April Cancel report
Chris Lewis
-----BEGIN PGP SIGNED MESSAGE-----
According to Robert's statistics, he generated roughly 250,000 cancels.
This site only saw 150,000 of them. This can be explained in two
ways - if someone else's cancel got here first (including mine), it
wouldn't be counted. Further, Robert receives rather more groups
than I do.
Lysander Spooner is in 3rd, once you combine his three different entries.
The heimdall cancels appear to be primarily ba.* and sbay.* policy
enforcement - when I looked a couple of weeks ago. I'm not sure whether
the fact that he has both "PM" and fully-standard cancels means that
he's switched to cyberspam-compliant cancels since then, or that he's
doing both ordinary spams and ba.*/sbay.* now.
Cancels as seen from this site. All email addresses shown in this table
appear to the program to be spam cancels, based upon the presence of
one or more spam cancel standard indicators. There are three indicators:
"!cyberspam!" in path, "cancel." messageid prefix, and the inclusion of
an X-Cancelled-By: header.
All despammers should look for their entry in this table and see if there
are flags beside your email address. If there are, please fix your
cancels ASAP.
Any email address indicated with a "-" is known to be a rogue canceller.
The email address is the best guess as to where it was injected.
Email addresses marked with "*" are known to be ISPs issuing cancels
for their own users, but use a different spam cancellation convention.
In the absence of a X-Cancelled-By: line, the email address is usually
generated by the right-most dotted-domain address in the path plus
the userid at the far right end. Thus, for example, part of the
cancelbomb generated by a user on cottagesoft is charged to galstar
(first wave of cancellations injected at galstar), and part to UUNET
(remainder injected into UUNET).
Spam cancels performed by users appearing to be usenet@site or news@site
are likely to have been performed by the administration of the system.
Entries with a very low count (1 or 2) can be the result of a software
glitch, and shouldn't be taken too seriously.
Keys:
B Missing X-Cancelled-By
P Missing/malformed !cyberspam!
M Missing/malformed <cancel. Message-Id prefix
- - Known illicit/rogue cancel
* Entirely non-standard, but known ISP cancellations
[Lysander is in 3rd once you combine his three addresses.]
Canceller Count %Total
mike 10 0.00
HVK(P) 10 0.00
ne...@news.istar.net(PB) 10 0.00
ne...@news.interpac.be(PB) 10 0.00
pl-can...@ict.pwr.wroc.pl(PB) 10 0.00
ro...@sledge.phiger.com(PM) 11 0.00
ro...@gonzo.tamu.edu(PB) 11 0.00
le...@cosy.sbg.ac.at 11 0.00
James 11 0.00
Ryan(P) 11 0.00
use...@geraldo.cc.utexas.edu(B) 12 0.00
h...@seneca.muc.de(PM) 12 0.00
Down.(P) 12 0.00
<br...@cerberus.csd.uwm.edu> 12 0.00
g...@snet.net(P) 12 0.00
al...@mattress.atww.org(P) 12 0.00
cant...@rintintin.Colorado.EDU 13 0.00
Russ 13 0.00
szie...@pbi.net(P) 14 0.00
not-fo...@news.latnet.lv(PB) 14 0.00
da...@muddy.mojo.org(P) 15 0.00
Andrew(P) 15 0.00
sjk...@crl.com 15 0.00
awha...@csclub.uwaterloo.ca(P) 16 0.00
use...@in2.delta.net(B) 16 0.00
Gabriel(PM) 16 0.00
not-fo...@nntp2.ba.best.com(PB) 16 0.00
uns...@gwu.edu(PB) 19 0.00
jo...@iecc.com(P) 19 0.00
ari...@taronga.com 20 0.00
mi...@scrum.muc.de 20 0.00
news-mai...@newsfeed.wu-wien.ac.at(PB) 21 0.00
use...@daily-bugle.newsops.execpc.com(P) 23 0.00
tski...@uiuc.edu(PM) 23 0.00
not-fo...@news.cc.ic.ac.uk(B) 24 0.00
cwil...@boink.clark.net 24 0.00
PCo...@Harris.com(P) 25 0.00
ba...@math.psu.edu 25 0.00
sjk...@crl.com(P) 27 0.01
post...@dejanews.com(P) 27 0.01
Ron(P) 28 0.01
jdm...@stc.net(P) 28 0.01
Alain.T...@alma.fr 28 0.01
ne...@flora.org(P) 29 0.01
ne...@news.chanae.stben.be 31 0.01
canc...@mycro.net(P) 31 0.01
twbbs...@netnews.csie.nctu.edu.tw(PB) 32 0.01
jer...@exit109.com(P) 33 0.01
n...@nataa.fr.eu.org 33 0.01
use...@199.172.62.14(B) 34 0.01
lau...@anet.fr(P) 34 0.01
d...@enquirer.adobe.com(PB) 34 0.01
ne...@pitt.edu(P) 35 0.01
jmkn...@quipu.redhat.com 36 0.01
canc...@taronga.com 38 0.01
sjk...@crl.com(M) 38 0.01
newsm...@demon.net(M) 40 0.01
d...@adobe.com 42 0.01
star...@umr.edu(P) 43 0.01
use...@newspump.sol.net(P) 44 0.01
how...@connectnet.com 47 0.01
Cernovog(PM) 48 0.01
not-fo...@news.nic.com(B) 51 0.01
heim...@oriole.sbay.org(P) 52 0.01
not-fo...@news.cs.su.oz.au(PB) 53 0.01
ne...@mattress.atww.org 55 0.01
Alex(P) 55 0.01
not-fo...@fr.net(PB) 61 0.01
rol...@spinnaker.rhein.de 62 0.01
a...@a3.xs4all.nl 62 0.01
mbar...@lear35.cytex.com 63 0.01
sang...@digifix.com(P) 68 0.01
twfi...@netnews.csie.nctu.edu.tw(PB) 70 0.01
e...@marco.korax.com(PB) 70 0.01
sin...@cadrus.fr 71 0.01
Spam...@spamfree.com 72 0.01
j...@xpat.com 73 0.01
ne...@nortel.ca(P) 74 0.01
kr...@koehntopp.de 76 0.02
New...@eerie.fr 79 0.02
ne...@cmc.net 86 0.02
use...@news.euro.net(PB) 100 0.02
ed...@xenitec.on.ca 110 0.02
ne...@freenet.carleton.ca 111 0.02
p...@freenix.fr 117 0.02
ne...@tpgi.com.au(P) 118 0.02
abp...@redpoll.mrfs.oh.us 123 0.02
canc...@mycro.net 124 0.02
wkro...@cts.com(PM) 124 0.02
dk...@cs.stanford.edu 128 0.03
ne...@prodigy.com* 135 0.03
binc...@dcns.csc.cuhk.edu.hk 164 0.03
edm...@cs.ubc.ca 178 0.04
not-fo...@newsgate.duke.edu(MB) 187 0.04
tr...@lyssa.owl.de 189 0.04
secu...@primenet.com 250 0.05
hh...@accessus.com(P) 270 0.05
ch...@unicom.com 275 0.05
not-fo...@news.rhrz.uni-bonn.de(PB) 289 0.06
bo...@pi.net 311 0.06
SpamC...@pobox.com 339 0.07
a...@azuret.alma.fr 356 0.07
han...@sub-rosa.com 372 0.07
lega...@xmission.com 421 0.08
not-fo...@jaring.my 426 0.08
g...@bby.com.au 428 0.08
ne...@newsfeed.concentric.net(PB) 432 0.09
hwe...@berlin.snafu.de(M) 439 0.09
lysa...@easyway.net(P) 443 0.09
ro...@127.0.0.1(P) 455 0.09
ach...@mmc.et.tudelft.nl(P) 533 0.11
fi...@toby.han.de 560 0.11
how...@iswest.com(P) 583 0.12
not-fo...@riemann.iam.uni-bonn.de(PB) 616 0.12
da...@good.net 691 0.14
mmfc...@stopspam.org 797 0.16
ab...@mindspring.com 801 0.16
bounc...@ix.netcom.com(PB) 808 0.16
o...@sn.no(P) 1084 0.21
canc...@news.transbay.net(P) 1098 0.22
Bob(M) 1209 0.24
r...@redpoll.mrfs.oh.us 1283 0.25
gr...@loose.apana.org.au 1619 0.32
hh...@accessus.com 1646 0.33
ot...@cc.jyu.fi 1650 0.33
bo...@keltia.freenix.fr 1809 0.36
ne...@tigerden.com 2678 0.53
bri...@tau-ceti.isc-br.com 2851 0.56
s...@kithrup.com 4090 0.81
jer...@exit109.com 4639 0.92
ne...@aol.com* 6560 1.30
ro...@127.0.0.1 7170 1.42
spamc...@stopspam.org 8736 1.73
how...@iswest.com 10799 2.14
hwe...@berlin.snafu.de 13564 2.69
heim...@oriole.sbay.org(PM) 14055 2.79
lysa...@exit109.com 14966 2.97
lysa...@easyway.net 15963 3.16
lysa...@intac.com 21079 4.18
heim...@oriole.sbay.org 22565 4.47
ne...@news.msfc.nasa.gov 31852 6.31
cle...@ferret.ocunix.on.ca 61815 12.25
rbr...@ohww.norman.ok.us 156935 31.10
Malformed spam cancels 31711 6.28
Properly formed spam cancels 396225 78.52
Illicit/rogue cancels 16 0.00
Total spam cancels (excluding illicit) 427920 84.80
Non-spam 76681 15.20
Total 504617 100.00
- --
All postings to news.admin.net-abuse.bulletins are unconfirmed and
unverified unless stated otherwise by the moderators. All opinions
expressed above are considered the opinions of the original poster
not the moderators or their respective employers.
For a copy of the guidelines to this group, see
http://www.math.uiuc.edu/~tskirvin/home/nana/
-----BEGIN PGP SIGNATURE-----
Version: 2.6
iQCVAgUBM2wtsZ3FmCyJjHfhAQH5zgP/eR6a+/AfKlIxSxfZAZD3COdO0BCUw5fp
bBEjo7QsavLHdryKcEFfNhUavQiFn3nkMB5wLRcDVTz5f4AaBoh3yBXny1mpPqb0
XWfLWjgCqMhQu4sC4rw5sdJkA59QBUD4cxS8qwxzrZbOn7AnykLn5iRAjD6TA70G
q9kzGNAQe0Y=
=0Cpx
-----END PGP SIGNATURE-----