Re: JoeJobbed, I think

[Rich Kulawiec <rsk () gsp org>]

On Mon, Feb 11, 2013 at 08:39:08AM -0500, Jay Ashworth wrote:
> Well, FWIW, I never use anyone's on-platform forwarding service to send
> article URLs to *anywhere*, much less a mailing list, though curiously
> I think I *did* put a URL about a Google KC article in a posting last 
> week.  Don't remember if it was LAT or not.  Just the three postings, 
> right, Rich?

Yes, just the three.  Now that I'm more caffeinated, I noticed the
presence of X-SBRS: and X-HAT: headers in all three of those.  I wonder
if those are there because somebody's Cisco Ironport got its hands on
those messages and did something ill-advised with them.

Perhaps if the list-owners are listening in, they could check to see if
there are any NANOG subscribers from mnginteractive.com or
medianewsgroup.com; that might shed some light on what's happened here.

---rsk