X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: f996b,77eeafbfc4a4ce17 X-Google-Attributes: gidf996b,public X-Google-ArrivalTime: 2001-08-01 12:47:24 PST From: Bean Newsgroups: alt.ascii-art Subject: Re: Spam Date: Wed, 1 Aug 2001 20:47:03 +0100 Message-ID: References: <6usnfd9c6l.fsf@chonsp.franklin.ch> Organization: OWG X-Newsreader: MicroPlanet Gravity v2.30 Lines: 74 X-Original-NNTP-Posting-Host: 62.60.43.202 NNTP-Posting-Host: 10.250.101.2 X-Trace: 1 Aug 2001 20:47:18 GMT, 10.250.101.2 X-Report: Report abuse to nntpabuse@vip.uk.com Path: archiver1.google.com!newsfeed.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.icl.net!iclnet!news1.vip.uk.com Xref: archiver1.google.com alt.ascii-art:6851 In article <6usnfd9c6l.fsf@chonsp.franklin.ch>, neil@franklin.ch.remove gaily trilled... > spamblock@no.spam (Harry Mason) writes: > > Looking at: > > - the multiple (obviously faked) From: lines, which all look > like actual users accounts All of the ones that my newsfeed picked up are yahoo.com addresses. Is this something that all these messages have in common? > - The Followup to an newsgroup that discusses fighting email spammers > On about half of them. The others do not have a followup header, although all seem to either be crossposted to nanae or have followup to there. > I suspect this is a spammer who got shafted by some folks in that > group and is trying to get revenge by: > > - burrying the group in complaint replys Simon was looking over my shoulder when I read this, and laughed at this line. I don't know why. > - getting some of his opponents accounts killed for "spamming" > One possible motive. I would also add: - He is a troll. He merely wants to annoy everyone so much that its not worth the trouble sifting through his garbage posts, and they leave. Trolls love to drive people out of interesting groups. > > To get your back at this guy do this: > > - analyse his NNTP-Posting-Host: lines for the sending provider They're not all the same. The Path: and X-Complaints-to: lines all seem to match other posts from the same providers, so I'd guess either he has a lot of accounts with different people, or he's found some way to screw up these headers (not easy AFAIK). Also, he's using a lot of different newsreaders. The first few were all sent through OE, which made me immediately think of some kind of email virus firing off random messages to newsgroups. However, this doesn't seem so likely when there are so many different programs being used. [edit - since I wrote this, I just saw one that is PGP signed. A bit odd, for spam.] > - report the spams with explanation of the situation to the providers > - ask them to kill his net access AND CHARGE HIM CLEAN UP COSTS > > Clean up costs from enough providers will harm him financially so that > he will in the end stop. > > Happy spammer trashing. > > > -- > Neil Franklin, neil@franklin.ch.remove http://neil.franklin.ch/ > Hacker, Unix Guru, El Eng HTL/BSc, Sysadmin, Archer, Roleplayer > - Intellectual Property is Intellectual Robbery > -- Isuldir, Demon prince of spam (if you really want to know, ask) Death is great fun... You haven't lived until you've tried it. Newsfeed full of holes, please cc me a copy