[chirp_users] Malicious use of chirp_users email addresses

[Michael Rathbun]

I see between 600 and 1200 of those per day here at a tiny mail server,
some indeed with the address I use for this list.  

Most of the IP addresses you quote are listed on the CBL (blocking list for
hosts known to be taken over by malware, worldwide).  Several of the ones
from your list that I spot-checked are also being actively used in the fake
"take the survey and get a 300-piece tool set" variety of scam spams.  It
will be something different in a few weeks.

If any given mailing list or other discussion forum has a publicly
accessible archive, you can bet your bottom dollar that it is scraped
several times per day by list collector bots.

mdr

On Thu, 26 Oct 2023 12:30:15 -0700, Tim Lavoie
<tim_chirp at fractaldragon.net> wrote:

>Hello all, long-time lurker here.
>
>I have noticed that the list-specific email address that I use here, has
>been used in attempted logins to my email server.
>
>>From the last couple days, these login attempts have been showing up in
>my dovecot-related logs, from the following IPs:
>
>    103.181.14.250
>    103.251.143.14
[snip]