Spam

I don't know if any of you have seen this....but...

 
==========================================
| ,dP""8a "888888b,  d8b    "888b  ,888" |
| 88b   "  888  d88 dPY8b    88Y8b,8888  |
| `"Y8888a 888ad8P'dPaaY8b   88 Y88P888  |
| a,   Y88 888    dP    Y8b  88  YP 888  |
| `"8ad8P'a888a  a88a;*a888aa88a   a888a |
|                ;*;;;;*;;;*;;;*,,       |
|        _,---'':::';*;;;*;;;*;;*d;,     |
|     .-'      ::::::::::';*;;*;dII;     |
|   .' ,<<<,.  :::::::::::::::ffffff`.   |
|  / ,<<<<<<<<,::::::::::::::::fffffI,\  |
| .,<<<<<<<<<<I;:::::::::::::::ffffKIP", |
| |<<<<<<<<<<dP;,?>;,::::::::::fffKKIP | |
| ``<<<<<<<dP;;;;;\>>>>>;,::::fffKKIPf ' |
|  \ `mYMMV?;;;;;;;\>>>>>>>>>,YIIPP"` /  |
|   `. "":;;;;;;;;;i>>>>>>>>>>>>>,  ,'   |
|     `-._``":;;;sP'`"?>>>>>=========.   |
|         `---..._______...|<[Hormel |   |
|                          `========='   |
==========================================

==========================================
| ,dP""8a "888888b,  d8b    "888b  ,888" |
| 88b   "  888  d88 dPY8b    88Y8b,8888  |
| `"Y8888a 888ad8P'dPaaY8b   88 Y88P888  |
| a,   Y88 888    dP    Y8b  88  YP 888  |
| `"8ad8P'a888a  a88a;*a888aa88a   a888a |
|                ;*;;;;*;;;*;;;*,,       |
|        _,---'':::';*;;;*;;;*;;*d;,     |
|     .-'      ::::::::::';*;;*;dII;     |
|   .' ,<<<,.  :::::::::::::::ffffff`.   |
|  / ,<<<<<<<<,::::::::::::::::fffffL,\  |
| .,<<<<<<<<<<I;:::::::::::::::ffffKIP", |
| |<<<<<<<<<<dP;,?>;,::::::::::fffKKIP | |
| ``<<<<<<<dP;;;;;\>>>>>;,::::fffKKIPf ' |
|  \ `mYMMV?;;;;;;;\>>>>>>>>>,YIIPP"` /  |
|   `. "":;;;;;;;;;i>>>>>>>>>>>>>,  ,'   |
|     `-._``":;;;sP'`"?>>>>>=========.   |
|         `---..._______...|<[Hormel |   |
|                          `=========' fL|
==========================================

 ==========================================
 | ,dP""8a "888888b,  d8b    "888b  ,888" |
 | 88b   "  888  d88 dPY8b    88Y8b,8888  |
 | `"Y8888a 888ad8P'dPaaY8b   88 Y88P888  |
 | a,   Y88 888    dP    Y8b  88  YP 888  |
 | `"8ad8P'a888a  a88a;*a888aa88a   a888a |
 |                ;*;;;;*;;;*;;;*,,       |
 |        _,---'':::';*;;;*;;;*;;*d;,     |
 |     .-'      ::::::::::';*;;*;dII;     |
 |   .' ,<<<,.  :::::::::::::::ffffff`.   |
 |  / ,<<<<<<<<,::::::::::::::::fffffI,\  |
 | .,<<<<<<<<<<I;:::::::::::::::ffffKIP", |
 | |<<<<<<<<<<dP;,?>;,::::::::::fffKKIP | |
 | ``<<<<<<<dP;;;;;\>>>>>;,::::fffKKIPf ' |
 |  \ `mYMMV?;;;;;;;\>>>>>>>>>,YIIPP"` /  |
 |   `. "":;;;;;;;;;i>>>>>>>>>>>>>,  ,'   |
 |     `-._``":;;;sP'`"?>>>>>=========.   |
 |         `---..._______...|<-HORMEL |   |
 |                          `========='   |
 ==========================================

   
How to Get Anything on Anyone!  
157 True Poor Man's James Bond Techniques:
 Go to http://www.thorn.by.net/sx030001.htm

What's this new pile of spam about then? Is it trying to sell something or
just annoy everyone?
-- 
Harry Mason ("hjm200.ecs@soton@ac@uk" =~ tr/@./.@/)

--(Once apon a time, in alt.ascii-art,)--
		--(Harry Mason said it like only they can.)--
> 
> What's this new pile of spam about then? Is it trying to sell something or
> just annoy everyone?
> -- 
> Harry Mason ("hjm200.ecs@soton@ac@uk" =~ tr/@./.@/)

some free spam filters for you

You will probably have to upgrade to 0.9.7.x from your current 0.9.6.x
because i don't remember if your version dose hard scoring with "="
as is shown below.
Upgrade anyway because there are just some really nice improvemnts
from 6 to 7

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
[*]
	Score:: =-9999
		Subject: \cre: \C[a-z]
	Score: =-9999
		~Subject: \c[a-z]
		~Subject: FAQ
	Score: =-9999
		Subject: ^Re: \c[^a-z]*$
		Subject: ^Re: \c.*[A-Z]
		~Subject: FAQ
	Score: =-9999
		Newsgroups: ,
		Subject: /[0-9])
		~Lines: 30 
		% odviously if its that small and crostposted 
		%  then its not a multi-part post worth having
	Score:: =-9999
		Subject: S.?U.?B.?L.?I.?M.?I.?N.?A.?L	
		Subject: p.?r.?e.?.?.?.?.?t.?e.?e.?n
		Subject: P.?H.?E.?R.?O.?M.?O.?N.?E.?S
		Subject: S.?E.?X.?A.?P.?P.?E.?A.?L
	 	Subject: A.?P.?H.?R.?O.?D.?I.?S.?I.?A.?C
	 	Subject: Q.?U.?I.?T  S.?M.?O.?K.?I.?N.?G
	 	Subject: A.?T.?T.?R.?A.?C.?T 
		Subject: \<\cD.?E.?B.?T\C\>
 		Subject: F.?R.?E.?E.?M.?O.?B.?I.?L.?E
			% kill any post that wants to use some variation
			% of those words 
		Subject: \!\!\!
		Subject: free.+sex
		Subject: guaranteed
		Subject: out of the office
		Subject: Penis
		Subject: pics xxx
		Subject: please read
		Subject: test.?+ignore
		Subject: out of the office
		Subject: WAREZ
		Subject: xxx pics
		Subject: \cDVD
		Subject: rough
		Subject: divx
		Subject: www\.
		Subject: XXX
		Subject: Earn \$
		Subject: Earn cash
		Subject: make \$
		Subject: make cash
		Subject: fast \$
		Subject: fast cash
		Subject: money fast
		Subject: money \$
		Subject: http://
		Subject: \<no subject
		Subject: (none)
		Subject: ^FREE\>
		Subject: ^Re: FREE\>
		Subject: \$\$
		Subject: ^!+ +
		Subject: you
[alt.binaries.*, *sex*]
	Score: =-9999
		~Lines: 100
	Score:: =-9999
%takeing sugestions here for new key words
		Subject: ^GAY
		Subject: Boys
		Subject: \<guy
		Subject: \<stud
		Subject: chick.*dick
		Subject: \cDVD
		Subject: www\.
		Subject: heavy
		Subject: \cSCAT\C
		Subject: piss\>
		Subject: pissing
		Subject: ^stud
		Subject: XXX
		Subject: http://
		Subject: ^!+ +
	 	Subject: drunk
		Subject: repost
		Subject: \cRP\C
		Subject: Marilyn Chambers
		Subject: Britney Spears
		Subject: Mariah Carey
		Subject: Pamela Anderson
		Subject: Jennifer Lopez
		Subject: horney
		Subject: ORGASM
		Subject: Thousands
		Subject: Pussy
		Subject: free
		Subject: Banned
	 	Subject: ^Hot
	 	Subject: ^See
%		Subject: Amateur
		Subject: virgin
		Subject: \cSEX
		Subject: deep
	 	Subject: Posting what I Got from here recently
		Subject: white.*black
						% posts gay porn 
		From: xposed
		From: @not\.for\.news
		From: ColumbiaStud <ColumbiaStud@Frat\.net> 
		From: Strip-Pics <free@strip-pics\.com>
		From: Nakked Master <nakked@allthepicsyouwant\.com>
		From: no\.email\.address\.entered
		From: respondby
		From: sex
		From: stud
		From: www\.
		From: sweet girls
		From: @pussy
		% a animal poster
		From: pictureposter
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


-- 
 --(tty...@faux.local|04:45|/home/faux)-- cat .sig
GUI's are for slackers.  Get ibpconf.sh 6.1 on freshmeat.net  

It's a damn poor mind that can only think of one way to spell a word.
        - Andrew Jackson

In article <slr...@localhost.localdomain>, Harry Mason
<spa...@no.spam> writes

>| Hey, Roger never trains until Zephram outwits the tall laptop bimonthly.
>| It's very robust today, I'll vend eventually or Chester will take the
>| advertisements.
>| To be bizarre or overloaded will engulf cold advertisements to finally open.
>| 
>| cheers, L. Jacobs
>
>Is this a carefully coded message, an experimental AI program, just
>meaningless bunkum, or what?

Probably just a random sentence generator...

-- 
Philip Taylor
philip @ zaynar . demon . co . uk

http://robowarriors.ultrastore.com/legoworld.shtml
  -- If the Earth was made of Lego...

On Tue, 31 Jul 2001 12:03:45 GMT, Faux_Pseudo <Faux_Pseudo@24.177.56.253> wrote:
> --(Once apon a time, in alt.ascii-art,)--
> 		--(Harry Mason said it like only they can.)--
> > What's this new pile of spam about then? Is it trying to sell something or
> > just annoy everyone?
> some free spam filters for you

I'm already behind a filter for /normal/ spam, but the latest batch is
really weird:

| Hey, Roger never trains until Zephram outwits the tall laptop bimonthly.
| It's very robust today, I'll vend eventually or Chester will take the
| advertisements.
| To be bizarre or overloaded will engulf cold advertisements to finally open.
| 
| cheers, L. Jacobs

Is this a carefully coded message, an experimental AI program, just
meaningless bunkum, or what?

I'm totally baffled.

-- 
Harry Mason ("hjm200.ecs@soton@ac@uk" =~ tr/@./.@/)

spa...@no.spam (Harry Mason) writes:

> On Tue, 31 Jul 2001 12:03:45 GMT, Faux_Pseudo <Faux_Pseudo@24.177.56.253> wrote:
> > --(Once apon a time, in alt.ascii-art,)--
> >             --(Harry Mason said it like only they can.)--
> > > What's this new pile of spam about then? Is it trying to sell something or
> > > just annoy everyone?
> > some free spam filters for you
>
> I'm already behind a filter for /normal/ spam, but the latest batch is
> really weird:
>
> | Hey, Roger never trains until Zephram outwits the tall laptop bimonthly.
> | It's very robust today, I'll vend eventually or Chester will take the
> | advertisements.
> | To be bizarre or overloaded will engulf cold advertisements to finally open.
> |
> | cheers, L. Jacobs
>
> Is this a carefully coded message, an experimental AI program, just
> meaningless bunkum, or what?

It looks to me like an revenge attempt by an spammer.


Looking at:

- the multiple (obviously faked) From: lines, which all look
like actual users accounts
- The Followup to an newsgroup that discusses fighting email spammers

I suspect this is a spammer who got shafted by some folks in that
group and is trying to get revenge by:

- burrying the group in complaint replys
- getting some of his opponents accounts killed for "spamming"


To get your back at this guy do this:

- analyse his NNTP-Posting-Host: lines for the sending provider
- report the spams with explanation of the situation to the providers
- ask them to kill his net access AND CHARGE HIM CLEAN UP COSTS

Clean up costs from enough providers will harm him financially so that
he will in the end stop.

Happy spammer trashing.


--
Neil Franklin, nei...@franklin.ch.remove http://neil.franklin.ch/
Hacker, Unix Guru, El Eng HTL/BSc, Sysadmin, Archer, Roleplayer
- Intellectual Property is Intellectual Robbery

In article <6us...@chonsp.franklin.ch>, nei...@franklin.ch.remove 
gaily trilled...
> spa...@no.spam (Harry Mason) writes:
> 
> Looking at:
> 
> - the multiple (obviously faked) From: lines, which all look
> like actual users accounts

All of the ones that my newsfeed picked up are yahoo.com addresses. Is 
this something that all these messages have in common?

> - The Followup to an newsgroup that discusses fighting email spammers
> 

On about half of them. The others do not have a followup header, 
although all seem to either be crossposted to nanae or have followup to 
there.

> I suspect this is a spammer who got shafted by some folks in that
> group and is trying to get revenge by:
> 
> - burrying the group in complaint replys

Simon was looking over my shoulder when I read this, and laughed at this 
line. I don't know why.

> - getting some of his opponents accounts killed for "spamming"
> 

One possible motive.

I would also add:
- He is a troll. He merely wants to annoy everyone so much that its not
  worth the trouble sifting through his garbage posts, and they leave.
  Trolls love to drive people out of interesting groups.

> 
> To get your back at this guy do this:
> 
> - analyse his NNTP-Posting-Host: lines for the sending provider

They're not all the same. The Path: and X-Complaints-to: lines all seem 
to match other posts from the same providers, so I'd guess either he has 
a lot of accounts with different people, or he's found some way to screw 
up these headers (not easy AFAIK).

Also, he's using a lot of different newsreaders. The first few were all 
sent through OE, which made me immediately think of some kind of email 
virus firing off random messages to newsgroups. However, this doesn't 
seem so likely when there are so many different programs being used.

[edit - since I wrote this, I just saw one that is PGP signed. A bit 
odd, for spam.]

> - report the spams with explanation of the situation to the providers
> - ask them to kill his net access AND CHARGE HIM CLEAN UP COSTS
> 
> Clean up costs from enough providers will harm him financially so that
> he will in the end stop.
> 
> Happy spammer trashing.
> 
> 
> --
> Neil Franklin, nei...@franklin.ch.remove http://neil.franklin.ch/
> Hacker, Unix Guru, El Eng HTL/BSc, Sysadmin, Archer, Roleplayer
> - Intellectual Property is Intellectual Robbery
> 

-- 
Isuldir, Demon prince of spam (if you really want to know, ask)
Death is great fun... You haven't lived until you've tried it.
Newsfeed full of holes, please cc me a copy

Bean <web...@tradespace.zzn.com> writes:

> In article <6us...@chonsp.franklin.ch>, nei...@franklin.ch.remove
> gaily trilled...
> >
> > - the multiple (obviously faked) From: lines, which all look
> > like actual users accounts
>
> All of the ones that my newsfeed picked up are yahoo.com addresses. Is
> this something that all these messages have in common?

I have seen at least 5 different providers.


> > - The Followup to an newsgroup that discusses fighting email spammers
>
> On about half of them. The others do not have a followup header,
> although all seem to either be crossposted to nanae or have followup to
> there.

Jes, nanae crossposts also. Also points to flooding it.


> > I suspect this is a spammer who got shafted by some folks in that
> > group and is trying to get revenge by:
> >
> > - burrying the group in complaint replys
>
> Simon was looking over my shoulder when I read this, and laughed at this
> line. I don't know why.

Is he also sysadmin?


> I would also add:
> - He is a troll. He merely wants to annoy everyone so much that its not
>   worth the trouble sifting through his garbage posts, and they leave.
>   Trolls love to drive people out of interesting groups.

Trolls usually focus on killing one group at a time, as intensity is
crucial to their "success". This one was scattered over many groups.


> > To get your back at this guy do this:
> >
> > - analyse his NNTP-Posting-Host: lines for the sending provider
>
> They're not all the same. The Path: and X-Complaints-to: lines all seem
> to match other posts from the same providers, so I'd guess either he has
> a lot of accounts with different people, or he's found some way to screw
> up these headers (not easy AFAIK).

I expect lost of (trow away) accounts. Spammers are experienced in
getting them fast.

Faking NNTP-Posting-Host: requires finding an old server that does not
strip NNTP-Posting-Host: from NNRP connections and replace it by its
own one. That is not fitting with the providers used. NNTP-Posting-Host:
is the most reliable header entry of all.


> Also, he's using a lot of different newsreaders. The first few were all
> sent through OE, which made me immediately think of some kind of email
> virus firing off random messages to newsgroups. However, this doesn't
> seem so likely when there are so many different programs being used.

That is fakeable. Easy.

I think for demo I will do a maximal fake header on this post. Compare
it with the previous one.


> [edit - since I wrote this, I just saw one that is PGP signed. A bit
> odd, for spam.]

Also fakeable. Or did you try to check up the PGP key if it is valid?


--
Neil Franklin, nei...@franklin.ch.remove http://neil.franklin.ch/
Hacker, Unix Guru, El Eng HTL/BSc, Sysadmin, Archer, Roleplayer
- Intellectual Property is Intellectual Robbery

On Wed, 1 Aug 2001 20:47:03 +0100, Bean <web...@tradespace.zzn.com> wrote:

>One possible motive.
>
>I would also add:
>- He is a troll. He merely wants to annoy everyone so much that its not
>  worth the trouble sifting through his garbage posts, and they leave.
>  Trolls love to drive people out of interesting groups.
>
>> 
>> To get your back at this guy do this:
>> 
>> - analyse his NNTP-Posting-Host: lines for the sending provider
>
>They're not all the same. The Path: and X-Complaints-to: lines all seem 
>to match other posts from the same providers, so I'd guess either he has 
>a lot of accounts with different people, or he's found some way to screw 
>up these headers (not easy AFAIK).

Uhh forget it.

It's just a misaimed new generation of spam. Maybe some funkup or test.
Typically, what appears to be the source(s) are real people whose
addresses have been 'hyjacked' and faked.
These happy people (they're innocent) get the complaints and the
bounces when the e-mail type is used.
One of the objects is to become non-filterable.
Joy joy joy :(