DMARC report mailing list subscriber address leaks - cypherpunks - lists.cpunks.org

newer
SIGINT and improving wireless...

DMARC report mailing list subscriber address leaks

older
Re: Poitras joins Roark in pro se...

Seth

24 Jul 2015 24 Jul '15

10:16 p.m.

I don't know if many are aware of this (I discovered it by accident myself) but if you enable dmarc reports for your domain and mail server, you'll start to get reports back that include many lurker addresses on the Cypherpunks list. I can start posting them publicly if anyone's interested.

Reply

Sign in to reply online Use email software

Show replies by date

Shelley

24 Jul 24 Jul

10:28 p.m.

On July 24, 2015 3:23:33 PM Seth wrote:

I don't know if many are aware of this (I discovered it by accident myself) but if you enable dmarc reports for your domain and mail server, you'll start to get reports back that include many lurker addresses on the Cypherpunks list.

I can start posting them publicly if anyone's interested.

Nice find! Yes, it's been a while since JY posted a list of the addresses for posterity. I'm all in favor of it, before the spooks try to unsub. Anyone else? -s

Reply

Sign in to reply online Use email software

coderman

10:36 p.m.

On 7/24/15, Shelley wrote:

... I'm all in favor of it,

do it!

Reply

Sign in to reply online Use email software

odinn

25 Jul 25 Jul

12:49 a.m.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Yep. On 07/24/2015 03:16 PM, Seth wrote:

I don't know if many are aware of this (I discovered it by accident myself) but if you enable dmarc reports for your domain and mail server, you'll start to get reports back that include many lurker addresses on the Cypherpunks list.

I can start posting them publicly if anyone's interested.

- -- http://abis.io ~ "a protocol concept to enable decentralization and expansion of a giving economy, and a new social good" https://keybase.io/odinn -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJVst0QAAoJEGxwq/inSG8C+m0IAJ4aTnUJ8DAWzlBnnMhoyac1 AId1LHCAwWq+UueeeOHdMc6H+qwI01+Ys8niWfU2e5MLRHQhf5lE1mwr28vcgZpy AzTemDF6XO7an1KfTD4r8YLGc9PTNPQRqfG9EOg/+YQI4IpQvBv+KOz0nqBm3mPJ sNgoCo6wsf1UVtLw9sn3Xpw0vWSKsRzHa9YL7wSU+n0GO4RO9EXDmTNmXWAcXp9Z Fjd8F9OxrW3XQEsGpt3wfOp7a58dJYPvHQFh60jDi9oXQXxw1S8VpIn50NIitL1l 9TfO9wxEXDtDGf3kBL4zFX+WMsuXI57b1y6hxfp1fTSQHYuTvt1PXdN+Pr3nlSg= =rOPD -----END PGP SIGNATURE-----

Reply

Sign in to reply online Use email software

Seth

2:39 a.m.

OK, as requested, here's the first report from fastmail.fm <?xml version="1.0"?> -<feedback> - 7758186 FastMail Pty Ltd <email>dmarc@fastmail.com</email> https://fastmail.com/ - <begin>1437696000</begin> <end>1437782399</end> - <domain>sysfu.com</domain> <p>none</p> <sp>none</sp> <pct>100</pct> -<record> -<row> 209.85.160.181 <count>1</count> - <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </row> -<identifiers> resistentialist.com gmail.com sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> pass </dkim> -<spf> <domain>gmail.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 209.85.212.173 <count>2</count> - <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </row> -<identifiers> jeffhammett.com gmail.com sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> pass </dkim> -<spf> <domain>gmail.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 209.85.160.175 <count>2</count> - <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </row> -<identifiers> resistentialist.com gmail.com sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> pass </dkim> -<spf> <domain>gmail.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 212.227.17.20 <count>1</count> - <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </row> -<identifiers> segordon.net gmx.com sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> pass </dkim> -<spf> <domain>gmx.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 209.85.212.177 <count>1</count> - <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </row> -<identifiers> kvet.ch hellyeah.com sysfu.com </identifiers> - -<dkim> <domain>1e100.net</domain> <selector>20130820</selector> <result>fail</result> fail (message has been altered) </dkim> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> pass </dkim> -<spf> <domain>hellyeah.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 209.85.212.181 <count>2</count> - <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </row> -<identifiers> jeffhammett.com gmail.com sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>fail</result> fail (message has been altered) </dkim> -<spf> <domain>gmail.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 195.140.195.194 <count>3</count> - <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </row> -<identifiers> fastmail.fm cpunks.org sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> pass </dkim> -<spf> <domain>cpunks.org</domain> <scope>mfrom</scope> <result>permerror</result> </spf> </record> -<record> -<row> 195.140.195.194 <count>1</count> - <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </row> -<identifiers> fastmail.fm cpunks.org sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>fail</result> fail (message has been altered) </dkim> -<spf> <domain>cpunks.org</domain> <scope>mfrom</scope> <result>permerror</result> </spf> </record> -<record> -<row> 209.85.212.181 <count>1</count> - <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </row> -<identifiers> kvet.ch hellyeah.com sysfu.com </identifiers> - -<dkim> <domain>1e100.net</domain> <selector>20130820</selector> <result>fail</result> fail (message has been altered) </dkim> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> pass </dkim> -<spf> <domain>hellyeah.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 209.85.212.169 <count>1</count> - <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </row> -<identifiers> jeffhammett.com gmail.com sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> pass </dkim> -<spf> <domain>gmail.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 209.141.47.85 <count>51</count> - <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </row> -<identifiers> afflictions.org cpunks.org sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> pass </dkim> -<spf> <domain>cpunks.org</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 212.227.15.18 <count>1</count> - <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </row> -<identifiers> segordon.net gmx.com sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>fail</result> fail (message has been altered) </dkim> -<spf> <domain>gmx.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 209.141.47.85 <count>17</count> - <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </row> -<identifiers> afflictions.org cpunks.org sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>fail</result> fail (message has been altered) </dkim> -<spf> <domain>cpunks.org</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 212.227.15.18 <count>1</count> - <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </row> -<identifiers> segordon.net gmx.com sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> pass </dkim> -<spf> <domain>gmx.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 212.227.17.21 <count>1</count> - <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </row> -<identifiers> segordon.net gmx.com sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> pass </dkim> -<spf> <domain>gmx.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 209.85.212.178 <count>1</count> - <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </row> -<identifiers> kvet.ch hellyeah.com sysfu.com </identifiers> - -<dkim> <domain>1e100.net</domain> <selector>20130820</selector> <result>fail</result> fail (message has been altered) </dkim> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> pass </dkim> -<spf> <domain>hellyeah.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> -<record> -<row> 209.85.160.176 <count>1</count> - <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </row> -<identifiers> resistentialist.com gmail.com sysfu.com </identifiers> - -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>fail</result> fail (message has been altered) </dkim> -<spf> <domain>gmail.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </record> </feedback>

Reply

Sign in to reply online Use email software

Shelley

3:54 a.m.

Thanks. Interesting that I don't show up under .FM, I have my MX & DNS handled there. I'll mess around with this, thanks. -s ---------- On July 24, 2015 7:49:43 PM Seth wrote:

OK, as requested, here's the first report from fastmail.fm

<?xml version="1.0"?>

-<feedback>

-

7758186

FastMail Pty Ltd

<email>dmarc@fastmail.com</email>

https://fastmail.com/

-

<begin>1437696000</begin>

<end>1437782399</end>

-

<domain>sysfu.com</domain>

<p>none</p>

<sp>none</sp>

<pct>100</pct>

-<record>

-<row>

209.85.160.181

<count>1</count>

-

<disposition>none</disposition>

<dkim>pass</dkim>

<spf>fail</spf>

</row>

-<identifiers>

resistentialist.com

gmail.com

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>pass</result>

pass

</dkim>

-<spf>

<domain>gmail.com</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

209.85.212.173

<count>2</count>

-

<disposition>none</disposition>

<dkim>pass</dkim>

<spf>fail</spf>

</row>

-<identifiers>

jeffhammett.com

gmail.com

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>pass</result>

pass

</dkim>

-<spf>

<domain>gmail.com</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

209.85.160.175

<count>2</count>

-

<disposition>none</disposition>

<dkim>pass</dkim>

<spf>fail</spf>

</row>

-<identifiers>

resistentialist.com

gmail.com

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>pass</result>

pass

</dkim>

-<spf>

<domain>gmail.com</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

212.227.17.20

<count>1</count>

-

<disposition>none</disposition>

<dkim>pass</dkim>

<spf>fail</spf>

</row>

-<identifiers>

segordon.net

gmx.com

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>pass</result>

pass

</dkim>

-<spf>

<domain>gmx.com</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

209.85.212.177

<count>1</count>

-

<disposition>none</disposition>

<dkim>pass</dkim>

<spf>fail</spf>

</row>

-<identifiers>

kvet.ch

hellyeah.com

sysfu.com

</identifiers>

-

-<dkim>

<domain>1e100.net</domain>

<selector>20130820</selector>

<result>fail</result>

fail (message has been altered)

</dkim>

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>pass</result>

pass

</dkim>

-<spf>

<domain>hellyeah.com</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

209.85.212.181

<count>2</count>

-

<disposition>none</disposition>

<dkim>fail</dkim>

<spf>fail</spf>

</row>

-<identifiers>

jeffhammett.com

gmail.com

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>fail</result>

fail (message has been altered)

</dkim>

-<spf>

<domain>gmail.com</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

195.140.195.194

<count>3</count>

-

<disposition>none</disposition>

<dkim>pass</dkim>

<spf>fail</spf>

</row>

-<identifiers>

fastmail.fm

cpunks.org

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>pass</result>

pass

</dkim>

-<spf>

<domain>cpunks.org</domain>

<scope>mfrom</scope>

<result>permerror</result>

</spf>

</record>

-<record>

-<row>

195.140.195.194

<count>1</count>

-

<disposition>none</disposition>

<dkim>fail</dkim>

<spf>fail</spf>

</row>

-<identifiers>

fastmail.fm

cpunks.org

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>fail</result>

fail (message has been altered)

</dkim>

-<spf>

<domain>cpunks.org</domain>

<scope>mfrom</scope>

<result>permerror</result>

</spf>

</record>

-<record>

-<row>

209.85.212.181

<count>1</count>

-

<disposition>none</disposition>

<dkim>pass</dkim>

<spf>fail</spf>

</row>

-<identifiers>

kvet.ch

hellyeah.com

sysfu.com

</identifiers>

-

-<dkim>

<domain>1e100.net</domain>

<selector>20130820</selector>

<result>fail</result>

fail (message has been altered)

</dkim>

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>pass</result>

pass

</dkim>

-<spf>

<domain>hellyeah.com</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

209.85.212.169

<count>1</count>

-

<disposition>none</disposition>

<dkim>pass</dkim>

<spf>fail</spf>

</row>

-<identifiers>

jeffhammett.com

gmail.com

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>pass</result>

pass

</dkim>

-<spf>

<domain>gmail.com</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

209.141.47.85

<count>51</count>

-

<disposition>none</disposition>

<dkim>pass</dkim>

<spf>fail</spf>

</row>

-<identifiers>

afflictions.org

cpunks.org

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>pass</result>

pass

</dkim>

-<spf>

<domain>cpunks.org</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

212.227.15.18

<count>1</count>

-

<disposition>none</disposition>

<dkim>fail</dkim>

<spf>fail</spf>

</row>

-<identifiers>

segordon.net

gmx.com

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>fail</result>

fail (message has been altered)

</dkim>

-<spf>

<domain>gmx.com</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

209.141.47.85

<count>17</count>

-

<disposition>none</disposition>

<dkim>fail</dkim>

<spf>fail</spf>

</row>

-<identifiers>

afflictions.org

cpunks.org

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>fail</result>

fail (message has been altered)

</dkim>

-<spf>

<domain>cpunks.org</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

212.227.15.18

<count>1</count>

-

<disposition>none</disposition>

<dkim>pass</dkim>

<spf>fail</spf>

</row>

-<identifiers>

segordon.net

gmx.com

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>pass</result>

pass

</dkim>

-<spf>

<domain>gmx.com</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

212.227.17.21

<count>1</count>

-

<disposition>none</disposition>

<dkim>pass</dkim>

<spf>fail</spf>

</row>

-<identifiers>

segordon.net

gmx.com

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>pass</result>

pass

</dkim>

-<spf>

<domain>gmx.com</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

209.85.212.178

<count>1</count>

-

<disposition>none</disposition>

<dkim>pass</dkim>

<spf>fail</spf>

</row>

-<identifiers>

kvet.ch

hellyeah.com

sysfu.com

</identifiers>

-

-<dkim>

<domain>1e100.net</domain>

<selector>20130820</selector>

<result>fail</result>

fail (message has been altered)

</dkim>

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>pass</result>

pass

</dkim>

-<spf>

<domain>hellyeah.com</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

-<record>

-<row>

209.85.160.176

<count>1</count>

-

<disposition>none</disposition>

<dkim>fail</dkim>

<spf>fail</spf>

</row>

-<identifiers>

resistentialist.com

gmail.com

sysfu.com

</identifiers>

-

-<dkim>

<domain>sysfu.com</domain>

<selector>main</selector>

<result>fail</result>

fail (message has been altered)

</dkim>

-<spf>

<domain>gmail.com</domain>

<scope>mfrom</scope>

<result>pass</result>

</spf>

</record>

</feedback>

Reply

Sign in to reply online Use email software

stef

11:37 a.m.

On Fri, Jul 24, 2015 at 07:39:59PM -0700, Seth wrote:

OK, as requested, here's the first report from fastmail.fm

how many are there in total? can you post this in some less fuckd up way than this copypaste crap? are there some urls, that could be simply curled for example? thx,s -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

Reply

Sign in to reply online Use email software

Seth

7:25 p.m.

On Sat, 25 Jul 2015 04:37:47 -0700, stef wrote:

On Fri, Jul 24, 2015 at 07:39:59PM -0700, Seth wrote:

...
OK, as requested, here's the first report from fastmail.fm

how many are there in total?

I get a few each day. Mostly from hotmail, fastmail.fm, yahoo.com and google. Think I saw one form xs4all too but it didn't climb over ye olde greylisting wall.

can you post this in some less fuckd up way than this copypaste crap? are there some urls, that could be simply curled for example?

I heard you screamin', the copypasta was extremely lame, I'm forwarding to Shelley who volunteered to perform proper text processing/formatting after which the extracted contents will be posted to the list.

Reply

Sign in to reply online Use email software

stef

7:40 p.m.

On Sat, Jul 25, 2015 at 12:25:56PM -0700, Seth wrote:

On Sat, 25 Jul 2015 04:37:47 -0700, stef wrote:

...
can you post this in some less fuckd up way than this copypaste crap? are there some urls, that could be simply curled for example?

I heard you screamin', the copypasta was extremely lame, I'm forwarding to Shelley who volunteered to perform proper text processing/formatting after which the extracted contents will be posted to the list.

thanks :) -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

Reply

Sign in to reply online Use email software

3352

Age (days ago)

3353

Last active (days ago)

Download

8 comments

5 participants

tags

participants (5)

coderman
odinn
Seth
Shelley
stef