296 Spam posts, sheesh...
Mike_B
In article <B1455695...@calmeilles.demon.co.uk>, Matthew Malthouse
<matthew....@guardian.co.uk> writes
>Bloody hell.
>
>In the last 14 hours there have appeared 16 meaningful (well, as meanigful
>as uk.g-l-b gets) articles and 296 spam posts, most from the same source.
>
>Here are some specimin headers - I'll do some follow-up investigations when
>I get into work this evening.
>
>Matthew
>
Very odd isn't it. Fairly clever in that almost every spam had a
different FROM: header, different subjects and different newsgroups x-
posted to. Most peculiar.
However, most were from randomname<?@?.?>
Turnpike users can simply scrub the random name and enter a custom kill
rule on author <?@?.?>
This should clear up the vast majority of it in case we are attacked
again.
--
Mike_B
http://www.blackpool.demon.co.uk/
Scene guide - Free Chatroom - Hotels listings - Blackpool Fiesta Info.
Michael Nieuwenhuizen
Matthew Malthouse wrote in message ...
>
> In the last 14 hours there have appeared 16 meaningful [...] articles
12 plus the 4 I've posted?
Mik, always meaningless...
Iain Bowen
In article <99GK7DAb...@blackpool.demon.co.uk>,
Mike_B <mi...@blackpool.demon.co.uk> wrote:
>In article <B1455695...@calmeilles.demon.co.uk>, Matthew Malthouse
><matthew....@guardian.co.uk> writes
>>Bloody hell.
>>
>>In the last 14 hours there have appeared 16 meaningful (well, as meanigful
>>as uk.g-l-b gets) articles and 296 spam posts, most from the same source.
>>
>>Here are some specimin headers - I'll do some follow-up investigations when
>>I get into work this evening.
>>
>>Matthew
>>
>
>Very odd isn't it. Fairly clever in that almost every spam had a
>different FROM: header, different subjects and different newsgroups x-
>posted to. Most peculiar.
Not really. This is a fairly standard way to get around the spam cancelling
bots - by trying to make sure that the Briedbart Index[0] stays under 20. It
doesn't work - sadly, two of the biggest spam killers have a specific
exclude for uk.glb after the last time that an article was accidentally
cancelled.
Want some *really* bad news. There looks like there is going to be a complete
cancel moratorium during June. For more details look at the newsgroup
news.admin.net-abuse.usenet on DejaNews.
>However, most were from randomname<?@?.?>
>
>Turnpike users can simply scrub the random name and enter a custom kill
>rule on author <?@?.?>
I'm killing on telia.no. However, this is after download. Various abuse
addresses at telia.no have been contacted and I'm going after the sites
uplink feed.
>This should clear up the vast majority of it in case we are attacked
>again.
Mutter, must rewrite slurp or suck. Mutter, that's project 65,000.
Iain
--
\/ Iain Bowen is alaric(at)harlech.demon.co.uk. Penguin Inside
"I have measured out my life with coffee spoons"
Dull Web Page: http://www.harlech.demon.co.uk/ PGP Public Key on request
UK-VOTING web pageshave moved to: http://www.cirra.com/ukvoting/
Ree-shar
Hope you realise, Matthew, that your post has been spam-killed!
Just for those like JohnM who believe that blacklist robomoderation is
the way to go!
Richard
--
If you wanna write to me, use the address formed by putting an @
between "rick" and "coopinf.demon.co.uk". Should be a doddle
if you've ever built anything using Blue Peter instructions ;-)
Mike_B
In article <3520ec4a...@news.demon.co.uk>, Ree-shar
<g...@blow.your.mind> writes
>Hope you realise, Matthew, that your post has been spam-killed!
>
>Just for those like JohnM who believe that blacklist robomoderation is
>the way to go!
>
>
>
>Richard
>
Ah, and perhaps filters aren't the way to go after all. Since most of
teh last two days' spam had <?@?.?> in the from: line I decided to kill
that.
Unfortunately, MYM also uses that in his from: line so I've been killing
any messages he sent in the last 2 days :(
Back to the drawing board... Mark, you're an awkward bugger! ;-)
David Holder
Mik, your posts are always insightful, meaningful and life-enriching. Or
something.. .:)
---------- David L. P. Holder <dl...@coventry.ac.uk> ----------
Mewn cariad, a stim ots pwy a wyr.
Matthew Malthouse
} Very odd isn't it. Fairly clever in that almost every spam had a
} different FROM: header, different subjects and different newsgroups x-
} posted to. Most peculiar.
}
} However, most were from randomname<?@?.?>
}
} Turnpike users can simply scrub the random name and enter a custom kill
} rule on author <?@?.?>
}
} This should clear up the vast majority of it in case we are attacked
} again.
Most had a 6 digit number so "[0-9][0-9][0-9][0-9][0-9]" in a reg exp would
get them (five rather than fewer to avoid year numbers).
I see you saw my post. Lucky, cause I didn't, it was bolldy well canceled!
Matthew
--
"Homo sum: humani nihil a me alienum puto"
mailto:matthew....@guardian.co.uk
http://www.geocities.com/WestHollywood/6630/index.html
http://www.calmeilles.demon.co.uk/index.html
Matthew Malthouse
In article <3520ec4a...@news.demon.co.uk>,
g...@blow.your.mind (Ree-shar) wrote:
} Subject: Re: 296 Spam posts, sheesh...
} From: g...@blow.your.mind (Ree-shar)
} Date: Mon, 30 Mar 1998 23:04:13 GMT
} Newsgroups: uk.gay-lesbian-bi
}
} Hope you realise, Matthew, that your post has been spam-killed!
}
} Just for those like JohnM who believe that blacklist robomoderation is
} the way to go!
Yes I DO realise.
The broken robot operated by Chris Lewis ignored the real subject
newsgroups lines instead using the quoted ones from the spam headers not
only to justify the cancel but to fire off a complaint to ab...@demon.net
Leaving and automatic bot operating in such a broken state is IMO highly
unethical and unless I get some positive response from CL soon I will be
raising Cain over it.
Ree-shar
> In article <3520ec4a...@news.demon.co.uk>, Ree-shar
> <g...@blow.your.mind> writes
>
> >Hope you realise, Matthew, that your post has been spam-killed!
> >
> >Just for those like JohnM who believe that blacklist robomoderation is
> >the way to go!
>
> Ah, and perhaps filters aren't the way to go after all. Since most of
> teh last two days' spam had <?@?.?> in the from: line I decided to kill
> that.
>
> Unfortunately, MYM also uses that in his from: line so I've been killing
> any messages he sent in the last 2 days :(
>
> Back to the drawing board... Mark, you're an awkward bugger! ;-)
Well Matthew's post was cancelled by someone else on the Net. The body
was not available from Demon's news server.
Actually, if we have a whitelist will cancels still work? Or will they
have to go through a moderator?
Mark Ynys-Mon
In article <X9mA7HAk...@blackpool.demon.co.uk>,
mi...@blackpool.demon.co.uk (Mike_B) spake thus:
> In article <3520ec4a...@news.demon.co.uk>, Ree-shar
> <g...@blow.your.mind> writes
> >Hope you realise, Matthew, that your post has been spam-killed!
> >
> >Just for those like JohnM who believe that blacklist robomoderation is
> >the way to go!
> >
> >
> >
> >Richard
> >
>
> Ah, and perhaps filters aren't the way to go after all. Since most of
> teh last two days' spam had <?@?.?> in the from: line I decided to kill
> that.
>
> Unfortunately, MYM also uses that in his from: line so I've been killing
> any messages he sent in the last 2 days :(
eh? my from line is
From: mcyatdemondotnet (Mark Ynys-Mon)
what is the problem?
--
Mark Ynys-Môn
sua cuique deus fit dira cupido
http://www.archdruid.demon.co.uk
opinions are mine not Demon Internet's
Chris Heathcote
On Tue, 31 Mar 1998 13:45:56 GMT, g...@blow.your.mind (Ree-shar) wrote:
>
>Actually, if we have a whitelist will cancels still work? Or will they
>have to go through a moderator?
From what I understand, cancels go to a special newsgroup called
control.cancel (E&OE). Servers that take and use this ng would process the
cancels that arrive there. Anyways, there ain't gonna be no cancels
soon.... (been busy reading news.admin.net-abuse.*)
Chris.
--
|---------------------------------------------------------------------|
| chris (a) deaddodo.com http://www.deaddodo.com ICQ: 6803574|
|---------------------------------------------------------------------|
| "He can make you laugh with no more than a |
| frantic flailing of his limbs" Lisa Simpson |
|---------------------------------------------------------------------|
Mike_B
In article <memo.19980331...@mcy.demon.net>, mcyatdemondotnet
<?@?.?> writes
>> Unfortunately, MYM also uses that in his from: line so I've been killing
>> any messages he sent in the last 2 days :(
>
>eh? my from line is
>
>From: mcyatdemondotnet (Mark Ynys-Mon)
>
>what is the problem?
>
The problem was incorrect usage of terms on my part. I was killing on
authors.
>--
>Mark Ynys-Môn
>sua cuique deus fit dira cupido
>http://www.archdruid.demon.co.uk
>opinions are mine not Demon Internet's
--
Iain Bowen
In article <3526f227...@news.demon.co.uk>,
Ree-shar <g...@blow.your.mind> wrote:
>Well Matthew's post was cancelled by someone else on the Net. The body
>was not available from Demon's news server.
>
>have to go through a moderator?
If we have a whitelist, there should be no need to issue cancels for the
group - if they are to be issued, they should by be issued by the poster
or the moderator. The cancel mechanism is different from the newsgroup
mechanism as has been explained by the honourable member for Deaddodo.
I shall make sure that a random post of your is cancelled every few months,
Richard :-)
Ree-shar
On 31 Mar 1998 18:52:58 +0100, ala...@harlech.demon.co.uk (Iain Bowen)
wrote:
> I shall make sure that a random post of your is cancelled every few months,
> Richard :-)
Bastard!
Oh, we already knew that!
Ree-shar
Matthew Malthouse
In article <3526f227...@news.demon.co.uk>,
g...@blow.your.mind (Ree-shar) wrote:
} Actually, if we have a whitelist will cancels still work? Or will they
} have to go through a moderator?
If there's a white list what will there be to cancel?
Chris Heathcote
>If there's a white list what will there be to cancel?
Methinks he's talking about the times when ppl firmly put their foot in
their mouth, and want to do some damage limitation....
Matthew Malthouse
In article <Pine.OSF.3.91.980331115407.3086H-100000@leofric>,
David Holder <dl...@coventry.ac.uk> wrote:
} On Mon, 30 Mar 1998, Michael Nieuwenhuizen wrote:
}
} > Matthew Malthouse wrote in message ...
} > >
} > > In the last 14 hours there have appeared 16 meaningful [...] articles
} >
} > 12 plus the 4 I've posted?
} > Mik, always meaningless...
}
} Mik, your posts are always insightful, meaningful and life-enriching. Or
} something.. .:)
Posted midday 31/1 arrived sometime between 1 and 10 am 2/4. Cripes, for
once I saw this first on the work server which is usually as 'with it' as
Uncle Bulgaria.
On the spam front - 36 xnastys in the couple of minutes between downloads
this morning. Who's complained and has anyone had a response (me and not
yet).
Ree-shar
> In article <3526f227...@news.demon.co.uk>,
> g...@blow.your.mind (Ree-shar) wrote:
>
> } Actually, if we have a whitelist will cancels still work? Or will they
> } have to go through a moderator?
>
> If there's a white list what will there be to cancel?
Well there's *your* posts for a start!
Iain Bowen
In article <B1493732...@0.0.0.0>,
Matthew Malthouse <matthew....@guardian.co.uk> wrote:
>In article <Pine.OSF.3.91.980331115407.3086H-100000@leofric>,
>
>On the spam front - 36 xnastys in the couple of minutes between downloads
>this morning. Who's complained and has anyone had a response (me and not
>yet).
Yes. To the last three sites they have spammed from and their uplink web
provider. Zilch, zero, nada...
Iain "Not looking forward to after tomorrow" Bowen
--
\/ Iain Bowen is alaric(at)harlech.demon.co.uk. Penguin Inside
"April is the cruelest month"
Iain Bowen
In article <35254935...@news.demon.co.uk>,
Chris Heathcote <spam...@deaddodo.com> wrote:
>On Thu, 02 Apr 1998 00:22:43 +0100, matthew....@guardian.co.uk
>(Matthew Malthouse) wrote:
>
>>If there's a white list what will there be to cancel?
>
>their mouth, and want to do some damage limitation....
You mean like what I did last night :-)
That should still work. Moderators will be able to cancel as well, in case
any spammers have gotten smart.
Iain
Harlequin
On Thu, 02 Apr 1998 12:38:10 +0100, Matthew Malthouse wrote:
...
>On the spam front - 36 xnastys in the couple of minutes between downloads
>this morning. Who's complained and has anyone had a response (me and not
>yet).
Ditto.
H.