full-disclosure - Netsys Mailman Probes due to Illegal Attachments

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <e92364c3041228053714e6af9d@mail.gmail.com>
From: jftucker at gmail.com (James Tucker)
Subject: Netsys Mailman Probes due to Illegal Attachments

Everyone else on gmail and with other good MTA filters getting these?

Thought it is interesting to note that so many (other people's)
addresses are being sent out in the probe...

  ----- The following addresses had permanent fatal errors -----
<scz@...ocus.com>
   (reason: 550 Error: Message content rejected)
<administrator@...inetworks.com>
   (reason: 550 5.0.0 your mail contains a virus)
<osnews@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<martin.burton@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<infolist@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<dogobrazil@...mac.com>
   (reason: 550 Blacklisted file extension detected)
<gskouby@...esnow.com>
   (reason: 550 Blacklisted file extension detected)
<jneedle@...hat.com>
   (reason: 554 5.7.1 Rejecting because of virus Worm.Bagle.Z)
<formatez@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<jmaier@...mann.com>
   (reason: 550 Error: attachment type not allowed)
<gzhanyz@...n.com>
   (reason: 553 Mail data refused by AISP, rule [2640375].)
<qixianqin@....com>
   (reason: 550 CoremailSys:Your message was blocked by NetEase
AntiSpam+...(T0E8Jxjr0EEysqOM.1.C.12921))
<marcano@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<radicand@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<shonkyholdings@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<greg.bur@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<core10@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<n00blette@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<f.caccavella@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<screenster@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<amathews@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<jftucker@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<bartuso@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<has207@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<grantmc@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<scott.sargent@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<michael.hale@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<wolvie@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<cren888@...il.com>
   (reason: 552 5.7.0 Illegal Attachment)
<chance@...amscope.com>
   (reason: 550 Error: Files attached to emails that contain or end in
.scr are prohibited on this server as they may contain viruses.)

  ----- Transcript of session follows -----
... while talking to 211.152.8.69.:
>>> DATA
<<< 550 Error: Message content rejected
554 5.0.0 Service unavailable
... while talking to mailin.webmailer.de.:
>>> DATA
<<< 550 5.0.0 your mail contains a virus
554 5.0.0 Service unavailable
<mweber@...win.com>... Deferred: Connection timed out with mail.hadag.com.
... while talking to gsmtp171.google.com.:
>>> DATA
<<< 552 5.7.0 Illegal Attachment
554 5.0.0 Service unavailable
... while talking to mail-in2.spymac.net.:
>>> DATA
<<< 550 Blacklisted file extension detected
554 5.0.0 Service unavailable
... while talking to mail.sitesnow.com.:
>>> DATA
<<< 550 Blacklisted file extension detected
554 5.0.0 Service unavailable
... while talking to mx1.redhat.com.:
>>> DATA
<<< 554 5.7.1 Rejecting because of virus Worm.Bagle.Z
554 5.0.0 Service unavailable
... while talking to gsmtp171.google.com.:
>>> DATA
<<< 552 5.7.0 Illegal Attachment
554 5.0.0 Service unavailable
... while talking to mail.ahlmann.com.:
>>> DATA
<<< 550 Error: attachment type not allowed
554 5.0.0 Service unavailable
... while talking to mta2.21cn.com.:
>>> DATA
<<< 553 Mail data refused by AISP, rule [2640375].
554 5.0.0 Service unavailable
... while talking to mx.mail.126.com.:
>>> DATA
<<< 550 CoremailSys:Your message was blocked by NetEase
AntiSpam+...(T0E8Jxjr0EEysqOM.1.C.12921)
554 5.0.0 Service unavailable
... while talking to gsmtp171.google.com.:
>>> DATA
<<< 552 5.7.0 Illegal Attachment
554 5.0.0 Service unavailable
... while talking to mail.dreamscope.com.:
>>> DATA
<<< 550 Error: Files attached to emails that contain or end in .scr
are prohibited on this server as they may contain viruses.
554 5.0.0 Service unavailable


Final-Recipient: RFC822; scz@...ocus.com
Action: failed
Status: 5.2.0
Remote-MTA: DNS; 211.152.8.69
Diagnostic-Code: SMTP; 550 Error: Message content rejected
Last-Attempt-Date: Tue, 28 Dec 2004 00:04:01 -0500 (EST)

Final-Recipient: RFC822; administrator@...inetworks.com
Action: failed
Status: 5.0.0
Remote-MTA: DNS; mailin.webmailer.de
Diagnostic-Code: SMTP; 550 5.0.0 your mail contains a virus
Last-Attempt-Date: Tue, 28 Dec 2004 00:04:42 -0500 (EST)

Final-Recipient: RFC822; osnews@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:05:31 -0500 (EST)

Final-Recipient: RFC822; martin.burton@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:05:31 -0500 (EST)

Final-Recipient: RFC822; infolist@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:05:31 -0500 (EST)

Final-Recipient: RFC822; dogobrazil@...mac.com
Action: failed
Status: 5.2.0
Remote-MTA: DNS; mail-in2.spymac.net
Diagnostic-Code: SMTP; 550 Blacklisted file extension detected
Last-Attempt-Date: Tue, 28 Dec 2004 00:07:06 -0500 (EST)

Final-Recipient: RFC822; gskouby@...esnow.com
Action: failed
Status: 5.2.0
Remote-MTA: DNS; mail.sitesnow.com
Diagnostic-Code: SMTP; 550 Blacklisted file extension detected
Last-Attempt-Date: Tue, 28 Dec 2004 00:08:56 -0500 (EST)

Final-Recipient: RFC822; jneedle@...hat.com
Action: failed
Status: 5.7.1
Remote-MTA: DNS; mx1.redhat.com
Diagnostic-Code: SMTP; 554 5.7.1 Rejecting because of virus Worm.Bagle.Z
Last-Attempt-Date: Tue, 28 Dec 2004 00:09:43 -0500 (EST)

Final-Recipient: RFC822; formatez@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:09:46 -0500 (EST)

Final-Recipient: RFC822; jmaier@...mann.com
Action: failed
Status: 5.2.0
Remote-MTA: DNS; mail.ahlmann.com
Diagnostic-Code: SMTP; 550 Error: attachment type not allowed
Last-Attempt-Date: Tue, 28 Dec 2004 00:10:55 -0500 (EST)

Final-Recipient: RFC822; gzhanyz@...n.com
Action: failed
Status: 5.1.0
Remote-MTA: DNS; mta2.21cn.com
Diagnostic-Code: SMTP; 553 Mail data refused by AISP, rule [2640375].
Last-Attempt-Date: Tue, 28 Dec 2004 00:11:42 -0500 (EST)

Final-Recipient: RFC822; qixianqin@....com
Action: failed
Status: 5.2.0
Remote-MTA: DNS; mx.mail.126.com
Diagnostic-Code: SMTP; 550 CoremailSys:Your message was blocked by NetEase
       AntiSpam+...(T0E8Jxjr0EEysqOM.1.C.12921)
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:04 -0500 (EST)

Final-Recipient: RFC822; marcano@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; radicand@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; shonkyholdings@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; greg.bur@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; core10@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; n00blette@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; f.caccavella@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; screenster@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; amathews@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; jftucker@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; bartuso@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; has207@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; grantmc@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; scott.sargent@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; michael.hale@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; wolvie@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; cren888@...il.com
Action: failed
Status: 5.7.0
Remote-MTA: DNS; gsmtp171.google.com
Diagnostic-Code: SMTP; 552 5.7.0 Illegal Attachment
Last-Attempt-Date: Tue, 28 Dec 2004 00:12:16 -0500 (EST)

Final-Recipient: RFC822; chance@...amscope.com
Action: failed
Status: 5.2.0
Remote-MTA: DNS; mail.dreamscope.com
Diagnostic-Code: SMTP;