Page MenuHomePhabricator

meta:Special:Contact/affcomusergroup being used to send spam to usergroup-applications@ mailing list
Closed, ResolvedPublic

Description

Please assist in blocking this person from sending anything to "usergroup-applications@lists.wikimedia.org" they somehow seem to have created an email address that is "noreply@wikimedia.org", anyhow I think this is a breach of some sort. Seee details of email below:


  • Forwarded message ----------

From: Jefferson Cardenas <noreply@wikimedia.org>
Date: Sun, Feb 4, 2018 at 5:47 PM
Subject: [Usergroup-applications] User group request: Jefferson Cardenas
To: Usergroups <usergroup-applications@lists.wikimedia.org>

Group name: Jefferson Cardenas
Group description: HOW TO MAKE 1 BTC FAST!

Here are instructions on how to make 1 BTC fast:

If you don't try it - you will never know.

There are 3 addresses listed below.

  1. 1G43bGRvb3rqLGmdYZBEJAg521bJ6Tukxj
  2. 1K2W4ykP1VWZqsmYgupvnuFQkjynVPTW7i
  3. 19hRsNTQ4XAMV29ngqndLBMmK9E4FMjJQh

Step 1: Send to the address at the top 0.0005 BTC.

Step 2: Now,... After sending 0.0005 BTC to #1 address above, take the #1
address off the list, move the next address up (3 becomes 2, 2 becomes 1)
and add Your address as number 3 on the list!

Step 3: Now start sending this ENTIRE post back out to people
Keep this post as close to the original as possible.
When 20 people receive it, those 20 people will move your address up to the
middle position and they will each send out 20.

That totals 400 people that will receive this post with your address in the middle.
Then, those 400 people will move your address up to the top and they will each send
out 20 posts.

That totals 8,000 people that will receive this post with your address at the top
and each will send you 0.0005 BTC.

8,000 people each sending you 0.0005btc = 4 BTC.
That's if everyone responds to this post, but not everyone will, so you can expect
more realistically to receive about 1BTC.

The more post you send out, the more cash you will receive
If each person sends out 100 E-mails, there will be 1,000,000
people that receive this letter when your name reaches the top.
If only 1% of those people respond, you will still get 1 BTC.

You do not need to re-type this entire letter to do your own posting. Simply
put your CURSOR at the beginning of this letter and drag your CURSOR to the
bottom of this document, and select 'copy' from the edit menu. This will
copy the entire letter into your computer's temporary memory.
Open a blank 'Notepad' file and place your cursor at the top of the blank
page. From the 'Edit' menu select 'Paste'. This will paste a copy of the
letter into notepad so that you can add your address to the list.
Save your new Notepad file as a .txt file. If you want to do your postings
in different settings, you'll always have this file to go back to.

PLEASE REMEMBER

This program remains successful because of the honesty and integrity of the
participants and by their carefully adhering to the directions.
Logo: Wikimedia community logo

Terms: Yes

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 7 2018, 10:29 AM
DNdubane_WMF updated the task description. (Show Details)Feb 7 2018, 10:30 AM
Reedy added a subscriber: Reedy.Feb 7 2018, 10:44 AM

I'm pretty sure they haven't created an account noreply@wikimedia.org, they're just spoofing it :)

Oh ok, I hope it can be fixed or prevented from continuing.

@DNdubane_WMF: Please provide full complete mail headers of such an email. You can drop the message body. Thanks.

Aklapper renamed this task from Jefferson Cardenas <noreply@wikimedia.org> {{SPAM}} to Help against spam by Jefferson Cardenas <noreply@wikimedia.org> on usergroup-applications@ mailing list.Feb 7 2018, 12:00 PM

This is what I got:

from: Jefferson Cardenas <noreply@wikimedia.org>
reply-to: Jefferson Cardenas <noreply@wikimedia.org>,
Affiliations Committee list for Wikimedia user group applications <usergroup-applications@lists.wikimedia.org>
to: Usergroups <usergroup-applications@lists.wikimedia.org>
date: Sun, Feb 4, 2018 at 5:47 PM
subject: [Usergroup-applications] User group request: Jefferson Cardenas
mailing list: usergroup-applications@lists.wikimedia.org Filter messages from this mailing list
mailed-by: lists.wikimedia.org
signed-by: lists.wikimedia.org
unsubscribe: Unsubscribe from this mailing-list
security: Standard encryption (TLS) Learn more
: Important according to our magic sauce.

We need full email headers. Above is not complete.
If you use GMail, see https://support.google.com/mail/answer/29436?hl=en

Delivered-To: dndubane@wikimedia.org
Received: by 10.37.131.206 with SMTP id v14csp1743521ybm;

Sun, 4 Feb 2018 07:47:49 -0800 (PST)

X-Google-Smtp-Source: AH8x227Rd+t6reGIduZGSo7S5hVXcQeoygyMTahGrPghKcuK6mo2myyhsTfqG10Uc3UFWezaTUcO
X-Received: by 10.55.145.193 with SMTP id t184mr18555913qkd.39.1517759269293;

Sun, 04 Feb 2018 07:47:49 -0800 (PST)

ARC-Seal: i=1; a=rsa-sha256; t=1517759269; cv=none;

d=google.com; s=arc-20160816;
b=RdeLn+K0jMphZi2lFbiczJlEXhv7LN2Wr1cS+voArnULVtcppzJM6+99xTHEkA37BT
 ey2v7nNdA2Wr+ZvSiOq/CW3IgqG4LXfHbRr48CTK8r1LnA/MxH+PHDa1BW/kjGNBlbFf
 U0RezzaNHtJmn5IhoUgiydRmTvpSJXuoOdIqLD2AXJTQLUx+0eQaByw77uslTYYOD7Fk
 C/mRY/Skqv/AgNcO93pgOHeZk+CXBLtLXO6cVGf2i3WXB8tDXEoVOW7engvcWu0Kmonf
 g2vAx5qd7tKRGt35wbmqz2mXaXFUe0Joh2Nzp2Na9BQ4l1DSwmZvMPRUPQzL3wrYnh/7
 r+Xw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;

h=sender:errors-to:content-transfer-encoding:reply-to:list-subscribe
 :list-help:list-post:list-archive:list-unsubscribe:list-id
 :precedence:subject:mime-version:message-id:date:from:to
 :dkim-signature:dkim-signature:arc-authentication-results;
bh=uCywhzavRJpBgVzzbiD44UnS0JxqfRLxMAUNdDKLe9M=;
b=z/q3OaKnl2c4HUupPJus6EAY0GJozREcRKWX0wurzZjnwl6YEBnvrlw6Uv0FyeoCG/
 +rOsebuAvjLzdpnhDI82iwKCdyIPNzhXHCjPeMuw/UQiTY9Xr2TT1wmppAOIRmxHsb+P
 FskirewbnBpdx66OXNTIm/W34h4Pv2TKBDuXJiwwhe7lMzTOU+TQjDX+VCEfJvVl50XO
 ufNSpVnwfbE3QzOTEj4csdt4pJCgnjDAtAcqr5ec9O4oxQXnJjoe9+XCvysrOZtVGEHe
 DhrWwvofell/ncZWgXFdrEzR6pYTYRE/WdR0d+OmLjcnoZfq+QAp6MxU6tmhrowBGwzt
 BXNw==

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@lists.wikimedia.org header.s=wikimedia header.b=n/jFU+TF;
dkim=neutral (body hash did not verify) header.i=@wikimedia.org header.s=wiki-mail header.b=MhtppCYw;
spf=pass (google.com: domain of usergroup-applications-bounces@lists.wikimedia.org designates 2620:0:861:1:208:80:154:21 as permitted sender) smtp.mailfrom=usergroup-applications-bounces@lists.wikimedia.org

Return-Path: <usergroup-applications-bounces@lists.wikimedia.org>
Received: from mx1001.wikimedia.org (mx1001.wikimedia.org. [208.80.154.76])

by mx.google.com with ESMTPS id z128si2189156qke.170.2018.02.04.07.47.48
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sun, 04 Feb 2018 07:47:49 -0800 (PST)

Received-SPF: pass (google.com: domain of usergroup-applications-bounces@lists.wikimedia.org designates 2620:0:861:1:208:80:154:21 as permitted sender) client-ip=2620:0:861:1:208:80:154:21;
Authentication-Results: mx.google.com;

dkim=pass header.i=@lists.wikimedia.org header.s=wikimedia header.b=n/jFU+TF;
dkim=neutral (body hash did not verify) header.i=@wikimedia.org header.s=wiki-mail header.b=MhtppCYw;
spf=pass (google.com: domain of usergroup-applications-bounces@lists.wikimedia.org designates 2620:0:861:1:208:80:154:21 as permitted sender) smtp.mailfrom=usergroup-applications-bounces@lists.wikimedia.org

Received: from lists.wikimedia.org ([2620:0:861:1:208:80:154:21]:56989) by mx1001.wikimedia.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from <usergroup-applications-bounces@lists.wikimedia.org>) id 1eiMWC-0005o8-Bg; Sun, 04 Feb 2018 15:47:48 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.wikimedia.org; s=wikimedia; h=Sender:Content-Transfer-Encoding:Content-Type:Reply-To:List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Subject:MIME-Version:Message-ID:Date:From:To; bh=uCywhzavRJpBgVzzbiD44UnS0JxqfRLxMAUNdDKLe9M=; b=n/jFU+TFzRdjS00wUxcSMXJp8cBadEqh21F8napZSzz1TBa2N/6SpNKB1AB60y+Q5s/Wd5rzBTtxfJIwxs4x0Gnu0xRYpPT+O4t8cFb/dz3zxTyhLhUVphDemyUAA4l9offo59bBJlPzzRHFWELTRjWtTccQRaOyYL+HotZ1au8=;
Received: from localhost ([::1]:57618 helo=fermium.wikimedia.org) by fermium.wikimedia.org with esmtp (Exim 4.84_2) (envelope-from <usergroup-applications-bounces@lists.wikimedia.org>) id 1eiMWB-0001sL-I1; Sun, 04 Feb 2018 15:47:47 +0000
Received: from wiki-mail-eqiad.wikimedia.org ([2620:0:861:3:208:80:154:91]:55981) by fermium.wikimedia.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from <wiki-metawiki-4ou8q-p3mujk-A26sPKLe+1kDR/Yy@wikimedia.org>) id 1eiMW9-0001s0-45 for usergroup-applications@lists.wikimedia.org; Sun, 04 Feb 2018 15:47:45 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=wikimedia.org; s=wiki-mail;

h=Content-transfer-encoding:Content-type:MIME-Version:List-Unsubscribe:Message-ID:Date:Reply-To:From:Subject:To; bh=nsBia+EXkECEIchppo3K5ItKaobwX+qZp6CiBbQKMWs=;
b=MhtppCYwgf55rGxi924L29j7MfFMdvadlyvbG3k2ws6Lfiybq53llbRGYBTpee9Da/7h/j7Ec3ji1+cp6W7SY8rxlaiFc2WAuLzyHMN7QpmAh33riD9lOviggOti/zyg9mhUZgjAM+kmMCwWruc8tt11Qz6WidgHxuWcLKlb5yI=;

Received: from [2620:0:861:103:1a66:daff:fe98:5f88] (port=48070 helo=mw1326.eqiad.wmnet) by mx1001.wikimedia.org with esmtp (Exim 4.84_2) (envelope-from <wiki-metawiki-4ou8q-p3mujk-A26sPKLe+1kDR/Yy@wikimedia.org>) id 1eiMW8-0005nl-TS for usergroup-applications@lists.wikimedia.org; Sun, 04 Feb 2018 15:47:44 +0000
Received: from www-data by mw1326.eqiad.wmnet with local (Exim 4.84_2) (envelope-from <wiki-metawiki-4ou8q-p3mujk-A26sPKLe+1kDR/Yy@wikimedia.org>) id 1eiMW8-0003l9-OI for usergroup-applications@lists.wikimedia.org; Sun, 04 Feb 2018 15:47:44 +0000
To: Usergroups <usergroup-applications@lists.wikimedia.org>
From: Jefferson Cardenas <noreply@wikimedia.org>
Date: Sun, 04 Feb 2018 15:47:44 +0000
Message-ID: <metawiki.5a772b20584713.41421863@meta.wikimedia.org>
X-Mailer: MediaWiki mailer
MIME-Version: 1.0
Subject: [Usergroup-applications] User group request: Jefferson Cardenas
X-BeenThere: usergroup-applications@lists.wikimedia.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: Affiliations Committee list for Wikimedia user group applications <usergroup-applications.lists.wikimedia.org>
List-Unsubscribe: https://lists.wikimedia.org/mailman/options/usergroup-applications,

<mailto:usergroup-applications-request@lists.wikimedia.org?subject=unsubscribe>

List-Archive: https://lists.wikimedia.org/mailman/private/usergroup-applications/
List-Post: <mailto:usergroup-applications@lists.wikimedia.org>
List-Help: <mailto:usergroup-applications-request@lists.wikimedia.org?subject=help>
List-Subscribe: https://lists.wikimedia.org/mailman/listinfo/usergroup-applications,

<mailto:usergroup-applications-request@lists.wikimedia.org?subject=subscribe>

Reply-To: Jefferson Cardenas <noreply@wikimedia.org>, Affiliations Committee list for Wikimedia user group applications <usergroup-applications@lists.wikimedia.org>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
Errors-To: usergroup-applications-bounces@lists.wikimedia.org
Sender: Usergroup-applications <usergroup-applications-bounces@lists.wikimedia.org>

R3JvdXAgbmFtZTogSmVmZmVyc29uIENhcmRlbmFzCkdyb3VwIGRlc2NyaXB0aW9uOiBIT1cgVE8g
TUFLRSAxIEJUQyBGQVNUIQoKSGVyZSBhcmUgaW5zdHJ1Y3Rpb25zIG9uIGhvdyB0byBtYWtlIDEg
QlRDIGZhc3Q6IAoKSWYgeW91IGRvbid0IHRyeSBpdCAtIHlvdSB3aWxsIG5ldmVyIGtub3cuIAoK
VGhlcmUgYXJlIDMgYWRkcmVzc2VzIGxpc3RlZCBiZWxvdy4KCjEpIDFHNDNiR1J2YjNycUxHbWRZ
WkJFSkFnNTIxYko2VHVreGoKMikgMUsyVzR5a1AxVldacXNtWWd1cHZudUZRa2p5blZQVFc3aQoz
KSAxOWhSc05UUTRYQU1WMjluZ3FuZExCTW1LOUU0Rk1qSlFoCgpTdGVwIDE6IFNlbmQgdG8gdGhl
IGFkZHJlc3MgYXQgdGhlIHRvcCAwLjAwMDUgQlRDLgoKU3RlcCAyOiBOb3csLi4uIEFmdGVyIHNl
bmRpbmcgMC4wMDA1IEJUQyB0byAjMSBhZGRyZXNzIGFib3ZlLCB0YWtlIHRoZSAjMQphZGRyZXNz
IG9mZiB0aGUgbGlzdCwgbW92ZSB0aGUgbmV4dCBhZGRyZXNzIHVwICgzIGJlY29tZXMgMiwgMiBi
ZWNvbWVzIDEpCmFuZCBhZGQgWW91ciBhZGRyZXNzIGFzIG51bWJlciAzIG9uIHRoZSBsaXN0IQoK
U3RlcCAzOiBOb3cgc3RhcnQgc2VuZGluZyB0aGlzIEVOVElSRSBwb3N0IGJhY2sgb3V0IHRvIHBl
b3BsZQpLZWVwIHRoaXMgcG9zdCBhcyBjbG9zZSB0byB0aGUgb3JpZ2luYWwgYXMgcG9zc2libGUu
CldoZW4gMjAgcGVvcGxlIHJlY2VpdmUgaXQsIHRob3NlIDIwIHBlb3BsZSB3aWxsIG1vdmUgeW91
ciBhZGRyZXNzIHVwIHRvIHRoZSAKbWlkZGxlIHBvc2l0aW9uIGFuZCB0aGV5IHdpbGwgZWFjaCBz
ZW5kIG91dCAyMC4KClRoYXQgdG90YWxzIDQwMCBwZW9wbGUgdGhhdCB3aWxsIHJlY2VpdmUgdGhp
cyBwb3N0IHdpdGggeW91ciBhZGRyZXNzIGluIHRoZSBtaWRkbGUuIApUaGVuLCB0aG9zZSA0MDAg
cGVvcGxlIHdpbGwgbW92ZSB5b3VyIGFkZHJlc3MgdXAgdG8gdGhlIHRvcCBhbmQgdGhleSB3aWxs
IGVhY2ggc2VuZCAKb3V0IDIwIHBvc3RzLgoKVGhhdCB0b3RhbHMgOCwwMDAgcGVvcGxlIHRoYXQg
d2lsbCByZWNlaXZlIHRoaXMgcG9zdCB3aXRoIHlvdXIgYWRkcmVzcyBhdCB0aGUgdG9wCmFuZCBl
YWNoIHdpbGwgc2VuZCB5b3UgMC4wMDA1IEJUQy4KCjgsMDAwIHBlb3BsZSBlYWNoIHNlbmRpbmcg
eW91IDAuMDAwNWJ0YyA9IDQgQlRDLgpUaGF0J3MgaWYgZXZlcnlvbmUgcmVzcG9uZHMgdG8gdGhp
cyBwb3N0LCBidXQgbm90IGV2ZXJ5b25lIHdpbGwsIHNvIHlvdSBjYW4gZXhwZWN0Cm1vcmUgcmVh
bGlzdGljYWxseSB0byByZWNlaXZlIGFib3V0IDFCVEMuCgpUaGUgbW9yZSBwb3N0IHlvdSBzZW5k
IG91dCwgdGhlIG1vcmUgY2FzaCB5b3Ugd2lsbCByZWNlaXZlCklmIGVhY2ggcGVyc29uIHNlbmRz
IG91dCAxMDAgRS1tYWlscywgdGhlcmUgd2lsbCBiZSAxLDAwMCwwMDAgCnBlb3BsZSB0aGF0IHJl
Y2VpdmUgdGhpcyBsZXR0ZXIgd2hlbiB5b3VyIG5hbWUgcmVhY2hlcyB0aGUgdG9wLiAKSWYgb25s
eSAxJSBvZiB0aG9zZSBwZW9wbGUgcmVzcG9uZCwgeW91IHdpbGwgc3RpbGwgZ2V0IDEgQlRDLgoK
WW91IGRvIG5vdCBuZWVkIHRvIHJlLXR5cGUgdGhpcyBlbnRpcmUgbGV0dGVyIHRvIGRvIHlvdXIg
b3duIHBvc3RpbmcuIFNpbXBseQpwdXQgeW91ciBDVVJTT1IgYXQgdGhlIGJlZ2lubmluZyBvZiB0
aGlzIGxldHRlciBhbmQgZHJhZyB5b3VyIENVUlNPUiB0byB0aGUKYm90dG9tIG9mIHRoaXMgZG9j
dW1lbnQsIGFuZCBzZWxlY3QgJ2NvcHknIGZyb20gdGhlIGVkaXQgbWVudS4gVGhpcyB3aWxsCmNv
cHkgdGhlIGVudGlyZSBsZXR0ZXIgaW50byB5b3VyIGNvbXB1dGVyJ3MgdGVtcG9yYXJ5IG1lbW9y
eS4KT3BlbiBhIGJsYW5rICdOb3RlcGFkJyBmaWxlIGFuZCBwbGFjZSB5b3VyIGN1cnNvciBhdCB0
aGUgdG9wIG9mIHRoZSBibGFuawpwYWdlLiBGcm9tIHRoZSAnRWRpdCcgbWVudSBzZWxlY3QgJ1Bh
c3RlJy4gVGhpcyB3aWxsIHBhc3RlIGEgY29weSBvZiB0aGUKbGV0dGVyIGludG8gbm90ZXBhZCBz
byB0aGF0IHlvdSBjYW4gYWRkIHlvdXIgYWRkcmVzcyB0byB0aGUgbGlzdC4KU2F2ZSB5b3VyIG5l
dyBOb3RlcGFkIGZpbGUgYXMgYSAudHh0IGZpbGUuIElmIHlvdSB3YW50IHRvIGRvIHlvdXIgcG9z
dGluZ3MKaW4gZGlmZmVyZW50IHNldHRpbmdzLCB5b3UnbGwgYWx3YXlzIGhhdmUgdGhpcyBmaWxl
IHRvIGdvIGJhY2sgdG8uCgpQTEVBU0UgUkVNRU1CRVIKClRoaXMgcHJvZ3JhbSByZW1haW5zIHN1
Y2Nlc3NmdWwgYmVjYXVzZSBvZiB0aGUgaG9uZXN0eSBhbmQgaW50ZWdyaXR5IG9mIHRoZQpwYXJ0
aWNpcGFudHMgYW5kIGJ5IHRoZWlyIGNhcmVmdWxseSBhZGhlcmluZyB0byB0aGUgZGlyZWN0aW9u
cy4KR3JvdXAgd2lraSBwYWdlOiAKR3JvdXAgbG9jYXRpb246IFdhZmZlbmJydW5uCkFjdGl2ZSBX
aWtpbWVkaWFuczogSE9XIFRPIE1BS0UgMSBCVEMgRkFTVCEKCkhlcmUgYXJlIGluc3RydWN0aW9u
cyBvbiBob3cgdG8gbWFrZSAxIEJUQyBmYXN0OiAKCklmIHlvdSBkb24ndCB0cnkgaXQgLSB5b3Ug
d2lsbCBuZXZlciBrbm93LiAKClRoZXJlIGFyZSAzIGFkZHJlc3NlcyBsaXN0ZWQgYmVsb3cuCgox
KSAxRzQzYkdSdmIzcnFMR21kWVpCRUpBZzUyMWJKNlR1a3hqCjIpIDFLMlc0eWtQMVZXWnFzbVln
dXB2bnVGUWtqeW5WUFRXN2kKMykgMTloUnNOVFE0WEFNVjI5bmdxbmRMQk1tSzlFNEZNakpRaAoK
U3RlcCAxOiBTZW5kIHRvIHRoZSBhZGRyZXNzIGF0IHRoZSB0b3AgMC4wMDA1IEJUQy4KClN0ZXAg
MjogTm93LC4uLiBBZnRlciBzZW5kaW5nIDAuMDAwNSBCVEMgdG8gIzEgYWRkcmVzcyBhYm92ZSwg
dGFrZSB0aGUgIzEKYWRkcmVzcyBvZmYgdGhlIGxpc3QsIG1vdmUgdGhlIG5leHQgYWRkcmVzcyB1
cCAoMyBiZWNvbWVzIDIsIDIgYmVjb21lcyAxKQphbmQgYWRkIFlvdXIgYWRkcmVzcyBhcyBudW1i
ZXIgMyBvbiB0aGUgbGlzdCEKClN0ZXAgMzogTm93IHN0YXJ0IHNlbmRpbmcgdGhpcyBFTlRJUkUg
cG9zdCBiYWNrIG91dCB0byBwZW9wbGUKS2VlcCB0aGlzIHBvc3QgYXMgY2xvc2UgdG8gdGhlIG9y
aWdpbmFsIGFzIHBvc3NpYmxlLgpXaGVuIDIwIHBlb3BsZSByZWNlaXZlIGl0LCB0aG9zZSAyMCBw
ZW9wbGUgd2lsbCBtb3ZlIHlvdXIgYWRkcmVzcyB1cCB0byB0aGUgCm1pZGRsZSBwb3NpdGlvbiBh
bmQgdGhleSB3aWxsIGVhY2ggc2VuZCBvdXQgMjAuCgpUaGF0IHRvdGFscyA0MDAgcGVvcGxlIHRo
YXQgd2lsbCByZWNlaXZlIHRoaXMgcG9zdCB3aXRoIHlvdXIgYWRkcmVzcyBpbiB0aGUgbWlkZGxl
LiAKVGhlbiwgdGhvc2UgNDAwIHBlb3BsZSB3aWxsIG1vdmUgeW91ciBhZGRyZXNzIHVwIHRvIHRo
ZSB0b3AgYW5kIHRoZXkgd2lsbCBlYWNoIHNlbmQgCm91dCAyMCBwb3N0cy4KClRoYXQgdG90YWxz
IDgsMDAwIHBlb3BsZSB0aGF0IHdpbGwgcmVjZWl2ZSB0aGlzIHBvc3Qgd2l0aCB5b3VyIGFkZHJl
c3MgYXQgdGhlIHRvcAphbmQgZWFjaCB3aWxsIHNlbmQgeW91IDAuMDAwNSBCVEMuCgo4LDAwMCBw
ZW9wbGUgZWFjaCBzZW5kaW5nIHlvdSAwLjAwMDVidGMgPSA0IEJUQy4KVGhhdCdzIGlmIGV2ZXJ5
b25lIHJlc3BvbmRzIHRvIHRoaXMgcG9zdCwgYnV0IG5vdCBldmVyeW9uZSB3aWxsLCBzbyB5b3Ug
Y2FuIGV4cGVjdAptb3JlIHJlYWxpc3RpY2FsbHkgdG8gcmVjZWl2ZSBhYm91dCAxQlRDLgoKVGhl
IG1vcmUgcG9zdCB5b3Ugc2VuZCBvdXQsIHRoZSBtb3JlIGNhc2ggeW91IHdpbGwgcmVjZWl2ZQpJ
ZiBlYWNoIHBlcnNvbiBzZW5kcyBvdXQgMTAwIEUtbWFpbHMsIHRoZXJlIHdpbGwgYmUgMSwwMDAs
MDAwIApwZW9wbGUgdGhhdCByZWNlaXZlIHRoaXMgbGV0dGVyIHdoZW4geW91ciBuYW1lIHJlYWNo
ZXMgdGhlIHRvcC4gCklmIG9ubHkgMSUgb2YgdGhvc2UgcGVvcGxlIHJlc3BvbmQsIHlvdSB3aWxs
IHN0aWxsIGdldCAxIEJUQy4KCllvdSBkbyBub3QgbmVlZCB0byByZS10eXBlIHRoaXMgZW50aXJl
IGxldHRlciB0byBkbyB5b3VyIG93biBwb3N0aW5nLiBTaW1wbHkKcHV0IHlvdXIgQ1VSU09SIGF0
IHRoZSBiZWdpbm5pbmcgb2YgdGhpcyBsZXR0ZXIgYW5kIGRyYWcgeW91ciBDVVJTT1IgdG8gdGhl
CmJvdHRvbSBvZiB0aGlzIGRvY3VtZW50LCBhbmQgc2VsZWN0ICdjb3B5JyBmcm9tIHRoZSBlZGl0
IG1lbnUuIFRoaXMgd2lsbApjb3B5IHRoZSBlbnRpcmUgbGV0dGVyIGludG8geW91ciBjb21wdXRl
cidzIHRlbXBvcmFyeSBtZW1vcnkuCk9wZW4gYSBibGFuayAnTm90ZXBhZCcgZmlsZSBhbmQgcGxh
Y2UgeW91ciBjdXJzb3IgYXQgdGhlIHRvcCBvZiB0aGUgYmxhbmsKcGFnZS4gRnJvbSB0aGUgJ0Vk
aXQnIG1lbnUgc2VsZWN0ICdQYXN0ZScuIFRoaXMgd2lsbCBwYXN0ZSBhIGNvcHkgb2YgdGhlCmxl
dHRlciBpbnRvIG5vdGVwYWQgc28gdGhhdCB5b3UgY2FuIGFkZCB5b3VyIGFkZHJlc3MgdG8gdGhl
IGxpc3QuClNhdmUgeW91ciBuZXcgTm90ZXBhZCBmaWxlIGFzIGEgLnR4dCBmaWxlLiBJZiB5b3Ug
d2FudCB0byBkbyB5b3VyIHBvc3RpbmdzCmluIGRpZmZlcmVudCBzZXR0aW5ncywgeW91J2xsIGFs
d2F5cyBoYXZlIHRoaXMgZmlsZSB0byBnbyBiYWNrIHRvLgoKUExFQVNFIFJFTUVNQkVSCgpUaGlz
IHByb2dyYW0gcmVtYWlucyBzdWNjZXNzZnVsIGJlY2F1c2Ugb2YgdGhlIGhvbmVzdHkgYW5kIGlu
dGVncml0eSBvZiB0aGUKcGFydGljaXBhbnRzIGFuZCBieSB0aGVpciBjYXJlZnVsbHkgYWRoZXJp
bmcgdG8gdGhlIGRpcmVjdGlvbnMuCkxvZ286IFdpa2ltZWRpYSBjb21tdW5pdHkgbG9nbwpUZXJt
czogWWVzCgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K
VXNlcmdyb3VwLWFwcGxpY2F0aW9ucyBtYWlsaW5nIGxpc3QKVXNlcmdyb3VwLWFwcGxpY2F0aW9u
c0BsaXN0cy53aWtpbWVkaWEub3JnCmh0dHBzOi8vbGlzdHMud2lraW1lZGlhLm9yZy9tYWlsbWFu
L2xpc3RpbmZvL3VzZXJncm91cC1hcHBsaWNhdGlvbnMK

Message ID <metawiki.5a772b20584713.41421863@meta.wikimedia.org>
Created at: Sun, Feb 4, 2018 at 5:47 PM (Delivered after 5 seconds)
From: Jefferson Cardenas <noreply@wikimedia.org>Using MediaWiki mailer
To: Usergroups <usergroup-applications@lists.wikimedia.org>
Subject: [Usergroup-applications] User group request: Jefferson Cardenas
SPF: PASS with IP 208.80.154.76 Learn more
DKIM: 'PASS' with domain lists.wikimedia.org Learn more

@DNdubane_WMF: To keep things more readable, could you consider using Markdown like three backticks (`) before and after a long quote, to avoid having some lines indented? :)
You could edit your comment T186691#3953497 via the dropdown next to it. (Also note the preview at the bottom when adding new comments.)

(T186691#3953504 does not look like actual raw headers, as things like "Learn more" look like copy&paste from some web interface (Gmail?) which lost links.)

Umm, anyone can fill out https://meta.wikimedia.org/wiki/Special:Contact/affcomusergroup to send an email to that group. You don't even have to be logged in.

The noreply@wikimedia.org is presumably the default email if the person has not filled out an email in their preferences.

Checkuser data confirms that the user was not logged in when sending this email.

The most obvious way to restrict spam coming in through that form would be to restrict it to logged in users.

Bawolff renamed this task from Help against spam by Jefferson Cardenas <noreply@wikimedia.org> on usergroup-applications@ mailing list to meta:Special:Contact/affcomusergroup being used to send spam to usergroup-applications@ mailing list.Feb 8 2018, 12:49 AM

cc'ing @Slaporte as based on T95789 it appears he knows more about the history of the contact page

This is the form that people fill out to submit an application to become a Wikimedia User Group. I don't see a problem with restricting the form to logged-in users, since having an active Wikimedian involved is part of the user group eligibility requirements.

I think the final decision should be up to @DNdubane_WMF and AffCom. If the form is updated, the user group guide should be updated too.

Thank you so much for diagnosing. I will discuss this with Affcom at this Sunday meeting and should be able to correct by Monday. Thanks, everyone.

Just following up on this - Does affcom need anything else done with this ticket? Or should it just be closed now that we have identified the cause?

Yes you can close the ticket

Aklapper closed this task as Resolved.Feb 22 2018, 4:26 PM
Bawolff changed the visibility from "Custom Policy" to "Public (No Login Required)".Feb 22 2018, 4:54 PM