[Outages-discussion] [outages] not quite an outage, more a hack, "Urgent: Threat actor in systems" emails from FBI infrastructure

[Glenn McGurrin]

I can confirm that, I'm not sure what exactly the issue was, but my mail 
server kept generating a temporary error when sending to puck.nether.net 
with a read timeout.  Other mail before and after all is flowing well 
including one to nanog (aka another major mailing list, not just other 
user mailboxes), so it doesn't seem to be an issue purely on my end, 
though clearly other messages are working on the list, so it's not 
purely on the list's end.

I'm happy to cooperate in tracking down the bug that seems to be 
affecting the link between my server and the list, I actually had to 
manually kill the message to stop it from repeating more when I saw the 
multiple copies on my end (and I'll be monitoring this message to kill 
it if needed).

On 2021-11-13 12:29, Grant Taylor wrote:
> I'm re-routing my reply to outages-discussion instead of the original
> outages mailing list.  --  I'm CCing John in case he doesn't subscribe
> to outages-discussion.
> 
> On 11/13/21 9:56 AM, John Sage via Outages wrote:
>> Is anyone besides me now receiving three (or here four) identical 
>> posts to the list with identical time stamps?
> 
> Yes.
> 
> I received five copies of the message.  All of the messages had the
> same Message-ID.
> 
> Tracing the Received: headers, it seems like the message was a
> duplicate all the way up to mx00.postal00.hostinfr.com.  I see the
> first new (E)SMTP(S) id at puck.nether.net.
> 
> So, it seems to me like the duplication happened between
> ...hostinfr.com and ...nether.net.
> 
> I've not implemented a duplicate message ID filter for the Outages
> mailing list.  But perhaps I should.
> 
> 
> 
> _______________________________________________
> Outages-discussion mailing list
> Outages-discussion at outages.org
> https://puck.nether.net/mailman/listinfo/outages-discussion