«

"Robert Baer" wrote:

> More info; THREE junk postings since my previous posting; so much for
> your "1.6 posts per month" - this is a DAILY thing.

Not relevant to my history of postings here or Bobb's, either, which
were the implied candidates in your complaint post that was a reply to
my post. Reread my stat post to see about WHO was mentioned regarding
those average monthly posting rates.

<snipped the following to show just the relevant headers and content>
>
> Path: ...!frontend-F10-12.ams.news.kpn.nl
> From:
> Message-ID: <50327335$0$32682$>
> Organization: KPN.com
> X-Trace: 1345483573 news.kpn.nl 32682 213.75.39.19@kpn/213.75.39.19:56150

There are 5 headers right there where you find the kpn.nl domain
specified. The injection node in the non-overview PATH header tells you
this asshole's posts originated from kpn.nl. The idiot is not adding
their own MID header but the NNTP server is adding its own so the
overview MID header is available for testing in just about every
newsreader. The non-overview Organization header is of little use
since, as with the MID header, the sender's client can insert its own
value for that header and the NNTP server won't overwrite it, plus the
MID and PATH headers are more effective for identifying from where a
post originates. The non-overview X-Trace header is added by the server
so it can be used to filter out this asshole's flood.

<snipped the other examples of flood posts from the asshole poster>

If your newsreader (Seamonkey) supports regex, some examples of usable
filters to flag this asshole's flood are:

From {@kpnmail\.(net|nl)}
Message-ID {news\.kpn\.(net|nl)>}
Header {(?-s)^Path: .+\.news\.kpn\.(net|nl)(!not-for-mail)?$}

Although I added the From filter above, I don't use it. The MID
overview and PATH non-overview filters are sufficient. I don't know
what features are available in your newsreader (Seamonkey). Mine lets
me test on both overview headers (in its first pass) and non-overview
headers (in its 2nd pass - if the entire article is retrieved which only
makes sense for text-only newsgroups and not in binary groups). My
newsreader also supports regex so I can specify just exactly where
within a string to find a target on which to fire a filter.

*-* On Mon, 20 Aug 2012, at 11:26:19 -0700,
*-* In Article <> ,
*-* Robert Baer wrote
*-* About Re: Scan - to file vs blank email and attachment vs Send to

> X-Usenet-Provider: http://www.giganews.com

> X-Complaints-To:

> VanguardLH wrote:
>> "Robert Baer" wrote:

>>> OT subject:
>>> How in the (#$$%!@ heck can we STOP these 2 idiots from
>>> overloading this NG?

>> I'm seeing this thread while visiting the alt.computer newsgroup.

[ ... ]

>> I see about 1 minute later that you decided to repost (as a new
>> thread) an exact duplicate of your complaint post submitted under
>> this thread. Similarly, you never bothered to identify the "2
>> idiots" to which you were referring. If you're talking about the
>> jumbled mess nym that is flooding the alt.computer newsgroup (and
>> probably elsewhere),

"Probably elsewhere" is correct. I recently read about the same
thing happening in the alt.humor.puns newsgroup.

[ ... ]

>> I know and filter out that one KPN-using idiot. I don't what might
>> be the 2nd idiot to which you refer.

> RECENT POSTINGS

[Quoting selected headers, relevant to my comments in this post]

> From:

> Date: Mon, 20 Aug 2012 17:28:42 +0000 (UTC)

> NNTP-Posting-Host: 213.75.39.19


> From:

> Date: Mon, 20 Aug 2012 17:33:42 +0000 (UTC)

> NNTP-Posting-Host: 213.75.39.19


> From:

> Date: Mon, 20 Aug 2012 17:38:43 +0000 (UTC)

> NNTP-Posting-Host: 213.75.39.19

> *** END COPY

VanguardLH is correct that it's one poster. Note that regardless
of which name appears in the "From:" header, all the posts in question
originate from the same IP address (NNTP-Posting-Host: 213.75.39.19).
Here is some selected information extracted from a "whois" look-up on
that address.

Host static.kpn.net
Location NL, Netherlands

Organization HN-Plus
ISP Koninklijke KPN N.V.

remarks: Static IP KPN customers
remarks: Please mail abuse issues to:
remarks: Please mail security issues to:

You might try e-mailing copies of several of the posts (including
all headers) to KPN's abuse-reporting address. I'd suggest using the
subject "Newsgroup Abuse". With luck KPN will cancel the poster's
account, or otherwise put an end to the flood.

Note, too, the posts are time-stamped five minutes apart, as if
the postings are automated.

In response to your comment in a later post:

> Will send complaint to my ISP (same as NSP).

from the headers of your post (the "X-" headers I quoted above) it
appears that your ISP, LocalNet, doesn't operate their own news
server, but rather outsources news to Giganews.

Ken Whiton
--
FIDO: 1:132/152
InterNet: (remove the obvious to reply)

Robert Baer wrote:

<Snip>
> I have been seeing around 100 posts at alt.computer on a DAILY basis
> from what appears to be two idiots exactly describes as you did ("the
> jumbled mess nym" in both cases).
>
> These posts are in English and the body is an exact copy of the
> subject, and are something like (faking now) "Good times ^_^".
>
> I have heard this nasty (to me) rumor that a filter can be used.
> First,where is it (SeaMonkey)?
> Second, how do i use it assuming it exists (have yet to find it)?
> (by sender?, by something else?)
> Third,since i saw nothing in the posts referring to KPN,how would it
> do that "discovery"?
>
> Thank you very much for your patience in addressing my abysmal
> ignorance concerning "filters".

Robert, I'm using SeaMonkey 2.11 and just the other day I made myself a
filter to get rid of these annoying posts.

1, In SeaMonkey, go to Tools->Message Filters
2. Select the News server/group that you want the filter to apply to (I
normally do it server wide)
3. Give it a name (I usually call it after what I'm filtering on)
4. In this case, under the drop-down for "Subject", select "From"
5. You would have noted that the posts are coming from more than one
address, but the server side is the same, so Copy/Paste the server name
into the empty field to the right of "contains"
6. Select what you want to happen to the message.
7. Click "OK".

It will not apply to the headers that you've listed today/tonight, but
for future listings, the filter will apply.

HTH

(If you need further assistance with SeaMonkey, set yourself up a news
sever for news.mozilla.org and subscribe to the group
mozilla.support.seamonkey and ask away!!)

(Also you are using SeaMonkey version 2.7.1 ... a bit old, we are now at
version 2.11)

Daniel

"Robert Baer" wrote:

> Ken Whiton wrote:
>> *-* On Mon, 20 Aug 2012, at 11:26:19 -0700,
>> *-* In Article< calnet>,
>> *-* Robert Baer wrote
>> *-* About Re: Scan - to file vs blank email and attachment vs Send to
>>
>>> X-Usenet-Provider: http://www.giganews.com
>>
>>> X-Complaints-To:
>>
>>> VanguardLH wrote:
>>>> "Robert Baer" wrote:
>>
>>>>> OT subject:
>>>>> How in the (#$$%!@ heck can we STOP these 2 idiots from
>>>>> overloading this NG?
>>
>>>> I'm seeing this thread while visiting the alt.computer newsgroup.
>>
>> [ ... ]
>>
>>>> I see about 1 minute later that you decided to repost (as a new
>>>> thread) an exact duplicate of your complaint post submitted under
>>>> this thread. Similarly, you never bothered to identify the "2
>>>> idiots" to which you were referring. If you're talking about the
>>>> jumbled mess nym that is flooding the alt.computer newsgroup (and
>>>> probably elsewhere),
>>
>> "Probably elsewhere" is correct. I recently read about the same
>> thing happening in the alt.humor.puns newsgroup.
>>
>> [ ... ]
>>
>>>> I know and filter out that one KPN-using idiot. I don't what might
>>>> be the 2nd idiot to which you refer.
>>
>>> RECENT POSTINGS
>>
>> [Quoting selected headers, relevant to my comments in this post]
>>
>>> From:
>>
>>> Date: Mon, 20 Aug 2012 17:28:42 +0000 (UTC)
>>
>>> NNTP-Posting-Host: 213.75.39.19
>>
>>
>>> From:
>>
>>> Date: Mon, 20 Aug 2012 17:33:42 +0000 (UTC)
>>
>>> NNTP-Posting-Host: 213.75.39.19
>>
>>
>>> From:
>>
>>> Date: Mon, 20 Aug 2012 17:38:43 +0000 (UTC)
>>
>>> NNTP-Posting-Host: 213.75.39.19
>>
>>> *** END COPY
>>
>> VanguardLH is correct that it's one poster. Note that regardless
>> of which name appears in the "From:" header, all the posts in question
>> originate from the same IP address (NNTP-Posting-Host: 213.75.39.19).
>> Here is some selected information extracted from a "whois" look-up on
>> that address.
>>
>> Host static.kpn.net
>> Location NL, Netherlands
>>
>> Organization HN-Plus
>> ISP Koninklijke KPN N.V.
>>
>> remarks: Static IP KPN customers
>> remarks: Please mail abuse issues to:
>> remarks: Please mail security issues to:
>>
>> You might try e-mailing copies of several of the posts (including
>> all headers) to KPN's abuse-reporting address. I'd suggest using the
>> subject "Newsgroup Abuse". With luck KPN will cancel the poster's
>> account, or otherwise put an end to the flood.
>>
>> Note, too, the posts are time-stamped five minutes apart, as if
>> the postings are automated.
>>
>> In response to your comment in a later post:
>>
>>> Will send complaint to my ISP (same as NSP).
>>
>> from the headers of your post (the "X-" headers I quoted above) it
>> appears that your ISP, LocalNet, doesn't operate their own news
>> server, but rather outsources news to Giganews.
>>
>> Ken Whiton
> Am not an expert in these things, will take your word for that.
> The complaint has been forwarded to my ISP, and they have been fairly
> good in regard to "ordinary" spam.

Your ISP can do nothing about a troll flood in Usenet. They aren't
operating the NNTP server. Even if they were contracting with Giganews
to provide Usenet services, Giganews won't do much, either. They are
*peering* the asshole's articles from somewhere else. The articles are
getting injected at KPN and getting peered out to other NNTP servers in
the worldwide mesh network that is Usenet. Eventually through this
peering the KPN-sourced article gets retrieved by the Giganews server.
Obviously neither KPN is not employing any spam/flood filtering, like
using the xxx filter, or the asshole is making sure the number of his
posts is under the threshold for that filter.

You'll have to send a complaint to KPN to report this asshole. It's
their customer that is flooding Usenet. Giganews can't do anything
about how KPN handles the accounts for KPN's customers. I've run into
similar situtations with e-mail providers. I might know that a
recipient's mailbox is full and why they cannot receive any more e-mails
but me telling the recipient's e-mail provider is going to have no
effect on fixing this type of lockout. I'm not their e-mail customer.
If I have no other contact for recipient, I can't tell them to clean out
their mailbox so they can receive more new e-mails. I had a buddy whose
company blacklist (in flaky fashion) e-mails that came from Yahoo
senders. Me telling his company about their invalid blacklisting on
Yahoo wouldn't help because I don't work for his company. I'm not their
employee. About the only time you can get someone else (whether you're
an e-mail user or another e-mail provider) to fix their e-mail service
is when the problem exists within their e-mail service, not with a
particular customer of theirs. They'll protect their customer and
ignore external requests to expend their resources on a problem that has
not yet been reported by their own customer.

If you want KPN to kill this asshole's account then complain to KPN, not
to your ISP. For me, filtering is far more effective than hoping some
ignorant or [often deliberately] blind Usenet provider will do anything
about bad behavior by their customers.

VanguardLH wrote:
> "Robert Baer" wrote:
>
>> Ken Whiton wrote:
>>> *-* On Mon, 20 Aug 2012, at 11:26:19 -0700,
>>> *-* In Article< calnet>,
>>> *-* Robert Baer wrote
>>> *-* About Re: Scan - to file vs blank email and attachment vs Send to
>>>
>>>> X-Usenet-Provider: http://www.giganews.com
>>>> X-Complaints-To:
>>>> VanguardLH wrote:
>>>>> "Robert Baer" wrote:
>>>>>> OT subject:
>>>>>> How in the (#$$%!@ heck can we STOP these 2 idiots from
>>>>>> overloading this NG?
>>>>> I'm seeing this thread while visiting the alt.computer newsgroup.
>>> [ ... ]
>>>
>>>>> I see about 1 minute later that you decided to repost (as a new
>>>>> thread) an exact duplicate of your complaint post submitted under
>>>>> this thread. Similarly, you never bothered to identify the "2
>>>>> idiots" to which you were referring. If you're talking about the
>>>>> jumbled mess nym that is flooding the alt.computer newsgroup (and
>>>>> probably elsewhere),
>>> "Probably elsewhere" is correct. I recently read about the same
>>> thing happening in the alt.humor.puns newsgroup.
>>>
>>> [ ... ]
>>>
>>>>> I know and filter out that one KPN-using idiot. I don't what might
>>>>> be the 2nd idiot to which you refer.
>>>> RECENT POSTINGS
>>> [Quoting selected headers, relevant to my comments in this post]
>>>
>>>> From:
>>>> Date: Mon, 20 Aug 2012 17:28:42 +0000 (UTC)
>>>> NNTP-Posting-Host: 213.75.39.19
>>>
>>>> From:
>>>> Date: Mon, 20 Aug 2012 17:33:42 +0000 (UTC)
>>>> NNTP-Posting-Host: 213.75.39.19
>>>
>>>> From:
>>>> Date: Mon, 20 Aug 2012 17:38:43 +0000 (UTC)
>>>> NNTP-Posting-Host: 213.75.39.19
>>>> *** END COPY
>>> VanguardLH is correct that it's one poster. Note that regardless
>>> of which name appears in the "From:" header, all the posts in question
>>> originate from the same IP address (NNTP-Posting-Host: 213.75.39.19).
>>> Here is some selected information extracted from a "whois" look-up on
>>> that address.
>>>
>>> Host static.kpn.net
>>> Location NL, Netherlands
>>>
>>> Organization HN-Plus
>>> ISP Koninklijke KPN N.V.
>>>
>>> remarks: Static IP KPN customers
>>> remarks: Please mail abuse issues to:
>>> remarks: Please mail security issues to:
>>>
>>> You might try e-mailing copies of several of the posts (including
>>> all headers) to KPN's abuse-reporting address. I'd suggest using the
>>> subject "Newsgroup Abuse". With luck KPN will cancel the poster's
>>> account, or otherwise put an end to the flood.
>>>
>>> Note, too, the posts are time-stamped five minutes apart, as if
>>> the postings are automated.
>>>
>>> In response to your comment in a later post:
>>>
>>>> Will send complaint to my ISP (same as NSP).
>>> from the headers of your post (the "X-" headers I quoted above) it
>>> appears that your ISP, LocalNet, doesn't operate their own news
>>> server, but rather outsources news to Giganews.
>>>
>>> Ken Whiton
>> Am not an expert in these things, will take your word for that.
>> The complaint has been forwarded to my ISP, and they have been fairly
>> good in regard to "ordinary" spam.
>
> Your ISP can do nothing about a troll flood in Usenet. They aren't
> operating the NNTP server. Even if they were contracting with Giganews
> to provide Usenet services, Giganews won't do much, either. They are
> *peering* the asshole's articles from somewhere else. The articles are
> getting injected at KPN and getting peered out to other NNTP servers in
> the worldwide mesh network that is Usenet. Eventually through this
> peering the KPN-sourced article gets retrieved by the Giganews server.
> Obviously neither KPN is not employing any spam/flood filtering, like
> using the xxx filter, or the asshole is making sure the number of his
> posts is under the threshold for that filter.
>
> You'll have to send a complaint to KPN to report this asshole. It's
> their customer that is flooding Usenet. Giganews can't do anything
> about how KPN handles the accounts for KPN's customers. I've run into
> similar situtations with e-mail providers. I might know that a
> recipient's mailbox is full and why they cannot receive any more e-mails
> but me telling the recipient's e-mail provider is going to have no
> effect on fixing this type of lockout. I'm not their e-mail customer.
> If I have no other contact for recipient, I can't tell them to clean out
> their mailbox so they can receive more new e-mails. I had a buddy whose
> company blacklist (in flaky fashion) e-mails that came from Yahoo
> senders. Me telling his company about their invalid blacklisting on
> Yahoo wouldn't help because I don't work for his company. I'm not their
> employee. About the only time you can get someone else (whether you're
> an e-mail user or another e-mail provider) to fix their e-mail service
> is when the problem exists within their e-mail service, not with a
> particular customer of theirs. They'll protect their customer and
> ignore external requests to expend their resources on a problem that has
> not yet been reported by their own customer.
>
> If you want KPN to kill this asshole's account then complain to KPN, not
> to your ISP. For me, filtering is far more effective than hoping some
> ignorant or [often deliberately] blind Usenet provider will do anything
> about bad behavior by their customers.

An example of a header from a couple years ago, looks like this. It
included an abuse address.

Message-ID: <4a0fe629$0$29211$703f...@news.kpn.nl>
NNTP-Posting-Host: 213.10.169.52
X-Trace: 1242555945 news.kpn.nl 29211 213.10.169.52:57715
X-Complaints-To: <----

The current spew, looks like this. No abuse address.

Message-ID: <5024bfd7$0$10065$>
Organization: KPN.com
NNTP-Posting-Host: 213.75.39.19
X-Trace: 1344585687 news.kpn.nl 10065 213.75.39.19@kpn/213.75.39.19:56580

A thread in Dutch, claims these are all using the same server. So
there are likely some variations on the abuse address as well.

news.kpn.nl
news.kpnplanet.nl
nova.planet.nl
binaries.news.planet.nl

So maybe , ,
could all be CCed or something.

Paul

wrote:
> Robert Baer wrote:
>
> <Snip>
>> I have been seeing around 100 posts at alt.computer on a DAILY basis
>> from what appears to be two idiots exactly describes as you did ("the
>> jumbled mess nym" in both cases).
>>
>> These posts are in English and the body is an exact copy of the
>> subject, and are something like (faking now) "Good times ^_^".
>>
>> I have heard this nasty (to me) rumor that a filter can be used.
>> First,where is it (SeaMonkey)?
>> Second, how do i use it assuming it exists (have yet to find it)?
>> (by sender?, by something else?)
>> Third,since i saw nothing in the posts referring to KPN,how would it
>> do that "discovery"?
>>
>> Thank you very much for your patience in addressing my abysmal
>> ignorance concerning "filters".
>
> Robert, I'm using SeaMonkey 2.11 and just the other day I made myself a
> filter to get rid of these annoying posts.
>
> 1, In SeaMonkey, go to Tools->Message Filters
> 2. Select the News server/group that you want the filter to apply to (I
> normally do it server wide)
> 3. Give it a name (I usually call it after what I'm filtering on)
> 4. In this case, under the drop-down for "Subject", select "From"
> 5. You would have noted that the posts are coming from more than one
> address, but the server side is the same, so Copy/Paste the server name
> into the empty field to the right of "contains"
> 6. Select what you want to happen to the message.
> 7. Click "OK".
>
> It will not apply to the headers that you've listed today/tonight, but
> for future listings, the filter will apply.
>
> HTH
>
> (If you need further assistance with SeaMonkey, set yourself up a news
> sever for news.mozilla.org and subscribe to the group
> mozilla.support.seamonkey and ask away!!)
>
> (Also you are using SeaMonkey version 2.7.1 ... a bit old, we are now at
> version 2.11)
>
> Daniel
>

.......and then I read, elsewhere in the thread, that Robert had been
given this information before hand!

Daniel