Google Group Fail - To: root@mda.wombatsecurity.local

[Ryan!]

My repost was also very strange. I awoke to emails that I had written (and forgotten) as well. Here's the whole thread from Gmail using Forward All and an IP lookup of the purported sender. This to address is in several emails. I don't see a call to action or any different links. It's very strange. 

To: ro...@mda.wombatsecurity.local

Received: from dev01.wombatsecurity.com (c-24-131-84-205.hsd1.pa.comcast.net. [24.131.84.205])
        by mx.google.com with ESMTPS id gv4si5208437qab.95.2012.02.10.07.25.30
        (version=TLSv1/SSLv3 cipher=OTHER);
        Fri, 10 Feb 2012 07:25:31 -0800 (PST)

It looks like this IP is in Pittsburgh, perhaps in the University of Pittsburgh? Zoom all the way in.

http://www.geoiptool.com/en/?IP=24.131.84.205

==========================================

Forwarded conversation
Subject: Re: ALC Recovery Ride: Wed, 6/15 7:00am RRR Bayspresso Style 2 (Businessy, though)
------------------------

From: Scott Crosby <scr...@gmail.com>
Date: Tue, Jun 14, 2011 at 23:16
To: hs...@google.com
Cc: SF2G <sf...@googlegroups.com>, Ryan Mason <rma...@gmail.com>


ok you talked me into it.

let's get more Ryans on this ride. any out there?

-sc

On Tue, Jun 14, 2011 at 7:58 PM, Harrison Shih <hs...@google.com> wrote:
> +1
>
> On Jun 14, 3:03 pm, Ryan Anderson <r...@michonline.com> wrote:
>> For those of us who are itching to get back on the bike after a week of
>> riding (or those who just like to hang out with us), a normal 7am start for
>> a bayspresso.
>>
>> Businessy means: don't dally, work together (pacelining), regroups after
>> lights as needed (or, when within one strava segment distance of a standard
>> stop/regroup, at the stop, e.g. the water stop, BTN, Google), aiming for
>> 20-22ish on flats at speed, 17-18 overall, maybe pushing to 19 if everyone
>> who shows up is feeling energetic. (Mostly that's to defend my legs; while
>> they feel fine today, they got worked pretty hard last week, so I don't know
>> if I trust my energy levels entirely.)
>>
>> --
>> Ryan
>
> --
> store: http://sf2g.com/store.html | blog: http://blog.sf2g.com | terms: http://sf2g.com/terms.html | bike prep: http://sf2g.com/prep.html | unsub: http://groups.google.com/group/sf2g
>

----------
From: Scott Crosby <scr...@gmail.com>
Date: Fri, Feb 10, 2012 at 02:50
To: ro...@mda.wombatsecurity.local
Cc: SF2G <sf...@googlegroups.com>, Ryan Mason <rma...@gmail.com>


>> riding (or those who just like to hang out with us), a normal 7am start =
>> lights as needed (or, when within one strava segment distance of a stand=
>> 20-22ish on flats at speed, 17-18 overall, maybe pushing to 19 if everyo=
ne
>> who shows up is feeling energetic. (Mostly that's to defend my legs; whi=
le
>> they feel fine today, they got worked pretty hard last week, so I don't =
> store: http://sf2g.com/store.html | blog: http://blog.sf2g.com | terms: h=
ttp://sf2g.com/terms.html | bike prep: http://sf2g.com/prep.html | unsub: h=
ttp://groups.google.com/group/sf2g
>

--
store: http://sf2g.com/store.html | blog: http://blog.sf2g.com | terms: htt=
p://sf2g.com/terms.html | bike prep: http://sf2g.com/prep.html | unsub: htt=
p://groups.google.com/group/sf2g


----------
From: Scott Crosby <scr...@gmail.com>
Date: Fri, Feb 10, 2012 at 03:07
To: ro...@mda.wombatsecurity.local
Cc: SF2G <sf...@googlegroups.com>, Ryan Mason <rma...@gmail.com>

----------
From: Ryan Mason <ry...@euclidelements.com>
Date: Wed, Jun 15, 2011 at 06:24
To: "scr...@gmail.com" <scr...@gmail.com>
Cc: "hs...@google.com" <hs...@google.com>, SF2G <sf...@googlegroups.com>, Ryan Mason <rma...@gmail.com>


+1 Ryan!

----------
From: Ryan Mason <ry...@euclidelements.com>
Date: Fri, Feb 10, 2012 at 03:07
To: ro...@mda.wombatsecurity.local
Cc: "hs...@google.com" <hs...@google.com>, SF2G <sf...@googlegroups.com>, Ryan Mason <rma...@gmail.com>

+1 Ryan!

On Jun 14, 2011, at 23:16, Scott Crosby <scr...@gmail.com> wrote:

----------
From: Ryan! <rma...@gmail.com>
Date: Wed, Jun 15, 2011 at 10:52
To: Ryan Mason <ry...@euclidelements.com>
Cc: "scr...@gmail.com" <scr...@gmail.com>, "hs...@google.com" <hs...@google.com>, SF2G <sf...@googlegroups.com>


Good ride today. It definitely feels like summer. 

http://app.strava.com/rides/739735

[Ryan Anderson]

This seems a lot like someone, somewhere, has been infected and it's
spamming everyone. :(

I don't think this is Google Groups' fault, outside of the fact that
gmail doesn't block mail from @gmail coming from outside. (The
standard "mailing lists" problem makes that hard, of course.)

--
Ryan

[Scott Crosby]

yeah if someone's account was hacked, we could easily unsubscribe them from the group, but whose is it?  for some reason I'm getting tons of stuff from Eric, but I'm pretty sure his account isn't compromised.

[Ryan!]

Is it hitting the list? It looks to me like the list isn't forwarding these on, but I could be wrong. It looks like these are direct messages to all the named people on the list message, but not the list itself. 

[Ben Kochie]

Yea. We have a ticket open with a sre team to fix it