Wierd Vertical SPAM of alt.religion.christian.boston-church
Catherine Hampton
We have a problem in alt.religion.christian.boston-church -- a
flood of vertical spam with varying From: lines, posted from
different locations, and with no common string to allow us to
killfile the slimeball.
The headers appear to be forged, and NNTP posting hosts don't match
Message IDs, which don't match From: lines. Usually the Path:
headers match the Message IDs. The majority of posting hosts/
sites appear to be European, and I recognize one as an open
NNTP server used in the past for spamming/net abuse.
Both headers and message text consists of a string of unrelated
English words, the majority long and somewhat complex. It appears
that the message was generated by a program using an English
dictionary, and working with an algorithm that rules out words less
than four characters long.
If this continues, it will be extremely difficult for users of
alt.religion.christian.boston-church to find their messages in
the midst of the garbage. You might want to check and see if
alt.religion.scientology has suffered a similar attack overnight;
this appears to be a more sophisticated vertical spam than
they've dealt with so far.
Could someone in news.admin.net-abuse.misc take a look at this
and help us come up with a way to killfile it or, if justified,
cancel it? Thank you!
Catherine
=-=-=-=-=-=-=-=-=-=
From nntp1.best.com!news1.best.com!newsfeed1.aimnet.com!newshub.internex.net!newshub1.internex.net!news.sprintlink.net!news-stk-11.sprintlink.net!news2.insinc.net!news.speedline.ca!news.newtrier.k12.il.us!agta164.cadvision.com!administrate!notoriety!net-3-107.austin.eden.com!SHENTEL.NET!news.cc.ukans.edu!news Mon Aug 5 08:16:54 1996
Newsgroups: alt.religion.christian.boston-church
Path: nntp1.best.com!news1.best.com!newsfeed1.aimnet.com!newshub.internex.net!newshub1.internex.net!news.sprintlink.net!news-stk-11.sprintlink.net!news2.insinc.net!news.speedline.ca!news.newtrier.k12.il.us!agta164.cadvision.com!administrate!notoriety!net-3-107.austin.eden.com!SHENTEL.NET!news.cc.ukans.edu!news
From: Rob.Ho...@galactica.it (Myron Sterile)
Subject: Sistine detestation shotgun
Message-ID: <19960805...@galactica.it>
Date: 5 Aug 1996 22:27:25 GMT
Organization: Yoke
NNTP-Posting-Host: hckyoung.demon.co.uk
Nntp-Posting-Host: bagend.atl.ga.us
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ACSII
Content-Transfer-Encoding: 7bit
Lines: 4
hem burette you'd dendrite versatec plot homologue Godwin barbarism
psychobiology perfuse macaque Serpens orthodox phycomycetes
coadjutor scriven supreme Coriolanus whish minim protrude cardamom
hyacinth wet shame habitant Somali bewitch intimal egghead nitrate
From nntp1.best.com!news1.best.com!news.sgi.com!nntp.coast.net!howland.reston.ans.net!newsfeed.internetmci.com!aldehyde.netone.com!news.sprintlink.net!news-fw-12.sprintlink.net!news2.insinc.net!news.speedline.ca!BIX.com!alb-nm1-18.ix.netcom.com!noc.netcom.net!shoji!icarus.cc.uic.edu!acmelabs.uhc.asu.edu!news.ttu.edu!news Mon Aug 5 08:17:07 1996
Newsgroups: alt.religion.christian.boston-church
Path: nntp1.best.com!news1.best.com!news.sgi.com!nntp.coast.net!howland.reston.ans.net!newsfeed.internetmci.com!aldehyde.netone.com!news.sprintlink.net!news-fw-12.sprintlink.net!news2.insinc.net!news.speedline.ca!BIX.com!alb-nm1-18.ix.netcom.com!noc.netcom.net!shoji!icarus.cc.uic.edu!acmelabs.uhc.asu.edu!news.ttu.edu!news
From: boom...@skylink.net (Crap)
Subject: Pterodactyl macroscopic Maltese
Message-ID: <h5dzMbW...@skylink.net>
Date: 5 Aug 1996 21:44:31 GMT
Organization: Capistrano
NNTP-Posting-Host: xp.psych.nyu.edu
Nntp-Posting-Host: bagend.atl.ga.us
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ACSII
Content-Transfer-Encoding: 7bit
Lines: 4
Berlitz irk molt Sanders guerdon initial motto onlooking smooth
radiogram Aubrey dunk dire allocate fruit vengeful betrayal
Vought cress lop formant variable white luminary Thimbu protest
von olfactory intermediary ladylike plunder evoke clash animosity
Follower of the Clawed Albino
(Posted and mailed due to the newsgroup flood.)
Thus spake Catherine Hampton (ar...@nntp.best.com) to the ether bunnies:
>
> We have a problem in alt.religion.christian.boston-church -- a
> flood of vertical spam with varying From: lines, posted from
> different locations, and with no common string to allow us to
> killfile the slimeball.
>
> The headers appear to be forged, and NNTP posting hosts don't match
> Message IDs, which don't match From: lines. Usually the Path:
> headers match the Message IDs. The majority of posting hosts/
> sites appear to be European, and I recognize one as an open
> NNTP server used in the past for spamming/net abuse.
>
> Both headers and message text consists of a string of unrelated
> English words, the majority long and somewhat complex. It appears
> that the message was generated by a program using an English
> dictionary, and working with an algorithm that rules out words less
> than four characters long.
Hmmmm...
It rather seems that NANAM has been hit by a very similar flood
(polymorphic, apparently is using a spell-checker dictionary to
randomly generate garbage, posted through open NNTP servers, forged
"Nntp-posting-host" of bagend.atl.ga.us).
Question regarding this that I have a feeling is going to be EXTREMELY
relevant regarding this net.abuse situation:
Have you been having problems with a person known as Sven or Goat,
posting from anus.com or loop.com?
> Could someone in news.admin.net-abuse.misc take a look at this
> and help us come up with a way to killfile it or, if justified,
> cancel it? Thank you!
Cancels are quite justified in this situation, and hopefully the spam
cancellers can catch it.
Incidentially:
Have any other Christian groups in alt.religion.* reported similar flooding
as of late?
--
-Windigo The Feral (NYAR!) |bleu|
Jihaddi, AHWW Cyberpack Member, Spam-Hunter and unrepentant fan of | () |
2000AD, Poison Elves and Lizzy Borden. ;) PGP Key upon request. | /\ |
Tie on a Blue Ribbon for Net.freedom--learn more at http://www.eff.org.
*Notice: Unsolicited commercial email is subject to archival fee of $200 US
per message--mailing denotes acceptance of these terms.* Rip the system.
Phil Launchbury
ar...@nntp.best.com (Catherine Hampton) wrote:
>
>We have a problem in alt.religion.christian.boston-church -- a
>flood of vertical spam with varying From: lines, posted from
>different locations, and with no common string to allow us to
>killfile the slimeball.
Yep - it has hit nanam as well - roughly 14K articles in the last 12 hours.
The only common denominator is that the posting host has been set to Jan
Isleys machine in Atlanta - probably as revenge for his legitimate
cancelling activities.
The name of the perp that springs to mind is Bob Allisat... It may not be,
but it has the same level of content and interest as the blank verse he
spams across Usenet :) He also has a long running (and on Bobs side)
bitter feud with Jan & Atlanta in general.
>If this continues, it will be extremely difficult for users of
>alt.religion.christian.boston-church to find their messages in
>the midst of the garbage. You might want to check and see if
Indeed it will - try finding the meat amongst 14000 worth of the gibberish!
>Could someone in news.admin.net-abuse.misc take a look at this
>and help us come up with a way to killfile it or, if justified,
>cancel it? Thank you!
It's being looked at - I think they picked the wrong bunch of people to
annoy!
Phil.
(Posted & emailed)
---------------------------------------------------------------------
Phil Launchbury Systems Engineer - Motorola ECID
laun...@ecid.cig.mot.com Swindon, Wilts, UK
Cats are the worlds highest lifeform
--------------------------------------------------------------------