UDP: news-service.com
YottaNews Support
providing propagation of articles for news-service.com. This recent rash
of spam/KP spam has to be stopped.
[emailed to abuse@{all domains}]
Hello,
I, along with several others, have been monitoring the traffic originating
from news-service.com. It's clear that this is a rouge site and their
sole purpose is to propagate spam.
In the last 3 days alone 84334 articles of spam, mainly child porn, has
flowed into the Usenet news system from them. Abuse complaints have been
ignored and the abuse continues as I write this.
A log file of the abuse from just the last 3 days is available here:
http://www.usenetabuse.com/newsservice.log
Abuse on such a grand scale can not be ignored. All normal methods for
abuse handling have been tried in vain. At this point de-peering the
rouge server is required to protect the Usenet system.
At the current time it appears that the following Usenet sites are
propagating spam for news-service.com:
kabelfoon.nl
euro.net
netcologne.de
giganews.com
100proofnews.com
newshosting.com
xsnews.nl
A response announcing your position on the issue would be most welcome.
The unquestionable proof is in the log files, but if anyone requires
anything further let me know.
--
Steve
News Administrator
YottaNews.com/NNTPServer.com
YottaNews Support
>A message that you sent could not be delivered to one or more of its
>recipients. This is a permanent error. The following address(es) failed:
>
> ab...@xsnews.nl
Anyone have a working contact for the people who run feeder.xsnews.nl?
They peer with glorb.com.
Thanks.
yEncateer┊
Steve did you get my e-mail? I thought giganews had depeered them?
yEncateer┊
It looks like their best address is:
Administrative contact:
E.B. Veraart
+31 (0)30 6300691
e.ve...@xsnetworks.nl
and the below listed info
http://www.xsnetworks.nl/contact.htm
Contact
Adres Informatie
XS Networks BV
Hoogbloklandseweg 24
4205NE Gorinchem
Kamer van Koophandel 11055982
14.93.99.405 Rabobank te Geldrop
Telefoonnummers
Telefoon +31 30 63 00 691
Fax +31 30 63 00 692
E-mail adressen
Algemeen in...@xsnetworks.nl
Verkoop sa...@xsnetworks.nl
Abuse ab...@xsnetworks.nl
-----------------------------
Address lookup
canonical name xsnews.nl.
aliases
addresses 213.239.187.4
Domain Whois record
Queried whois.nic.nl with "xsnews.nl"...
Rights restricted by copyright. See
http://www.domain-registry.nl/whois.php
Domain name:
xsnews.nl (next domain)
Status: active
Registrant:
XS Networks B.V.
Hoogbloklandseweg 24
4205 NE GORINCHEM
Netherlands
Domicile:
N/A
Committed to ADR: yes
Administrative contact:
E.B. Veraart
+31 (0)30 6300691
e.ve...@xsnetworks.nl
Registrar:
XS Networks B.V.
Hoogbloklandseweg 24
4205 NE GORINCHEM
Netherlands
Technical contact:
E.B. Veraart
+31 (0)306300691
e.ve...@xsnetworks.nl
Domain nameservers:
ns1.xsnetworks.net 213.239.187.2
ns2.xsnetworks.net 213.193.235.150
Date registered: 14-12-2004
Record last updated: 14-12-2004
Record maintained by: NL Domain Registry
Network Whois record
Queried whois.ripe.net with "-B -G 213.239.187.4"...
% This is the RIPE Whois query server #1.
% The objects are in RPSL format.
%
% Note: the default output of the RIPE Whois server
% is changed. Your tools may need to be adjusted. See
% http://www.ripe.net/db/news/abuse-proposal-20050331.html
% for more details.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html
inetnum: 213.239.187.0 - 213.239.187.127
netname: NL-TRUESERVER-XS-NETWORKS
descr: Range assigned to XS Networks BV
country: NL
admin-c: TSAR1-RIPE
tech-c: TSTR1-RIPE
status: ASSIGNED PA
mnt-by: TRUESERVER-MNT
changed: sab...@trueserver.nl 20040610
source: RIPE
route: 213.239.176.0/20
descr: TrueServer BV
origin: AS15703
notify: ruben...@trueserver.nl
mnt-by: TRUESERVER-MNT
changed: ruben...@trueserver.nl 20020412
source: RIPE
role: Administrative role account
address: Trueserver B.V.
address: Cooperatiehof 16A
address: 1073 JR Amsterdam
phone: +31 20 3059750
fax-no: +31 20 3059751
e-mail: ripe-...@trueserver.nl
admin-c: TSPR1-RIPE
admin-c: TSSJ1-RIPE
tech-c: TSTR1-RIPE
nic-hdl: TSAR1-RIPE
notify: ripe-...@trueserver.nl
mnt-by: TRUESERVER-MNT
changed: maa...@trueserver.nl 20040828
source: RIPE
role: Technical role account
address: Trueserver B.V.
address: Cooperatiehof 16A
address: 1073 JR Amsterdam
phone: +31 20 3059750
fax-no: +31 20 3059751
e-mail: ripe...@trueserver.nl
admin-c: TSPR1-RIPE
admin-c: TSSJ1-RIPE
tech-c: TSVD1-RIPE
tech-c: JG1961-RIPE
tech-c: TSLL1-RIPE
tech-c: DWS-RIPE
nic-hdl: TSTR1-RIPE
notify: ripe-...@trueserver.nl
mnt-by: TRUESERVER-MNT
changed: maa...@trueserver.nl 20040928
source: RIPE
DNS records
DNS query for 4.187.239.213.in-addr.arpa returned an error from the
server: NameError
name class type data time to live
xsnews.nl IN SOA server: ns1.xsnetworks.net
email: root.xsnews.nl
serial: 2005062103
refresh: 7200
retry: 3600
expire: 1209600
minimum ttl: 86400
14400s (04:00:00)
xsnews.nl IN NS ns1.xsnetworks.net 14400s (04:00:00)
xsnews.nl IN NS ns2.xsnetworks.net 14400s (04:00:00)
xsnews.nl IN TXT v=spf1 a mx ip4:213.239.187.4 ~all 14400s (04:00:00)
xsnews.nl IN MX preference: 10
exchange: mail.xsnews.nl
14400s (04:00:00)
xsnews.nl IN A 213.239.187.4 14400s (04:00:00)
4.187.239.213.in-addr.arpa IN NS ns1.xsnetworks.net 86400s
(1.00:00:00)
4.187.239.213.in-addr.arpa IN NS ns2.xsnetworks.net 86400s
(1.00:00:00)
-- end --
yEncateer┊
<spam...@yottanews.com> wrote:
It looks like their best address is:
yEncateer┊
Contact addresses for the above listed domains:
kabelfoon.nl: n...@caiw.nl, ab...@caiw.nl, pee...@caiw.nl
giganews.com: ab...@giganews.com, sup...@giganews.com,
n...@giganews.com
xsnews.nl: ab...@xsnetworks.nl, e.ve...@xsnetworks.nl, in...@true.nl,
maa...@trueserver.nl
100proofnews.com: ab...@100proofnews.com, ab...@cogentco.com,
n...@cogentco.com, dc...@the-server.com, Acco...@100ProofNews.com
newshosting.com: sup...@newshosting.com, ab...@newshosting.com,
RAD...@siscom.net tf...@siscom.net, sup...@siscom.net
netcologne.de: ab...@netcologne.de, aes...@netcologne.de,
use...@netcologne.de.
I'm not sure about these
mad...@netcologne.de
mru...@netcologne.de
eba...@netcologne.de
ludger.b...@telekom.de
euro.net (www.nordnet.net): ab...@wanadoo.nl, domain...@EURO.NET,
hostm...@euro.net
Tom Perrett
>A log file of the abuse from just the last 3 days is available here:
>
>http://www.usenetabuse.com/newsservice.log
A cursory check shows that the posts seem
to be appropriate for the newsgroup to which
they were directed. Problem, I can't see it???
Tom
yEncateer┊
wrote:
>A cursory check shows that the posts seem
>to be appropriate for the newsgroup to which
>they were directed. Problem, I can't see it???
>
>Tom
How is child/teen porn binary billboards are appropriate for:
alt.binaries.pictures.erotica.latina
alt.binaries.pictures.erotica.redhead
alt.binaries.pictures.erotica.interracial
alt.binaries.pictures.erotica.black.females
alt.binaries.pictures.erotica.brunette
Tom Perrett
Are the teens in question of legal age, or
otherwise?
Tom
yEncateer┊
wrote:
>Are the teens in question of legal age, or
>otherwise?
>
>Tom
>
DEFINTELY minors.... however even if they were legal bulk spamming is
still not permissible
Here's a few headers
Path:
bigbe1.bellsouth.net!bigfeed.bellsouth.net!news.bellsouth.net!cycny01.gnilink.net!cyclone1.gnilink.net!gnilink.net!wn12feed!worldnet.att.net!216.196.98.141!border2.nntp.dca.giganews.com!border1.nntp.dca.giganews.com!border1.nntp.ams.giganews.com!border2.nntp.ams.giganews.com!nntp.giganews.com!feeder.news-service.com!post.news-service.com!news.usenext.de!not-for-mail
From: cus...@young-mod.com (ModMaker)
Sender: cus...@young-mod.com
Newsgroups:
alt.binaries.pictures.erotica.indian-asian,alt.binaries.pictures.erotica.koo.sisters,alt.binaries.pictures.erotica.latina
Subject: Young Model Lolitas [02/10]
YMUUU572.jpg (1/1)
Followup-To: http://www.young-mod.com
X-Newsposter: NNTP POWER-POST 2000 (Build 24c) - net-toys.8k.com
Message-ID: <539a6$42a1ae06$5084e0cd$10...@news.usenext.de>
X-Complaints-To: ab...@usenext.de
Organization: Aviteo Ltd
Date: Sat, 04 Jun 2005 15:35:02 +0200
Lines: 380
X-Trace: 539a642a1ae06f521456810084
Xref: bigfeed.bellsouth.net
alt.binaries.pictures.erotica.indian-asian:1313270
alt.binaries.pictures.erotica.koo.sisters:479239
alt.binaries.pictures.erotica.latina:2233346
---------------------------------------------------------------------------------------------------
Path:
bigbe2.bellsouth.net!bigfeed3.bellsouth.net!news.bellsouth.net!news-in.ntli.net!newsrout1-win.ntli.net!ntli.net!border2.nntp.ams.giganews.com!nntp.giganews.com!feeder.news-service.com!post.news-service.com!news.usenext.de!not-for-mail
From: Oleg V Makarov <ol...@got.mmtel.ru>
Newsgroups: alt.binaries.pictures.erotica.latina
Subject: YOUNG ANGELS - "702-001.jpg" yEnc (1/1)
X-Newsposter: YENC-POWER-POST-A&A-v13b (Modified POWER-POST
www.CosmicWolf.com)
X-No-Archive: yes
Message-ID: <d8bdd$42a5c491$d10815b2$19...@news.usenext.de>
X-Complaints-To: ab...@usenext.de
Organization: Aviteo Ltd
Date: Tue, 07 Jun 2005 18:00:17 +0200
Lines: 1165
X-Trace: d8bdd42a5c49174adb01701911
Xref: bigfeed.bellsouth.net
alt.binaries.pictures.erotica.latina:2235580
---------------------------------------------------------------------------------------------------
Path:
bigbe1.bellsouth.net!bigfeed3.bellsouth.net!news.bellsouth.net!news-in.ntli.net!newsrout1-win.ntli.net!news-out.ntli.net!newsrout1-gui.ntli.net!ntli.net!pe1.news.blueyonder.co.uk!blueyonder!pe2.news.blueyonder.co.uk!blueyonder!border2.nntp.ams.giganews.com!nntp.giganews.com!feeder.news-service.com!post.news-service.com!news.usenext.de!not-for-mail
From: Zherdev Anatoly <tol...@mx.ru>
Newsgroups: alt.binaries.pictures.erotica.latina
Subject: subject - "698-001.jpg" yEnc (1/1)
X-Newsposter: YENC-POWER-POST-A&A-v13b (Modified POWER-POST
www.CosmicWolf.com)
X-No-Archive: yes
Message-ID: <de3fc$42a57c04$d10815b2$32...@news.usenext.de>
X-Complaints-To: ab...@usenext.de
Organization: Aviteo Ltd
Date: Tue, 07 Jun 2005 12:50:44 +0200
Lines: 920
X-Trace: de3fc42a57c0474adb01732731
Xref: bigfeed.bellsouth.net
alt.binaries.pictures.erotica.latina:2235462
---------------------------------------------------------------------------------------------------
Path:
bigbe2.bellsouth.net!bigfeed3.bellsouth.net!news.bellsouth.net!news-in.ntli.net!newsrout1-win.ntli.net!ntli.net!border2.nntp.ams.giganews.com!nntp.giganews.com!feeder.news-service.com!post.news-service.com!news.usenext.de!not-for-mail
From: Oleg V Makarov <ol...@got.mmtel.ru>
Newsgroups: alt.binaries.pictures.erotica.latina
Subject: YOUNG ANGELS - "702-001.jpg" yEnc (1/1)
X-Newsposter: YENC-POWER-POST-A&A-v13b (Modified POWER-POST
www.CosmicWolf.com)
X-No-Archive: yes
Message-ID: <d8bdd$42a5c491$d10815b2$19...@news.usenext.de>
X-Complaints-To: ab...@usenext.de
Organization: Aviteo Ltd
Date: Tue, 07 Jun 2005 18:00:17 +0200
Lines: 1165
X-Trace: d8bdd42a5c49174adb01701911
Xref: bigfeed.bellsouth.net
alt.binaries.pictures.erotica.latina:2235580
---------------------------------------------------------------------------------------------------
Path:
bigbe1.bellsouth.net!bigfeed3.bellsouth.net!news.bellsouth.net!news-in.ntli.net!newsrout1-win.ntli.net!news-out.ntli.net!newsrout1-gui.ntli.net!ntli.net!pe1.news.blueyonder.co.uk!blueyonder!pe2.news.blueyonder.co.uk!blueyonder!border2.nntp.ams.giganews.com!nntp.giganews.com!feeder.news-service.com!post.news-service.com!news.usenext.de!not-for-mail
From: Zherdev Anatoly <tol...@mx.ru>
Newsgroups: alt.binaries.pictures.erotica.latina
Subject: subject - "698-001.jpg" yEnc (1/1)
X-Newsposter: YENC-POWER-POST-A&A-v13b (Modified POWER-POST
www.CosmicWolf.com)
X-No-Archive: yes
Message-ID: <de3fc$42a57c04$d10815b2$32...@news.usenext.de>
X-Complaints-To: ab...@usenext.de
Organization: Aviteo Ltd
Date: Tue, 07 Jun 2005 12:50:44 +0200
Lines: 920
X-Trace: de3fc42a57c0474adb01732731
Xref: bigfeed.bellsouth.net
alt.binaries.pictures.erotica.latina:2235462
Geoff Brozny
"YottaNews Support" <spam...@yottanews.com> wrote in message
news:1119674024.a6cc492a86a4ecf7ba6f73032230a4ed@yottanews...
> I've received a reply...
>
>>A message that you sent could not be delivered to one or more of its
>>recipients. This is a permanent error. The following address(es) failed:
>>
>> ab...@xsnews.nl
>
> Anyone have a working contact for the people who run feeder.xsnews.nl?
> They peer with glorb.com.
>
The only contact I have for them is newsmaster (at) xsnews.nl, I do not know
if the address still work, but it worked back in April of this year when I
setup our peer.
geoff
YottaNews Support
> If it is in fact KP, wouldn't contacting an LEA be the more appropriate
> thing to do?
The law enforcement aspect is totally separate. Regardless if your local
laws prohibit pictures of nude 8 year old kids in unnatural poses,
everyone agrees that spamming is not to be tolerated. Posting the same
URL branded pictures hundreds of times, to hundreds of newsgroups, can
not be allowed.
> This whole thing reeks to much of "I don't like what your users are
> posting so I'm going to call for a UDP". In other words, a form of
> censorship.
Have you bothered to review the logs? The >only< thing that is coming
from their server are the same advertisements for same web sites. Review
the logs and find five (5) non-spam messages of the hundred thousand
posted from their server in the last few days.
yEncateer┊
<b...@thedragons.lair> wrote:
>If it is in fact KP, wouldn't contacting an LEA be the more appropriate
>thing to do?
>
>This whole thing reeks to much of "I don't like what your users are
>posting so I'm going to call for a UDP". In other words, a form of
>censorship.
Kiddie Porn and network abuse are indeed two separate issues. When
Both Kiddie Porn and massive network abuse are condoned by a rogue
NNTP server/ISP (perhaps even protected) wouldn't it make sense too
not only report the abuser to proper authorities but to also target
the server that is permitting the abuse to repeatedly occur?
Dietmar Braun
> Contact addresses for the above listed domains:
Thank you for burning all these addresses. Thank your for all the abuse
staff of these ISPs having it much more harder to sort the complaints
from the crap. With this "tactics", you only achieve that the real
complaints (which we surely want to deal with) probably are ignored,
because nobody can find them in the crap any more...
Dietmar
Erik Warmelink
Sj <s...@NOTforMAIL.not> writes:
>>Thank you for burning all these addresses. Thank your for all the abuse
>>staff of these ISPs having it much more harder to sort the complaints
>>from the crap. With this "tactics", you only achieve that the real
>>complaints (which we surely want to deal with) probably are ignored,
>>because nobody can find them in the crap any more...
>>
>>Dietmar
>
> I think most of us recognize the fact that abuse
> departments get a lot of complaints so are careful
> to file only legit abuse complaints...
Dietmar wasn't talking about complaints (legit or otherwise), I guess.
> A lot of the info yEncateer provided is available
> on the web or from doing a WHOIS...I know I do
> my homework before filing an abuse complaint...
Viruses and most spammers won't bother about that, they will just
search the drives or usenet for anything containing a "@".
Jab...@excite.com
Dont see you writing UDP against Shared-secrets.com
or any other free newsserver Like aioe, and X-privat.
they all picked up a cyberstalker: wind...@direcpc.org
aka Carcklin' aka Reel Mckoi.
You guys offer free newsserver service to begin with. And your greatest
customer are those who are interested in Porn.
Direcpc allowed their server to post child porn drawing on rec.ponds
Your UDP is moot.
yEncateer┊
>Kettle calls Pot Black.
>
>Dont see you writing UDP against Shared-secrets.com
>or any other free newsserver Like aioe, and X-privat.
>
>they all picked up a cyberstalker: wind...@direcpc.org
>
>aka Carcklin' aka Reel Mckoi.
>
>You guys offer free newsserver service to begin with. And your greatest
>customer are those who are interested in Porn.
>
>Direcpc allowed their server to post child porn drawing on rec.ponds
>
>Your UDP is moot.
When I see them bulk spamming it on the same massive apoplectic scale
as news-server was I'll be the first one in line writing complaints.
I haven't seen any shared-secrets spam. Never even heard of it.
It sounds as if your upset because of an isolated spam situation.
why don't you post some headers... some whois info
Jab...@excite.com
yEncateer©® wrote:
> I haven't seen any shared-secrets spam. Never even heard of it.
You haven't seen it, because you don't know where to look, and it is
not affecting you. If it did. You would be writing about them. Do a
search on
Shared-secrets Intent UDP.
have fun.
YottaNews Support
> Kettle calls Pot Black.
>
> Dont see you writing UDP against Shared-secrets.com or any other free
> newsserver Like aioe, and X-privat.
Grow up. You sound like a cry-baby.
"If you catch yourself saying, 'someone should do something about this',
that someone should be you."
BTW- I just saw, npeer.de.kpn-eurorings.net!feeder.news-service.com flow
by. Does kpn-eurorings.net stand for kiddy porn network (euro edition)?
As you can see, I'm fighting a loosing battle. If you want your own
loosing battle, go for it, but don't get me involved as I already have
several.
:)
yEncateer┊
>You haven't seen it, because you don't know where to look, and it is
>not affecting you. If it did. You would be writing about them. Do a
>search on
>
>Shared-secrets Intent UDP.
>
>have fun.
No thanks....
yEncateer┊
>You're replying to a fucknut who posts through Google with a different
>reply address each week.
>
Thanks I just gathered I was dealing with a troll and plonked him
Gunther Nitzsche
> The following email has been sent to all news providers that are currently
> providing propagation of articles for news-service.com. This recent rash
> of spam/KP spam has to be stopped.
>
> [emailed to abuse@{all domains}]
news-service.com has reacted in diffferent ways. The email-contact
I had was fast, efficient and competent.
A new abuse-policy was created and published by them:
http://www.news-service.com/doc/abuse-statement.pdf
Let's hope, at least this spamming has indeed stopped.
best greetings,
Gunther
--
Gunther Nitzsche | IRC: MotoGuzzi
| MUD,Netrek: Cedric
| HAM: DH1KAT
It never can be that bad, that it can´t get worse...
yEncateer┊
<burn...@netcologne.de> wrote:
>news-service.com has reacted in diffferent ways. The email-contact
>I had was fast, efficient and competent.
>A new abuse-policy was created and published by them:
>http://www.news-service.com/doc/abuse-statement.pdf
>
>Let's hope, at least this spamming has indeed stopped.
>
>best greetings,
>Gunther
It's been pretty quite the last few days. I haven't seen any
news-service.com on my service for two or three days now. It all
seemed to dry up at once
Howard Knight
Are you nuts? Since when was flooding the newsgroups with ads
appropriate for _any_ newsgroup? Regardless of what the pictures
are of, it is pure spam, plain and simple.
Howard