----- Forwarded message from Rick Moen <rick(a)linuxmafia.com> -----
Date: Sat, 21 Nov 2020 12:41:28 -0800
From: Rick Moen <rick(a)linuxmafia.com>
To: Al <aw009(a)sunnyside.com>
Cc: Michael Paoli <Michael.Paoli(a)cal.berkeley.edu>
Subject: Re: Fwd: cooperation
I'm going to also send this to balug-admin for collective knowledge.
Quoting Al Whaley (aw009(a)sunnyside.com):
> Rick,
> this one caught my eye... it seems to have gone through mailman on
> linuxmafia for the SFLUG mailing list.
_Sort_ of, but mostly not.
You as a listadmin for the SF-LUG mailing list receive copies from
Mailman of outside mail addressed to the sf-lug-owner(a)linuxmafia.com
alias (note -owner suffix). If the initial MTA defences don't reject
the inbound mail to that role alias address, then it'll get out to the
listadmins, i.e., to you + me + Jim Stockford (the SF-LUG list's
three-person listadmin roster).
If you check full headers, you'll find that the 419 scam mail
originated from Microsoft Hotmail IP address 40.92.51.100. See these
Received headers for that initial information:
From mailman-bounces(a)linuxmafia.com Sat Nov 21 09: 9:52 2020
Return-path: <mailman-bounces(a)linuxmafia.com>
Envelope-to: rick(a)linuxmafia.com
Delivery-date: Sat, 21 Nov 2020 09:09:52 -0800
Received: from localhost ([127.0.0.1] helo=linuxmafia.com)
by linuxmafia.com with esmtp (Exim 4.72)
(envelope-from <mailman-bounces(a)linuxmafia.com>)
id 1kgWOV-0005CC-Vj; Sat, 21 Nov 2020 09:09:52 -0800
Received: from mail-db8eur06olkn2100.outbound.protection.outlook.com
([40.92.51.100]
helo=EUR06-DB8-obe.outbound.protection.outlook.com)
by linuxmafia.com with esmtp (Exim 4.72)
(envelope-from <jmpumjzzjjsxssvvvzzz(a)hotmail.com>)
id 1kgWOQ-0005C3-Vq; Sat, 21 Nov 2020 09:09:50 -0800
Grepping the MTA logs for that IP....
linuxmafia:/var/log/exim4# zgrep 40.92.51.100 mainlog*
mainlog:2020-11-21 09:09:50 1kgWOQ-0005C3-Vq SA: Action: scanned but message isn't spam: score=0.8 required=4.0 (scanned in 3/3 secs | Message-Id: 1kgWOQ-0005C3-Vq). From <jmpumjzzjjsxssvvvzzz(a)hotmail.com> (host=mail-db8eur06olkn2100.outbound.protection.outlook.com
[40.92.51.100]) for sf-lug-owner(a)linuxmafia.com, sf-lug(a)linuxmafia.com mainlog:2020-11-21 09:09:50 1kgWOQ-0005C3-Vq <= jmpumjzzjjsxssvvvzzz(a)hotmail.com H=mail-db8eur06olkn2100.outbound.protection.outlook.com (EUR06-DB8-obe.outbound.protection.outlook.com) [40.92.51.100] P=esmtp S=8365 id=AM6PR08MB424596EC3D85FB4BE09C3DD6CDFE0(a)AM6PR08MB4245.eurprd08.prod.outlook.com
linuxmafia:/var/log/exim4#
...you can see that the SMTP session, i.e., the SMTP envelope
information embodied in the SMTP delivery conversation, must have contained
MAIL FROM: <jmpumjzzjjsxssvvvzzz(a)hotmail.com>
RCPT TO: <sf-lug-owner(a)linuxmafia.com>
RCPT TO: <sf-lug(a)linuxmafia.com>
Measured spamicity (0.8) at receiving MTA level was nowhere near high
enough for my MTA to reject (4.0), because this really _was_ from a
Hotmail user, and the mail's body text was not sufficiently spammy to a
degree that automated MTA-level spamd scanning for garbage adjudged
processed meat, so this 419 scam mail got passed along to the Mailman
MLM. Mailman passed through the copy _back_ to the MTA that was
addressed out to the listadmins, _but_ by contrast lodged the direct
mailing list copy in Mailman's admin queue for sf-lug(a)linuxmafia.com,
whence it will expire out in five days and then automatically get thrown
away.
Why in the MLM admin queue? Two reasons:
1. Since in this case the scam mail's internal SMTP headers were
'implicitly addressed', i.e., there were no To: or Cc: addresses
whatsoever inside the message proper, only SMTP envelope addressees
(outside the message proper), Mailman will never send such mail out to
subscribers, on account of Mailman's built-in filter blocking all
'implicitly addressed' mail. I.e., Mailman requires that valid mail to
subscribers specify on either the internal To: header or the internal CC:
header the mailing list's direct address or an alias the listadmins have
specified inside the admin WebUI. If that header is _not_ present, the
message deterministically lodges in the admin queue, flagged as
'implicitly addressed'.
2. Also, it didn't originate from a subscriber, hence would (for that
reason as well) have been intercepted and held as being from a
non-subscribed address.
> it's not in the archives so I'm assuming it didn't go out to
> everyone, unless you deleted it, and it wasn't marked
> as being sent for moderation...
> what am I missing here?
Naturally, I would love for inbound junkmail filtering to reject even
more than it already does, but, frankly, linuxmafia.com system-level
spam-rejection is already quite good. Diminishing returns and false
positives rapidly become a problem as one tries to make MTA spam
immune response even better.
Where I sit, it seems to me it's a fact of life that being a Mailman
addressee on any [listname]-owner aliases _is_ going to get you
increased MLM-mediated spam because of being a member of that alias, as
additional protections covering MLM subscribers simply don't apply to
that admin-role alias address.
Speaking of that, I believe it's past time that I remove Jim Stockford
(i.e., jim(a)well.com) from the sf-lug-owner(a)linuxmafia.com roster, and
I'm going to do that right now.
It realised I probably needed to get around to that, about a year or so
ago, when he was _publicly_ claiming on the SF-LUG mailing list that
linuxmafia.com is an SMTP spam source, very likely because of having
received some amount of junkmail via the sf-lug-owner alias. (His
public accusation was, however, _unbelievably_ vague, so I couldn't
investigate his claim.)
You, by contrast, did exactly the right thing in asking me rather than
going on a public accusation campaign, so the comparison is night and
day. That distinction having been made, to this day I resent Jim's
(false) public accusation, and the only thing that mitigates it is that,
for unclear personal reasons, Jim has been lately unable to discharge
his responsibilities.
I didn't want to delete him from the roster in haste, since Jim founded
the group, and supposedly solemnly committed to being _the_ listadmin
responsible for it, (but has never actually done the job, over the
entire 15-year period I've given SF-LUG temporary mailing list hosting,
pending them getting their server running again -- which never
happened).
Done. jim(a)well.com is now omitted from the SF-LUG listadmin roster.
(Just for the record: This means that the _sole_ requirement I insisted
on, before being willing to grant SF-LUG temporary mailing list hosting
to help after whatever mysterious failure destroyed SF-LUG's -own-
mailing list server in late 2005 -- the requirement that Jim shoulder
listadmin duties so I don't have my workload increased by SF-LUG's
presence on my server -- has been continuously in default from that day
in December 2005 to the present.)
----- End forwarded message -----
I get emails ... <sigh>
... seems to be a lot 'o these goin' around:
Threat/extortion emails (mostly all bark no or negligible bite).
Seems they're probably targeting those more probable to fall for it,
e.g. smaller businesses and such that aren't particularly tech savvy,
... not that their targeting is particularly accurate, but maybe at
least what they aim for by the content of their email.
Trimmed and redacted for brevity, etc., both of these from same IP:
------------------------------------------------------------------------
Received: from dedi.coronaxy.com ([185.198.58.92]:38380)
by balug-sf-lug-v2.balug.org
for <balug-announce(a)lists.balug.org>; Tue, 27 Oct 2020 04:41:53 +0000
To: balug-announce(a)lists.balug.org
Date: Tue, 27 Oct 2020 04:41:34 +0000
From: Patrick Wilson <patrick-wilson(a)coronaxy.com>
Subject: Your website www.balug.org has been hacked
We are the Cozy Bear and we have chosen www.balug.org as target for
our next DDoS attack.
Your network will be subject to a DDoS attack starting at 2020
November 2nd (Monday).
THIS IS NOT A HOAX, and to prove it right now we will start a small
attack on www.balug.org that will last for 30 minutes.
This means that your website, e-mail and other connected services will
be unavailable for everyone.
We will refrain from attacking your servers for a small fee.
The current fee is $1200(USD) in bitcoins (BTC). The fee will increase
by 1000 USD for each day after deadline that passed without payment.
Please send Bitcoin to the following Bitcoin address (cAsE-SeNsitIve):
[REDACTED]
If you decide not to pay, we will start the attack on the indicated
date and uphold it until you do, there's no counter measure to this,
you will only end up wasting more money trying to find a solution
(Cloudflare, Sucuri, Imperva and similar services are useless, because
we will hit your network directly).
We will completely destroy your reputation and make sure your services
will remain offline until you pay.
We will also download your database and do as much damage as possible.
Once you have paid we won't start the attack and you will never hear
from us again.
------------------------------------------------------------------------
From <elijah-martin(a)coronaxy.com> Tue Oct 27 17:35:38 2020
Received: from dedi.coronaxy.com ([185.198.58.92]:56414)
for <balug-announce-owner(a)lists.balug.org>; Tue, 27 Oct 2020 17:35:38 +0000
To: balug-announce-owner(a)lists.balug.org
Date: Tue, 27 Oct 2020 17:35:16 +0000
From: Elijah Martin <elijah-martin(a)coronaxy.com>
Subject: If www.balug.org is important to you, you must read this
We have hacked your website(s) www.balug.org and extracted your databases.
We will systematically go through a series of steps of totally
damaging your reputation. First your database will be leaked or sold
to the highest bidder which they will use with whatever their
intentions are. Next if there are e-mails found they will be e-mailed
that their information has been sold or leaked and your site
www.balug.org was at fault thusly damaging your reputation and having
angry customers/associates with whatever angry customers/associates
do. Lastly any links that you have indexed in the search engines will
be de-indexed based off of blackhat techniques that we used in the
past to de-index our targets.
How do I stop this?
We are willing to refrain from destroying your site's reputation for a
small fee. The current fee is $1050(USD) in bitcoins (BTC).
Please send the bitcoin to the following Bitcoin address (Copy and
paste as it is case sensitive):
[REDACTED]
If you decide not to pay, we will start the attack at the indicated
date and uphold it until you do, there's no counter measure to this,
you will only end up wasting more money trying to find a solution. We
will completely destroy your reputation amongst google and your
customers.
This is not a hoax, do not reply to this email, don't try to reason or
negotiate, we will not read any replies. Once you have paid we will
stop what we were doing and you will never hear from us again!
------------------------------------------------------------------------
And yes, simple Internet search to confirm, and many such threats being
emailed about.
Maybe if I get bored and have some time some day, I'll put in an
anti-spam filter to specifically reject these upon attempted delivery
during the SMTP phase ... maybe with reject message/diagnostic
including something along the lines of:
Due to overwhelming request volume, we are no longer able to accept
ransomware/blackmail/threat requests for payment via email.
We do however, still accept such requests via USPS mail.
For prompt attention to your request, please send it via USPS to:
<automatically inserted email address they attempted to> c/o
ref: <automatically inserted reference on failed email attempt>
FBI: ATTN: ransomware/blackmail/threat requests for payment
<address>
USA
Thank you for your cooperation on these matters to help ensure prompt
attention by those relevant and responsible for handling your request.
Dropping larryp(a)inow.com from the forwarding aliases.
inow.com has two NS, neither of which function.
Let me know if/when I should add it back.
----- Forwarded message from Mailer-Daemon(a)balug.org -----
Date: Sat, 01 Aug 2020 09:16:03 +0000
From: "Mail Delivery System" <Mailer-Daemon(a)balug.org>
Reply-To: postmaster(a)balug.org
Subject: Mail delivery failed: returning message to sender
To: Michael.Paoli(a)cal.berkeley.edu
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
larryp(a)inow.com
(generated from balug-contact(a)balug.org)
Unrouteable address
----- End forwarded message -----
Rick,
Thanks, I'll need to look into it some more - see what I can fix easily
enough. Even your emails to me (via balug-admin(a)lists.balug.org) didn't
land in my "inbox", but, alas, were snagged by gmail as "spam". Not that
there's anything inherently wrong with the emails ... gmail's spam
filtering seems to be getting increasingly stupid, and drops lots of
legitimate email from numerous legitimate senders into spam - and
senders having perfectly fine (or at least okay) email sending too. But
at least gmail's spam filtering is better than yahoo's horrible mess of
spam filtering ... but that's not saying much.
I miss when berkeley.edu actually handled their own mail - they've long
since handed it all over to Google ... ugh.
So, yeah, anyway, something(s) definitely not right. I think some of
the issues are - mailman's bounce processing isn't working 100%. That
is likely due to exim4/eximconfig/mailman interaction.
There's also some fair bits of odd breakage(ness) in eximconfig.
eximconfig, unfortunately, hasn't been maintained in many many years,
and as time goes on, and exim evolves and upgrades versions, eximconfig
only continues to be more and more broken.
My longer term plan is to get rid of eximconfig - and almost certainly
also exim - and probably go with an MTA that is also more reasonably
configurable - probably postfix. One of exim's significant
limitations/issues, is it doesn't play very nice with multiple domains.
If, e.g., one has multiple domains - be it 2 or thousands, and one wants
to or needs to, say, set up, postmaster@DOMAIN, webmaster@DOMAIN,
contact@DOMAIN, listmaster@DOMAIN, etc. the distinct DOMAINs can't be
aliased separately, but every single one, e.g. postmaster, webmaster,
etc, must all use the same alias for the same local part - even across
distinct domains. That's a best highly annoying and unsatisfactory.
Yes, is possible to add further post-processing tools, that might
possibly address that, but that's also rather unsatisfactory.
E.g. if I want/need webmaster@DOMAIN1, and @DOMAIN2, but don't want and
want to reject webmaster@OTHER_DOMAINS - exim has no way to do that - post
processing tools could drop that, but they can't reject it at connect.
Anyway, lots of reasons to switch out the MTA. And with that will need to
put in some reasonable (and much more feasible to reasonably control -
eximconfig is too creaky and unmaintained for that, and much of it is
deeply tied into python - which I don't exactly fully grok ... yet).
And, "of course", since it's all live and operational, need to do the
changes carefully (will probably need to alpha/beta test the changes on
a quasi-work-alike dummy/test VM first ... carefully, as won't want to
be doing actual Internet email/list traffic - at least not with same
domains/IPs). Anyway, is on the todo list. Did get balug VM upgraded
to current stable some months back - so that's a bit closer. Still have
one (fairly complex) physical host to upgrade to current stable ...
likely get to the MTA/anti-spam stuff on the BALUG VM sometime after that.
But I'll also look to see if there's something I might be able to do in
the meantime that works reasonably well and easily enough.
Also, might go from mailman2 to mailman3 at some point ... but that's not
nearly as urgent. Would likely have some fair bit of advantages, but that
wouldn't fix the other (at least for the most part) email issues - so not
a priority at this time.
> Date: Fri, 26 Jun 2020 21:23:29 -0700
> From: Rick Moen <rick(a)linuxmafia.com>
> To: balug-admin(a)lists.balug.org
> Subject: Re: [BALUG-Admin] balug.org's IP and domain are on some blocklists
> Sender: BALUG-Admin <balug-admin-bounces(a)lists.balug.org>
>
> I wrote:
>
> > RBL claims in the bounce notices below motivated me to check the BALUG
> > IP (96.86.170.229) and domain on DNSBLs. There are some reputation
> > problems for the IP address...
> >
> > $ dig -t a +short 229.170.86.96.dnsbl-1.uceprotect.net
> > 127.0.0.2
> > $ dig -t a +short 229.170.86.96.all.s5h.net
> > 127.0.0.2
> > $ dig -t a +short 229.170.86.96.b.barracudacentral.org
> > 127.0.0.2
> > $ dig -t a +short 229.170.86.96.bb.barracudacentral.org
> > 127.0.0.2
> > $ dig -t a +short 229.170.86.96.black.dnsbl.brukalai.lt
> > 127.0.0.2
> > $
>
> One more:
>
> $ dig -t a +short 229.170.86.96.l2.apews.org
> 127.0.0.2
> $
>
> http://www.apews.org/?page=test&C=20&E=521546&ip=96.86.170.229
> Date: Fri, 26 Jun 2020 21:03:21 -0700
> From: Rick Moen <rick(a)linuxmafia.com>
> To: balug-admin(a)lists.balug.org
> Subject: [BALUG-Admin] balug.org's IP and domain are on some blocklists
> Sender: BALUG-Admin <balug-admin-bounces(a)lists.balug.org>
>
> RBL claims in the bounce notices below motivated me to check the BALUG
> IP (96.86.170.229) and domain on DNSBLs. There are some reputation
> problems for the IP address...
>
> $ dig -t a +short 229.170.86.96.dnsbl-1.uceprotect.net
> 127.0.0.2
> $ dig -t a +short 229.170.86.96.all.s5h.net
> 127.0.0.2
> $ dig -t a +short 229.170.86.96.b.barracudacentral.org
> 127.0.0.2
> $ dig -t a +short 229.170.86.96.bb.barracudacentral.org
> 127.0.0.2
> $ dig -t a +short 229.170.86.96.black.dnsbl.brukalai.lt
> 127.0.0.2
> $
>
> ...and for the domain:
>
> $ dig -t a +short balug.org.postmaster.rfc-clueless.org
> 127.0.0.3
> $
>
> The domain claim is definitely bogus, and I don't know why the RBL
> claims balug.org doesn't accept mail to postmaster -- as I just verified
> that it does:
>
> $ telnet balug.org smtp
> Trying 96.86.170.229...
> Connected to balug.org.
> Escape character is '^]'.
> 220-balug.org ESMTP Exim 4.92 (EximConfig 2.5) Sat, 27 Jun 2020 03:41:33
> +0000
> 220-.
> 220-WARNING: Unsolicited commercial E-mail (UCE/SPAM), pornographic
> 220-material, viruses and relaying is prohibited by this server and
> 220-any such messages will be rejected/filtered automatically
> 220-depending on content.
> 220-.
> 220-By using this server, you agree not to send any messages of the
> 220-above nature. Please disconnect immediately if you do not agree
> 220-to these terms and conditions.
> 220-.
> 220-Please contact postmaster(a)balug.org if you have any
> 220-enquiries about or problems with this server.
> 220-.
> 220-Find out more about EximConfig for the Exim mailer by visiting
> 220-the following URL: http://www.jcdigita.com/eximconfig
> 220 .
> HELO linuxmafia.com
> 250 balug-sf-lug-v2.balug.org Hello linuxmafia.com [96.95.217.99]
> MAIL FROM: <root(a)linuxmafia.com>
> 250 OK
> RCPT TO: <postmaster(a)balug.org>
> 250 Accepted
> DATA
> 354 Enter message, ending with "." on a line by itself
> From: root(a)linuxmafia.com
> To: postmaster(a)balug.org
> Subject: Just testing postmaster deliverability
>
> postmaster.rfc-clueless.org lists the balug.org domain, so I'm just
> doing a test. Am guessing the RBL's claim is bogus.
> .
> 250 OK id=1jp1kE-0004HS-RP
> quit
> 221 balug-sf-lug-v2.balug.org closing connection
> Connection closed by foreign host.
> $
>
>
> It could be that rfc-clueless.org's testing is aggressive enough
> to occasionally cause Exim to reject the test mails to postmaster,
> or that their text seems spammy to the rulesets, or something like
> that. I cannot remember exactly where EximConfig's whitelisting
> is, but, if logfile analysis reveals where rfc-clueless.org's test
> mails originate, that would be a preventative.
>
> The other listings are more troubling, claiming that balug.org's IP
> has been functioning as a spamhaus.
>
>
> The bounce message (below) talks about the IP address also being listed
> at 'spamrl.com', but according to
> https://www.gmass.co/blog/domain-blacklists-comprehensive-guide/ ,
> 'SpamRL.com is a domain blacklist cloaked in secrecy' with no Web-based
> or other query tools, though one can manually de-list one's IP for up
> to seven days at their Web site.
>
>
> ----- Forwarded message from mailman(a)lists.balug.org -----
>
> Date: Sat, 27 Jun 2020 00:50:51 +0000
> From: mailman(a)lists.balug.org
> To: balug-talk-owner(a)lists.balug.org
> Subject: Bounce action notification
>
> This is a Mailman mailing list bounce action notice:
>
> List: BALUG-Talk
> Member: dale(a)skywriterhosting.com
> Action: Subscription disabled.
> Reason: Excessive or fatal bounces.
>
>
>
> The triggering bounce notice is attached below.
>
> Questions? Contact the Mailman site administrator at
> mailman(a)lists.balug.org.
>
> Received: from Debian-exim by balug-sf-lug-v2.balug.org with local
> (Exim 4.92 #3 (EximConfig 2.5))
> id 1joyqL-0001nw-BL ; Sat, 27 Jun 2020 00:37:17 +0000
> X-Failed-Recipients: pricen(a)live-int.com,
> james(a)globaltap.com,
> jack(a)puppetlabs.com,
> luke(a)teyssier.com,
> zen(a)pengaru.com,
> embeddedlinuxguy(a)gmail.com,
> dale(a)skywriterhosting.com,
> melissa(a)ginormus.com
> Reply-To: postmaster(a)balug.org
> Auto-Submitted: auto-replied
> From: Mail Delivery System <Mailer-Daemon(a)balug.org>
> To: balug-talk-bounces(a)lists.balug.org
> Content-Type: multipart/report; report-type=delivery-status;
> boundary=1593218237-eximdsn-1255133696
> MIME-Version: 1.0
> Subject: Mail delivery failed: returning message to sender
> Message-Id: <E1joyqL-0001nw-BL(a)balug-sf-lug-v2.balug.org>
> Date: Sat, 27 Jun 2020 00:37:17 +0000
> X-SA-Do-Not-Run: Yes
> X-SA-Exim-Connect-IP: <locally generated>
> X-SA-Exim-Mail-From:
> X-SA-Exim-Scanned: No (on balug-sf-lug-v2.balug.org); SAEximRunCond
> expanded to false
>
> This message was created automatically by mail delivery software.
>
> A message that you sent could not be delivered to one or more of its
> recipients. This is a permanent error. The following address(es) failed:
>
> pricen(a)live-int.com
> retry timeout exceeded
> james(a)globaltap.com
> host mxa.spamstick.net [192.73.242.154]
> SMTP error from remote mail server after RCPT TO:<james(a)globaltap.com>:
> 550 no mailbox by that name is currently available
> jack(a)puppetlabs.com
> host aspmx.l.google.com [2607:f8b0:400e:c07::1a]
> SMTP error from remote mail server after RCPT TO:<jack(a)puppetlabs.com>:
> 550-5.1.1 The email account that you tried to reach does not
> exist. Please try
> 550-5.1.1 double-checking the recipient's email address for typos or
> 550-5.1.1 unnecessary spaces. Learn more at
> 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser
> k88si9124651pjk.22 - gsmtp
> luke(a)teyssier.com
> host mail.teyssier.com [64.26.60.153]
> SMTP error from remote mail server after end of data:
> 550 The sending IP (96.86.170.229) is listed on
> https://spamrl.com/. Please resolve this and retry.
> zen(a)pengaru.com
> host mail.pengaru.com [66.240.222.126]
> SMTP error from remote mail server after RCPT TO:<zen(a)pengaru.com>:
> 554 5.7.1 Service unavailable; Client host [96.86.170.229]
> blocked using b.barracudacentral.org;
> http://www.barracudanetworks.com/reputation/?pr=1&ip=96.86.170.229
> embeddedlinuxguy(a)gmail.com
> host gmail-smtp-in.l.google.com [2607:f8b0:400e:c08::1b]
> SMTP error from remote mail server after RCPT
> TO:<embeddedlinuxguy(a)gmail.com>:
> 552-5.2.2 The email account that you tried to reach is over
> quota. Please direct
> 552-5.2.2 the recipient to
> 552 5.2.2 https://support.google.com/mail/?p=OverQuotaPerm
> y34si3775952pgk.91 - gsmtp
> dale(a)skywriterhosting.com
> Unrouteable address
> melissa(a)ginormus.com
> Unrouteable address
>
> Reporting-MTA: dns; balug-sf-lug-v2.balug.org
>
> Action: failed
> Final-Recipient: rfc822;melissa(a)ginormus.com
> Status: 5.0.0
>
> Action: failed
> Final-Recipient: rfc822;dale(a)skywriterhosting.com
> Status: 5.0.0
>
> Action: failed
> Final-Recipient: rfc822;embeddedlinuxguy(a)gmail.com
> Status: 5.0.0
> Remote-MTA: dns; gmail-smtp-in.l.google.com
> Diagnostic-Code: smtp; 552-5.2.2 The email account that you tried to
> reach is over quota. Please direct
> 552-5.2.2 the recipient to
> 552 5.2.2 https://support.google.com/mail/?p=OverQuotaPerm
> y34si3775952pgk.91 - gsmtp
>
> Action: failed
> Final-Recipient: rfc822;zen(a)pengaru.com
> Status: 5.0.0
> Remote-MTA: dns; mail.pengaru.com
> Diagnostic-Code: smtp; 554 5.7.1 Service unavailable; Client host
> [96.86.170.229] blocked using b.barracudacentral.org;
> http://www.barracudanetworks.com/reputation/?pr=1&ip=96.86.170.229
>
> Action: failed
> Final-Recipient: rfc822;luke(a)teyssier.com
> Status: 5.0.0
> Remote-MTA: dns; mail.teyssier.com
> Diagnostic-Code: smtp; 550 The sending IP (96.86.170.229) is listed
> on https://spamrl.com/. Please resolve this and retry.
>
> Action: failed
> Final-Recipient: rfc822;jack(a)puppetlabs.com
> Status: 5.0.0
> Remote-MTA: dns; aspmx.l.google.com
> Diagnostic-Code: smtp; 550-5.1.1 The email account that you tried to
> reach does not exist. Please try
> 550-5.1.1 double-checking the recipient's email address for typos or
> 550-5.1.1 unnecessary spaces. Learn more at
> 550 5.1.1 https://support.google.com/mail/?p=NoSuchUser
> k88si9124651pjk.22 - gsmtp
>
> Action: failed
> Final-Recipient: rfc822;james(a)globaltap.com
> Status: 5.0.0
> Remote-MTA: dns; mxa.spamstick.net
> Diagnostic-Code: smtp; 550 no mailbox by that name is currently available
>
> Action: failed
> Final-Recipient: rfc822;pricen(a)live-int.com
> Status: 5.0.0
>
> Return-path: <balug-talk-bounces(a)lists.balug.org>
> Received: from localhost ([127.0.0.1]:50342 helo=balug.org)
> by balug-sf-lug-v2.balug.org with esmtp (Exim 4.92 #3
> (EximConfig 2.5))
> id 1joyoo-0001ju-Jy ; Sat, 27 Jun 2020 00:35:42 +0000
> Received: from mail-lj1-f174.google.com ([209.85.208.174]:44764)
> by balug-sf-lug-v2.balug.org with esmtps
> (Cipher TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92 #3 (EximConfig
> 2.5)) id 1joyog-0001jQ-H0
> for <balug-talk(a)lists.balug.org>; Sat, 27 Jun 2020 00:35:39 +0000
> Received: by mail-lj1-f174.google.com with SMTP id s9so12067445ljm.11
> for <balug-talk(a)lists.balug.org>; Fri, 26 Jun 2020 17:35:33 -0700 (PDT)
> X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
> d=1e100.net; s=20161025;
> h=x-gm-message-state:mime-version:references:in-reply-to:from:date
> :message-id:subject:to:cc;
> bh=Wn8H2ShFdHhe4BNguMg/UIqr20XvfG9VUNOkJ854sRE=;
> b=tXPJdqLthil1+swKuvMfVwBMeCKXD6EQCsxoaMi5rizt2LJGsRMTPYFSsClES7RVRF
> Z3bpm8VCikrxXu6vyxd9cMaXZYnuD+4flBU6TUhrIINccno2Z+ilmgQbl3Opl1fr6IVC
> aQ/D1EkmaBobeM2J2sLZZ8jko22xjqVQHZa9pPCeJCUbEqUgTDKoYmZFjEN64/oFviiS
> nCZ3alynwZCqRGupT0kHyxfbuXHBIAf6MPg6UA/dVxyCEbTj+ig40uA35ElojuAopJX5
> eWqnXiBO4oSC+1O36B31v66dAkvXv74zuFsBJzb+SFrIfgClW6gSOOWzpWkZNXfUpdZG
> kMOw==
> X-Gm-Message-State: AOAM530EzYEexmMPf1V7QDIi06oBzbRcWMkVwQ2ondPw36bOL0dnHHX1
> 3mPgUhjt8MLR/ZjrwirAE5FDP2yivNNlkJufiOCJ8HIY
> X-Google-Smtp-Source:
> ABdhPJzAIqjhfbbkmBjG+4rYayUqSbTSQa6zyj9Z7hxTUx7Qw5khYM/hYXwXVV39a460nB5k6JtvA8ASIhifOlN7xN4=
> X-Received: by 2002:a50:d790:: with SMTP id
> w16mr5805036edi.231.1593216865715;
> Fri, 26 Jun 2020 17:14:25 -0700 (PDT)
> MIME-Version: 1.0
> References: <20200626023605.17604atnvm66m8ao(a)webmail.rawbw.com>
> In-Reply-To: <20200626023605.17604atnvm66m8ao(a)webmail.rawbw.com>
> From: Tony Godshall <togo(a)of.net>
> Date: Fri, 26 Jun 2020 17:13:48 -0700
> Message-ID:
> <CAAOvATjh27eGzrAMmnDUCxsKPskbdO0XG02FvzZHij0gt9kv1g(a)mail.gmail.com>
> To: Michael Paoli <Michael.Paoli(a)cal.berkeley.edu>
> X-Flood-Protect-Sender-Added: Yes
> X-Flood-Protect-Sender-Rcpt-Added: Yes
> Received-SPF: pass (gmail.com ... _spf.google.com: Sender is
> authorized to use
> 'apgodshall(a)gmail.com' in 'mfrom' identity (mechanism
> 'include:_netblocks.google.com' matched) (gmail.com ... _spf.google.com:
> Sender is authorized to use 'apgodshall(a)gmail.com' in 'mfrom' identity
> (mechanism 'include:_netblocks.google.com' matched)))
> X-Greylist-Verify-Added: Yes
> X-Greylist-Passed: Yes
> X-Flood-Protect-Repeat-Fail-Added: Yes
> X-Flood-Protect-Message-Added: Yes
> X-SA-Do-Not-Teergrube: Yes
> X-EximConfig: v2.5 on balug.org (http://www.jcdigita.com/eximconfig)
> X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on
> balug-sf-lug-v2.balug.org
> X-Spam-Level:
> X-Spam-Status: No, score=-0.0 required=5.0 tests=RCVD_IN_DNSWL_NONE,
> RCVD_IN_MSPIKE_H2 autolearn=ham autolearn_force=no version=3.4.2
> Subject: Re: [BALUG-Talk] Company in Concord seeks to donate older PCs to a
> LUG
> X-BeenThere: balug-talk(a)lists.balug.org
> X-Mailman-Version: 2.1.29
> Precedence: list
> List-Id: General discussion list for BALUG <balug-talk.lists.balug.org>
> List-Unsubscribe:
> <https://lists.balug.org/cgi-bin/mailman/options/balug-talk>,
> <mailto:balug-talk-request@lists.balug.org?subject=unsubscribe>
> List-Archive: <https://lists.balug.org/pipermail/balug-talk/>
> List-Post: <mailto:balug-talk@lists.balug.org>
> List-Help: <mailto:balug-talk-request@lists.balug.org?subject=help>
> List-Subscribe:
> <https://lists.balug.org/cgi-bin/mailman/listinfo/balug-talk>,
> <mailto:balug-talk-request@lists.balug.org?subject=subscribe>
> Cc: BALUG-Talk <balug-talk(a)lists.balug.org>
> Content-Type: text/plain; charset="us-ascii"
> Content-Transfer-Encoding: 7bit
> Errors-To: balug-talk-bounces(a)lists.balug.org
> Sender: "BALUG-Talk" <balug-talk-bounces(a)lists.balug.org>
> X-SA-Do-Not-Run: Yes
> X-EximConfig: v2.5 on balug.org (http://www.jcdigita.com/eximconfig)
> X-SA-Exim-Connect-IP: 127.0.0.1
> X-SA-Exim-Mail-From: balug-talk-bounces(a)lists.balug.org
> X-SA-Exim-Scanned: No (on balug-sf-lug-v2.balug.org); SAEximRunCond
> expanded to false
>
> Ah, I recall times I participated in Installfest For The Schools, I
> think these guys were involved...
>
>
> On Fri, Jun 26, 2020 at 2:37 AM Michael Paoli
> <Michael.Paoli(a)cal.berkeley.edu> wrote:
> >
> > Also replied to 'em off-list regarding Partimus and such.
> >
> > references/excerpts:
> >
> > > From: "Michael Paoli" <Michael.Paoli(a)cal.berkeley.edu>
> > > To: "Cameron Abrams" <cameronabrams25(a)gmail.com>, "Christian
> > > Einfeldt" <christian(a)partimus.org>, "Grant Bowman"
> > > <grant(a)partimus.org>, "James Howard" <james(a)partimus.org>
> > > Cc: "Rick Moen" <rick(a)linuxmafia.com>
> > > Subject: Re: Company in Concord seeks to donate older PCs to a LUG
> > > Date: Fri, 26 Jun 2020 02:15:09 -0700
> >
> > > Cameron / Partimus folks, perhaps y'all ought connect. :-)
> > >
> > > I believe Partiums is (approximately?) based in(/around?) San Francisco,
> > > and also does / has done work with some East Bay (Oakland, if I
> > > recall correctly) school(s). I believe Grant is also out in East Bay,
> > > East of Concord.
> > >
> > > Also including link to list of lists (of [L]UGs), in case that's
> > > also useful.
> > >
> > > Thanks for reaching out and asking!
> > >
> > > http://www.partimus.org/
> > > http://www.partimus.org/contact.php
> > >
> > >
> https://www.wiki.balug.org/wiki/doku.php?id=balug:bay_area_open_source_linu…
> > >
> > > references/excerpts:
> > > http://linuxmafia.com/pipermail/dvlug/2020q2/000608.html
> > > http://linuxmafia.com/pipermail/dvlug/2020q2/000609.html
> > > https://groups.google.com/g/berkeleylug/c/Tr_WRg1STpI/m/qOZ_8bheCQAJ
> > > https://lists.balug.org/pipermail/balug-talk/2020-June/000213.html
> > >
> > >> From: "Rick Moen" <rick(a)linuxmafia.com>
> > >> To: dvlug(a)linuxmafia.com
> > >> Subject: [dvlug] Company in Concord seeks to donate older PCs to a LUG
> > >> Date: Thu, 25 Jun 2020 11:02:25 -0700
> > >
> > >> ----- Forwarded message from Cameron Abrams
> > >> <cameronabrams25(a)gmail.com> -----
> > >>
> > >> Date: Thu, 25 Jun 2020 09:28:39 -0700
> > >> From: Cameron Abrams <cameronabrams25(a)gmail.com>
> >
> >
> > > From rick(a)linuxmafia.com Thu Jun 25 18:11:04 2020
> > > Date: Thu, 25 Jun 2020 11:10:49 -0700
> > > From: Rick Moen <rick(a)linuxmafia.com>
> > > To: BALUG-Talk(a)lists.balug.org
> > > Subject: [BALUG-Talk] Company in Concord seeks to donate older
> PCs to a LUG
> > >
> > > ----- Forwarded message from Cameron Abrams
> <cameronabrams25(a)gmail.com> -----
> > >
> > > Date: Thu, 25 Jun 2020 09:28:39 -0700
> > > From: Cameron Abrams <cameronabrams25(a)gmail.com>
> > > To: dvlug-owner(a)linuxmafia.com
> > > Subject: Do you take donations?
> > >
> > > Hello,
> > >
> > > I am contacting you on behalf of the company I work for. We are
> located in
> > > Concord, and are in the midst of a transition. We would like to
> get rid of
> > > some older PCs we have replaced with newer ones, and we are in
> the midst of
> > > wiping all of our hard drives. We were wondering if perhaps this was a
> > > Linux group that took donations, as we would rather put the PCs
> to use than
> > > scrap them as e-waste. If you do accept donations and would like
> to discuss
> > > this matter further, or if you do not accept donations but do
> know of other
> > > local groups that accept donations, please email me back.
> > >
> > > Thanks,
> > >
> > > Cameron
> > >
> > > ----- End forwarded message -----
> >
> >
> > _______________________________________________
> > BALUG-Talk mailing list
> > BALUG-Talk(a)lists.balug.org
> > https://lists.balug.org/cgi-bin/mailman/listinfo/balug-talk
>
>
>
> --
> --
> Best Regards.
> This is unedited.
> This message came out of me
> via a suboptimal keyboard.
>
> _______________________________________________