I was looking at the sporge we recieved and noticed the first server in path
(read from right to left) is news.suddenlink.net.

I tried to filter on it but agent can not do it. Assuming you don't
news.suddenlink.net that might help. Those that monitor other groups who is
on the immediate left of !not-for-mail in path?

Wes

"Wes" wrote in message
...
I was looking at the sporge we recieved and noticed the first server in
path
(read from right to left) is news.suddenlink.net.

I tried to filter on it but agent can not do it. Assuming you don't
news.suddenlink.net that might help. Those that monitor other groups who
is
on the immediate left of !not-for-mail in path?

Wes

I noticed that, too. But it appears that the newer posts on this group today
now have a new path in the header. Crap!

On Tue, 14 Aug 2007 09:34:40 -0400, Wes
wrote:

I was looking at the sporge we recieved and noticed the first server in path
(read from right to left) is news.suddenlink.net.

I tried to filter on it but agent can not do it. Assuming you don't
news.suddenlink.net that might help. Those that monitor other groups who is
on the immediate left of !not-for-mail in path?

Wes

I'm using Agent 2.0, so this may not work for you.

If you already have the offending crap on your computer, do
a Global search using the term just mentioned (ctrl-g). Tell
Agent to Find All occurrences and then at the bottom of the
dialog click on View all. Now you should have a filtered
view of just the messages matching your search term (Agent's
regular expressions work here too in the search terms).
Select all messages and delete or scroll though and
highlight the ones to delete. Works good for me.

Click on the Message filter area to reset the filter to all.

--
Leon Fisk
Grand Rapids MI/Zone 5b
Remove no.spam for email

According to pogo :
"Wes" wrote in message
...
I was looking at the sporge we recieved and noticed the first server in
path
(read from right to left) is news.suddenlink.net.

I tried to filter on it but agent can not do it. Assuming you don't
news.suddenlink.net that might help. Those that monitor other groups who
is
on the immediate left of !not-for-mail in path?

Wes

I noticed that, too. But it appears that the newer posts on this group today
now have a new path in the header. Crap!

And the part of the "Path: " header closest to the end (usually
the "!not-for-mail" is easy to forge, so you have to identify where it
*really* originated -- somewhere in the path.

But it seems to me that the flood has been shut down now.

Either that, or my news server has gotten on top of the problem.

Enjoy,
DoN.

--
Email: | Voice (all times): (703) 938-4564
(too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
--- Black Holes are where God is dividing by zero ---

--Here's the trick that worked for me: filter out "*,*" without the
quotes; this will delete anything that's crossposted.

--
"Steamboat Ed" Haas : A steaming pile of
Hacking the Trailing Edge! : obscure information...
www.nmpproducts.com
---Decks a-wash in a sea of words---

On 15 Aug 2007 06:20:12 GMT, steamer wrote:
--Here's the trick that worked for me: filter out "*,*" without the
quotes; this will delete anything that's crossposted.

Might want to limit that to the Newsgroups: line.

Dave Hinz wrote:

Might want to limit that to the Newsgroups: line.

I had a look at some of the headers of the floodings. I get them in SEJW,
not here.
They are making batches of postings and then change the headers. There is no
common pattern I can see.
The only thing that looks suspicious to me is this (in the path):
"post01.iad01". Not a valid TLD and that iad01-pattern only occurs in
nx01.iad01.newshosting.com but that is more on the *left* side of the path
and a valid URL. To me, it looks like the faked path starts left of the
post01.iad01.
The feeding part "news.suddenlink.net" on the very right and
the "X-Complaints-To: " is only a joe-job.


Nick

"DoN. Nichols" wrote in message
...
According to pogo :

Snip


And the part of the "Path: " header closest to the end (usually
the "!not-for-mail" is easy to forge, so you have to identify where it
*really* originated -- somewhere in the path.

But it seems to me that the flood has been shut down now.

Either that, or my news server has gotten on top of the problem.

Enjoy,
DoN.

--
Email: | Voice (all times): (703) 938-4564
(too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
--- Black Holes are where God is dividing by zero ---


Darn! I thought it was the filter I wrote that day!


Steve R.



--
Return address munged to bugger up spammers

I suggest we start using [RCM] in this group in the subject
so we might the better spot ourselves.

Martin
Martin H. Eastburn
@ home at Lions' Lair with our computer lionslair at consolidated dot net
TSRA, Life; NRA LOH & Endowment Member, Golden Eagle, Patriot's Medal.
NRA Second Amendment Task Force Charter Founder
IHMSA and NRA Metallic Silhouette maker & member.
http://lufkinced.com/


Nick Mueller wrote:
Dave Hinz wrote:

Might want to limit that to the Newsgroups: line.

I had a look at some of the headers of the floodings. I get them in SEJW,
not here.
They are making batches of postings and then change the headers. There is no
common pattern I can see.
The only thing that looks suspicious to me is this (in the path):
"post01.iad01". Not a valid TLD and that iad01-pattern only occurs in
nx01.iad01.newshosting.com but that is more on the *left* side of the path
and a valid URL. To me, it looks like the faked path starts left of the
post01.iad01.
The feeding part "news.suddenlink.net" on the very right and
the "X-Complaints-To: " is only a joe-job.


Nick

----== Posted via Newsfeeds.Com - Unlimited-Unrestricted-Secure Usenet News==----
http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+ Newsgroups
----= East and West-Coast Server Farms - Total Privacy via Encryption =----

On Wed, 15 Aug 2007 22:05:09 -0500, Martin H. Eastburn wrote:
I suggest we start using [RCM] in this group in the subject
so we might the better spot ourselves.

Wouldn't it be easier and less, well, less let's make the real people
jump into bull****, to just filter out sci.crypt, Newsgroups: lines with
two or more commas (syntax being *,*,* ), and nntp posting hosts as
named previously? Why should everyone adapt to some workaround when the
fix is so easy?

(Nick, if you want to answer my posts, you have to use email. You know
I've killfiled you due to your constant off-topic rants).

On 16 Aug 2007 03:08:36 GMT, Dave Hinz wrote:
On Wed, 15 Aug 2007 22:05:09 -0500, Martin H. Eastburn wrote:
I suggest we start using [RCM] in this group in the subject
so we might the better spot ourselves.

Wouldn't it be easier and less, well, less let's make the real people
jump into bull****, to just filter out sci.crypt, Newsgroups: lines with
two or more commas (syntax being *,*,* ), and nntp posting hosts as
named previously? Why should everyone adapt to some workaround when the
fix is so easy?

(Nick, if you want to answer my posts, you have to use email. You know
I've killfiled you due to your constant off-topic rants).


I agree with you 100%. The sporges, while annoying, are easy to filter
out. They do make downloading the newsgroup a little slower, but it is
not a big deal.

i

Dave Hinz wrote:

(Nick, if you want to answer my posts, you have to use email. You know
I've killfiled you due to your constant off-topic rants).

Sorry, that won't happen. It is *your* decision to filter me, so *you* take
the consequences, not me.
Second, that flooding is nothing different than OT-postings. Doesn't belong
here, have to wade through a POS.

You're just getting what you are preaching.
NNTP-servers that accept mangled eMail-adresses
NNTP-servers that have no abuse management
NNTP-servers that accept forged postings
NNTP-servers that get their feeds from rogue servers

But it's so *cheap*!


Usenet dies, film at 12:00


Nick

Dave Hinz wrote:
two or more commas (syntax being *,*,* ), and nntp posting hosts as
--Oops! I spoke too soon about comma filtering: turns out
comp.robotics.misc got hit today and even though I had the kill in place I
still got to see 400 or so crap messages. Sounds to me like there's a 'human
agent' making decisions to aggravate this mess.

--
"Steamboat Ed" Haas : A steaming pile of
Hacking the Trailing Edge! : obscure information...
www.nmpproducts.com
---Decks a-wash in a sea of words---

Nick Mueller wrote:

Dave Hinz wrote:

(Nick, if you want to answer my posts, you have to use email. You know
I've killfiled you due to your constant off-topic rants).

Sorry, that won't happen. It is *your* decision to filter me, so *you* take
the consequences


What 'consequences'? Peace of mind and not seeing your constant off
topic rants? What was the downside, again?


--
Service to my country? Been there, Done that, and I've got my DD214 to
prove it.
Member of DAV #85.

Michael A. Terrell
Central Florida

According to steamer :
Dave Hinz wrote:
two or more commas (syntax being *,*,* ), and nntp posting hosts as
--Oops! I spoke too soon about comma filtering: turns out
comp.robotics.misc got hit today and even though I had the kill in place I
still got to see 400 or so crap messages. Sounds to me like there's a 'human
agent' making decisions to aggravate this mess.

We got a new hit here, too. In this case, you need to filter on
the:

NNTP-Posting-Host: " 64.203.204.101.dyn-cm-pool-65.hargray.net

or as an alternative, kill anything with:

!news.infoave.net!

in the "Path: ".

At least not as many as there were in the cross-posting to
sci.crypt flood (so far).

Enjoy,
DoN.
--
Email: | Voice (all times): (703) 938-4564
(too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
--- Black Holes are where God is dividing by zero ---