Behalf Of Deloris Williams Sent: Sunday, April 28, 2013 11:41 AM To: Listowners@rootsweb.com Subject: Re: [LO] Spammer subscribing. These are not messages that come through as SPAM, they come through as Subscription Requests, if you have your list set to contact you for authorization for all new Subscription Requests. These kinds of requests aren't SPAM, so you shouldn't be looking for them in as such. What you need to do, is check to see how you have your list set, and then you will know what kinds of messages come to you from Mailman. Deloris <snip>

This current crop of spam with SUBSCRIBE in the subject and maybe the message body also...wasn't around last month...so I suspect you were dealing with a completely issue last month. If I had to guess, I would guess you were dealing with a subscriber whose email account was hijacked and the hijacker sent out the spam as though it was coming from your subscriber...if you didn't FIND the address on your subscriber list it is most likely because staff already unsubbed the address from all lists due to the spam hitting the lists. Non-subscriber mail won't go TO the list and get into the archives unless an admin (and I'm not saying you did this) accidentally clicks to approve the spam message while reviewing their pending requests. It has happened in the past...accidents DO happen. Joan In a message dated 4/28/2013 10:29:16 A.M. Eastern Daylight Time, tobinger@frontiernet.net writes: Thanks Joan, I only had one get through to the list last month. The from wasn't my list of subscribers. I had it removed from the archives before I checking if subscribe was in it. Now I know what to watch for in theses non-subscriber messages. Jerry

These are not messages that come through as SPAM, they come through as Subscription Requests, if you have your list set to contact you for authorization for all new Subscription Requests. These kinds of requests aren't SPAM, so you shouldn't be looking for them in as such. What you need to do, is check to see how you have your list set, and then you will know what kinds of messages come to you from Mailman. Deloris -------------------------------------------------- From: "Gerald Tobin" <tobinger@frontiernet.net> Sent: Sunday, April 28, 2013 9:29 AM To: <JYoung6180@aol.com>; "Listowners@rootsweb.com" <listowners@rootsweb.com> Subject: Re: [LO] Spammer subscribing. > Thanks Joan, > > I only had one get through to the list last month. The from wasn't my list > of subscribers. I had it removed from the archives before I checking if > subscribe was in it. > Now I know what to watch for in theses non-subscriber messages. > > Jerry > > On Apr 28, 2013, at 10:11 AM, JYoung6180@aol.com wrote: > >> Jerry- >> >> It would appear that this type of spam was sent to the LIST address and >> the address isn't subbed to the list and therefore MailMan correctly sent >> it to pending requests because you have your list set to send >> non-subscriber emails there with the setting of HOLD. I don't see these >> at all because I have all my lists set to DISCARD non-subscriber emails. >> >> I think the most troubling of these spam emails with SUBSCRIBE in the >> subject and/or message body would be the ones sent to the list-request >> address which COULD if the spammer followed through on the request get >> them subbed to the list. The question is really about THOSE >> requests...and whether anyone has seen them actually get subbed. I >> haven't. >> >> Joan >> >> In a message dated 4/28/2013 9:56:58 A.M. Eastern Daylight Time, >> tobinger@frontiernet.net writes: >> All of spam to my list come in as >> >> "subject:NYQUEENS post from xxx@xxx requires approval >> Reason: Post sent by a non-member to a members-only list." >> >> and I reply back to rootsweb spam and discard. >> >> Jerry >> > > > ------------------------------- > To unsubscribe from the list, please send an email to > LISTOWNERS-request@rootsweb.com with the word 'unsubscribe' without the > quotes in the subject and the body of the message

Thanks Joan, I only had one get through to the list last month. The from wasn't my list of subscribers. I had it removed from the archives before I checking if subscribe was in it. Now I know what to watch for in theses non-subscriber messages. Jerry On Apr 28, 2013, at 10:11 AM, JYoung6180@aol.com wrote: > Jerry- > > It would appear that this type of spam was sent to the LIST address and the address isn't subbed to the list and therefore MailMan correctly sent it to pending requests because you have your list set to send non-subscriber emails there with the setting of HOLD. I don't see these at all because I have all my lists set to DISCARD non-subscriber emails. > > I think the most troubling of these spam emails with SUBSCRIBE in the subject and/or message body would be the ones sent to the list-request address which COULD if the spammer followed through on the request get them subbed to the list. The question is really about THOSE requests...and whether anyone has seen them actually get subbed. I haven't. > > Joan > > In a message dated 4/28/2013 9:56:58 A.M. Eastern Daylight Time, tobinger@frontiernet.net writes: > All of spam to my list come in as > > "subject:NYQUEENS post from xxx@xxx requires approval > Reason: Post sent by a non-member to a members-only list." > > and I reply back to rootsweb spam and discard. > > Jerry >

Jerry- It would appear that this type of spam was sent to the LIST address and the address isn't subbed to the list and therefore MailMan correctly sent it to pending requests because you have your list set to send non-subscriber emails there with the setting of HOLD. I don't see these at all because I have all my lists set to DISCARD non-subscriber emails. I think the most troubling of these spam emails with SUBSCRIBE in the subject and/or message body would be the ones sent to the list-request address which COULD if the spammer followed through on the request get them subbed to the list. The question is really about THOSE requests...and whether anyone has seen them actually get subbed. I haven't. Joan In a message dated 4/28/2013 9:56:58 A.M. Eastern Daylight Time, tobinger@frontiernet.net writes: All of spam to my list come in as "subject:NYQUEENS post from xxx@xxx requires approval Reason: Post sent by a non-member to a members-only list." and I reply back to rootsweb spam and discard. Jerry

All of spam to my list come in as "subject:NYQUEENS post from xxx@xxx requires approval Reason: Post sent by a non-member to a members-only list." and I reply back to rootsweb spam and discard. Jerry At your convenience, visit: http://lists2.rootsweb.ancestry.com/mailman/admindb/nyqueens to approve or deny the request. On Apr 27, 2013, at 6:23 PM, Charani <charani.b@gmail.com> wrote: > JYoung6180@aol.com wrote: >> Okay...here is my question. Let's say you have your list set to >> automatically allow people to subscribe like most of us do. And let's say just for >> the sake of argument that these apparently deliberate attempts to subscribe >> to lists DO make it through and don't get blocked as non-subscriber emails or >> because the address is "implicit" or because there are too many >> addresses...I would still assume that these subscribe attempts are being mass >> generated by an automated process and, if that is the case, has ANYONE had one of >> these actually get subbed to their lists? What I'm really curious about is >> the fact that a subscription attempt would generate a confirmation >> email...and the spammer would then have to receive the confirmation and respond to >> it to actually BE subscribed...has that been happening? > > Obviously I can't speak for anyone else but I have not had any of > these addresses come to either the admin address directly or bounces > addresses. If they've been sent to the list, then I won't see them if > they aren't subscribed. > > If the address was implicit or there were too many, I wouldn't expect > to see it getting through for approval (or confirmation). > > If these addresses are not operational, then sending a mail asking for > confirmation would be bounced back as an unknown address and so would > not be subscribed to a list. > > If the address is in any way operational and hits a list set for > confirmation, then we potentially have a real problem. > > It's quite possible they are being mass generated but that doesn't > mean they aren't actual attempts. > > It will only take one of the apparently randomly fake addresses to > make it through to have the potential to create chaos because it > wasn't actually a fake. > > I've just had a second one from a different address hit one of my lists. > > -- > Charani (UK) > OPC for Walton, Ashcott, Shapwick, > Greinton and Clutton, SOM > http://wsom-opc.org.uk > > > ------------------------------- > To unsubscribe from the list, please send an email to LISTOWNERS-request@rootsweb.com with the word 'unsubscribe' without the quotes in the subject and the body of the message

JYoung6180@aol.com wrote: > Charani- > > That is the million dollar question...and the only way we'll know is if a > list admin can prove to us that this spam subscription attempt actually > WORKS and completes the automated process to confirm. I haven't seen ANY > evidence of that happening as yet and with the vast number of these people are > seeing you would think we'd know by now if that happened. If 'ifs' and 'ands' were pots and pans, I'd be falling over them instead of various members of our menagerie <G> If all list admins sub to this list, then if it had happened there's a chance one of them would say. I rather suspect not all admins are subbed. Even those who usually are might not be at the moment. Are there vast numbers though? There are over 35,000 lists, many of them with the ancestors and many without admins. In other words it /might/ have happened and we don't know about it - yet. I'd rather err on the side of caution and keep my lists set to approval. -- Charani (UK) OPC for Walton, Ashcott, Shapwick, Greinton and Clutton, SOM http://wsom-opc.org.uk

I apparently need to check my settings for my one small list set, but almost all of the requests sent to me are indicated as being from non-members. I haven't paid attention to whether they were posting requests or membership because they are SO obviously SPAM & I set them to 'Discard.. I will try to pay a little more attention to them, but in any case they are not legitimate requests. Every once in awhile out of curiosity I will click on the highlighted number to look at the rest of the message & it always just spam. Guess I had better go back & read administrator notes. It has been a while since I have. Linda Jowers North Carolina Scots jowerslh@aol.com -----Original Message----- From: scotstout <scotstout@aol.com> To: Listowners <Listowners@rootsweb.com> Sent: Sat, Apr 27, 2013 7:39 am Subject: Re: [LO] Spammer subscribing. the one list i manage is very rarely used even by the subscribers, and i haven't been hit by any spammers -- until this morning. suspicious address - C1C2231BD@actionsports-usa.com but all would-be subscribers have to be approved by me, so it's no biggie. -----Original Message----- From: Gene Phillips <gnphllps@comcast.net> To: Listowners <Listowners@rootsweb.com> Sent: Fri, Apr 26, 2013 8:57 pm Subject: [LO] Spammer subscribing. FYI I just got 3 subscribe requests from "DatingLife" using 2 different email addresses. I also had 2 spam messages to my admin address from the same user name. Gene ------------------------------- To unsubscribe from the list, please send an email to LISTOWNERS-request@rootsweb.com with the word 'unsubscribe' without the quotes in the subject and the body of the message ------------------------------- To unsubscribe from the list, please send an email to LISTOWNERS-request@rootsweb.com with the word 'unsubscribe' without the quotes in the subject and the body of the message

JYoung6180@aol.com wrote: > Okay...here is my question. Let's say you have your list set to > automatically allow people to subscribe like most of us do. And let's say just for > the sake of argument that these apparently deliberate attempts to subscribe > to lists DO make it through and don't get blocked as non-subscriber emails or > because the address is "implicit" or because there are too many > addresses...I would still assume that these subscribe attempts are being mass > generated by an automated process and, if that is the case, has ANYONE had one of > these actually get subbed to their lists? What I'm really curious about is > the fact that a subscription attempt would generate a confirmation > email...and the spammer would then have to receive the confirmation and respond to > it to actually BE subscribed...has that been happening? Obviously I can't speak for anyone else but I have not had any of these addresses come to either the admin address directly or bounces addresses. If they've been sent to the list, then I won't see them if they aren't subscribed. If the address was implicit or there were too many, I wouldn't expect to see it getting through for approval (or confirmation). If these addresses are not operational, then sending a mail asking for confirmation would be bounced back as an unknown address and so would not be subscribed to a list. If the address is in any way operational and hits a list set for confirmation, then we potentially have a real problem. It's quite possible they are being mass generated but that doesn't mean they aren't actual attempts. It will only take one of the apparently randomly fake addresses to make it through to have the potential to create chaos because it wasn't actually a fake. I've just had a second one from a different address hit one of my lists. -- Charani (UK) OPC for Walton, Ashcott, Shapwick, Greinton and Clutton, SOM http://wsom-opc.org.uk

Well...I don't think a list admins needs to be subscribed to this list to become concerned if a spammer successfully subs to their lists --- they would probably join the list if that happened just so they could report it to the rest of us. I admin quite a few lists and people can subscribe themselves to all of those lists without my help...BUT I do have ALL of my lists set to notify me of new subscriptions...and I have not received a single notice of this spammer subbing to ANY of my lists. So fiddle-de-de as Scarlet said...I'll worry about it tomorrow. Joan In a message dated 4/27/2013 7:54:50 P.M. Eastern Daylight Time, charani.b@gmail.com writes: JYoung6180@aol.com wrote: > Charani- > > That is the million dollar question...and the only way we'll know is if a > list admin can prove to us that this spam subscription attempt actually > WORKS and completes the automated process to confirm. I haven't seen ANY > evidence of that happening as yet and with the vast number of these people are > seeing you would think we'd know by now if that happened. If 'ifs' and 'ands' were pots and pans, I'd be falling over them instead of various members of our menagerie <G> If all list admins sub to this list, then if it had happened there's a chance one of them would say. I rather suspect not all admins are subbed. Even those who usually are might not be at the moment. Are there vast numbers though? There are over 35,000 lists, many of them with the ancestors and many without admins. In other words it /might/ have happened and we don't know about it - yet. I'd rather err on the side of caution and keep my lists set to approval. -- Charani (UK) OPC for Walton, Ashcott, Shapwick, Greinton and Clutton, SOM http://wsom-opc.org.uk

David- That is precisely what I'm doing (and I'd hope others do the same) with those spam messages...the concern of some others are actual attempts by a mass spammer to subscribe to the lists...and the admins who have their lists set to "approve" new subs are seeing these and rejecting them. Admins who don't have lists set to review and approve new subs are seeing these in pending requests if they have their lists set to "hold" non-subscriber emails, admins who have lists set to "discard" like I do are not seeing these at all...and I've not had any notices of any subscriptions (successful) to my lists by this spammer...so I'm simply not going to worry about it. Joan In a message dated 4/27/2013 7:57:46 P.M. Eastern Daylight Time, dsam52@sampubco.com writes: This is what I am seeing - and whoever sent that is trying to get you to subscribe to whatever that site is. Just hit delete button. I received 2 to my admin address and once just to me. Deleted right on spot after added them to spam hit list. David Samuelsen On 4/27/2013 8:49 AM, JYoung6180@aol.com wrote: > I'm getting the ones sent to my admin address that say "subscribe now and > save..." but they are not trying to sub to the list...just using that word > in the subject for their own spam purposes. > > Joan ------------------------------- To unsubscribe from the list, please send an email to LISTOWNERS-request@rootsweb.com with the word 'unsubscribe' without the quotes in the subject and the body of the message

Could very well be, but to be sure we have now temporarily put all of the lists on approve. I hate doing that but I hate spammers even more. Janet On Sat, Apr 27, 2013 at 6:45 PM, <JYoung6180@aol.com> wrote: > ** > Janet- > > This may be because you REVIEW all new subs. I don't...so I wouldn't see > anything requiring approval to subscribe but they still don't seem to GET > subscribed. Probably because farther down the list for MailMan to check off > is the "implicit" address check or "too many" addresses the post is being > sent to. So they end up in pending requests. > > Joan >

Wyants wrote: > I'm sure you're right, Gene, and I don't mean to drag this out, but are you > sure they were sent to your lists' subscribe addresses? Have a look at this: http://fourrabbitsblog.wordpress.com/2013/04/27/spammer-sub-request/ I've borrowed a page on the blog to show what many of us are seeing. -- Charani (UK) OPC for Walton, Ashcott, Shapwick, Greinton and Clutton, SOM http://wsom-opc.org.uk

Greetings: It would be very, very helpful -- to me at least -- if people using the "Spammer subscribing" subject line would limit their reports to cases of spammers who are actually, successfully, subscribing. Otherwise, it seems a change of subject line to something more descriptive of the contents would be in order. Come on folks, "spammers attempt to subscribe, notice sent to admin address" is about as much a news flash as "thunderstorm produces lightning and rain". Darrell

Charani- That is the million dollar question...and the only way we'll know is if a list admin can prove to us that this spam subscription attempt actually WORKS and completes the automated process to confirm. I haven't seen ANY evidence of that happening as yet and with the vast number of these people are seeing you would think we'd know by now if that happened. Joan In a message dated 4/27/2013 6:23:28 P.M. Eastern Daylight Time, charani.b@gmail.com writes: If these addresses are not operational, then sending a mail asking for confirmation would be bounced back as an unknown address and so would not be subscribed to a list. If the address is in any way operational and hits a list set for confirmation, then we potentially have a real problem.

I don't see this as a BUG...I see this as a FEATURE...the fact that we require confirmation for the auto subscriptions...if the email addresses are not valid they won't be able to subscribe and confirm. I think the people who confirm every new subscription are probably wasting their time worrying about this because the automated system will sort it out on its own...unless someone can prove me wrong and show that the spammer actually DID become subscribed to a list via the automatic system. Joan In a message dated 4/27/2013 6:59:07 P.M. Eastern Daylight Time, wyants@sasktel.net writes: OK, thanks, Charani ... I see now. I must be blessed because I have had NONE of these! Only posts to my admin addresses and posts in Pending ... it's almost certainly because I don't have my lists set to approve each subscription, so this is a simple issue for me to deal with ... But it raises the question as to whether or not this is a bug in MailMan that needs to be seen to?? PSW

None got through to my lists. They were sent multiple times to 7 of my lists which are set to get Approvals for new Subscribers; those lists usually get none to maybe 2 requests for new subscribers every 3 months. Most of those that were Pending had been received overnight, except for about a dozen that seem to have come in all at one time around late morning. Haven't seen any since mid-afternoon, though. They definitely were some sort of mass-produced system all kicking out numbered email addresses, but all showing "Dating Life" as the owners. I'm subscribed to a lot of Mailing Lists, and haven't seen any emails come through them from any of the addresses or anything similar to the addresses, so obviously they are not getting to the lists, unless somehow one did manage to make it to a list, perhaps through an error of an unwitting administrator. Frankly, it's actually been rather quiet on the Lists today, I think the majority of the messages from any of the lists I'm subbed to have been from this one. Deloris -------------------------------------------------- From: "Charani" <charani.b@gmail.com> Sent: Saturday, April 27, 2013 6:54 PM To: <JYoung6180@aol.com>; <listowners@rootsweb.com> Subject: Re: [LO] Spammer subscribing. > JYoung6180@aol.com wrote: >> Charani- >> >> That is the million dollar question...and the only way we'll know is if a >> list admin can prove to us that this spam subscription attempt actually >> WORKS and completes the automated process to confirm. I haven't seen ANY >> evidence of that happening as yet and with the vast number of these >> people are >> seeing you would think we'd know by now if that happened. > > If 'ifs' and 'ands' were pots and pans, I'd be falling over them > instead of various members of our menagerie <G> > > If all list admins sub to this list, then if it had happened there's a > chance one of them would say. I rather suspect not all admins are > subbed. Even those who usually are might not be at the moment. > > Are there vast numbers though? There are over 35,000 lists, many of > them with the ancestors and many without admins. > > In other words it /might/ have happened and we don't know about it - yet. > > I'd rather err on the side of caution and keep my lists set to approval. > > -- > Charani (UK) > OPC for Walton, Ashcott, Shapwick, > Greinton and Clutton, SOM > http://wsom-opc.org.uk > > > ------------------------------- > To unsubscribe from the list, please send an email to > LISTOWNERS-request@rootsweb.com with the word 'unsubscribe' without the > quotes in the subject and the body of the message