atompub.org seems to have been hacked

Tim Bray <twbray@google.com> Sun, 08 May 2011 15:49 UTC

Return-Path: <owner-atom-syntax@mail.imc.org>
X-Original-To: ietfarch-atompub-archive@ietfa.amsl.com
Delivered-To: ietfarch-atompub-archive@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9ED4DE0789 for <ietfarch-atompub-archive@ietfa.amsl.com>; Sun, 8 May 2011 08:49:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.976
X-Spam-Level:
X-Spam-Status: No, score=-105.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vRWmzPwLQuaG for <ietfarch-atompub-archive@ietfa.amsl.com>; Sun, 8 May 2011 08:49:25 -0700 (PDT)
Received: from hoffman.proper.com (IPv6.Hoffman.Proper.COM [IPv6:2001:4870:a30c:41::81]) by ietfa.amsl.com (Postfix) with ESMTP id D1074E068C for <atompub-archive@ietf.org>; Sun, 8 May 2011 08:49:24 -0700 (PDT)
Received: from hoffman.proper.com (localhost [127.0.0.1]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id p48Fg4nf053987 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 8 May 2011 08:42:04 -0700 (MST) (envelope-from owner-atom-syntax@mail.imc.org)
Received: (from majordom@localhost) by hoffman.proper.com (8.14.4/8.13.5/Submit) id p48Fg4sj053986; Sun, 8 May 2011 08:42:04 -0700 (MST) (envelope-from owner-atom-syntax@mail.imc.org)
X-Authentication-Warning: hoffman.proper.com: majordom set sender to owner-atom-syntax@mail.imc.org using -f
Received: from smtp-out.google.com (smtp-out.google.com [216.239.44.51]) by hoffman.proper.com (8.14.4/8.14.3) with ESMTP id p48Fg3h1053978 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for <atom-syntax@imc.org>; Sun, 8 May 2011 08:42:04 -0700 (MST) (envelope-from twbray@google.com)
Received: from hpaq3.eem.corp.google.com (hpaq3.eem.corp.google.com [172.25.149.3]) by smtp-out.google.com with ESMTP id p48Fg2aa030074 for <atom-syntax@imc.org>; Sun, 8 May 2011 08:42:03 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1304869323; bh=PRZY6bmOKnFd6ZUGikf3vjUUKXg=; h=MIME-Version:From:Date:Message-ID:Subject:To:Content-Type; b=O2uKK9Wt2MJEF4HAJY0pUhmo/AMa61qO1EdHAgBq4fd9aQP3wQcuQRRA2zTgxOhMl ELsDvGONMS+WYx3LjZUvg==
Received: from ewy28 (ewy28.prod.google.com [10.241.103.28]) by hpaq3.eem.corp.google.com with ESMTP id p48Fg1nJ027022 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <atom-syntax@imc.org>; Sun, 8 May 2011 08:42:01 -0700
Received: by ewy28 with SMTP id 28so1399758ewy.25 for <atom-syntax@imc.org>; Sun, 08 May 2011 08:42:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=domainkey-signature:mime-version:from:date:message-id:subject:to :content-type; bh=XLs5Ba4cjUqBXY80Kb87vemruUxdsmcn2Xm9HWeFIQ0=; b=Xw1txqRGH/+i4Xq7ikMZfQ3EdFrti+SImUAykMttA2i1vV0TKxA89Xiez9OV0oUU7+ h4zEvKu2rUcu3vom9J7g==
DomainKey-Signature: a=rsa-sha1; c=nofws; d=google.com; s=beta; h=mime-version:from:date:message-id:subject:to:content-type; b=X/wzQkmhe3RTTq0STWRHAAyzqj14dtN7qA3SkJq+Mr6tsVqqw45F22JIQ3LuqjHeni AZMmRemZFB/1f3472A4g==
Received: by 10.213.96.71 with SMTP id g7mr718652ebn.69.1304869320400; Sun, 08 May 2011 08:42:00 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.213.35.81 with HTTP; Sun, 8 May 2011 08:41:30 -0700 (PDT)
From: Tim Bray <twbray@google.com>
Date: Sun, 08 May 2011 08:41:30 -0700
Message-ID: <BANLkTinP5Mi9yhw02aywf3LBFUNzrbzRbA@mail.gmail.com>
Subject: atompub.org seems to have been hacked
To: atom-syntax@imc.org
Content-Type: multipart/alternative; boundary="00504502c6dc5221b104a2c59005"
X-System-Of-Record: true
Sender: owner-atom-syntax@mail.imc.org
Precedence: bulk
List-Archive: <http://www.imc.org/atom-syntax/mail-archive/>
List-Unsubscribe: <mailto:atom-syntax-request@imc.org?body=unsubscribe>
List-ID: <atom-syntax.imc.org>

Check the footer.

Oh, hold on... http://www.networksolutions.com/whois-search/atompub.org

I suspect the domain have lapsed, etc  -T