1. Forum
  2. Usenet
  3. NEWS.ADMIN.NET-ABUSE.USEN

  • Re: @@NCM Eternal September NoCem Bot-spam NoCeM notice (19 articles) 1

    From Adam W.@21:1/5 to nocem@eternal-september.org on Fri Oct 27 20:04:55 2023
    nocem@eternal-september.org wrote:

    Notice-ID: Eternal September NoCem Bot-spam.1698436802
    @@BEGIN NCM BODY
    <7e6c97d2-c@7f4-4df4-937d-da13f45b65f1> de.soc.misc <98599686-a@1c8-4955-bdbd-71d42c36b6ea> de.rec.sport.misc <ba96bd92-9@02e-4f10-8aef-7e3974d3ab42> de.sci.misc

    Looks like you changed something, Ray :)

    Something's wrong with these IDs. @ is inserted at the fixed position, and
    last character of the identifier (and @, and FQDN) is missing.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Ray Banana@21:1/5 to All on Sat Oct 28 04:25:54 2023
    Thus spake gof-cut-this-news@cut-this-chmurka.net.invalid (Adam W.)

    nocem@eternal-september.org wrote:
    Notice-ID: Eternal September NoCem Bot-spam.1698436802
    @@BEGIN NCM BODY
    <7e6c97d2-c@7f4-4df4-937d-da13f45b65f1> de.soc.misc
    <98599686-a@1c8-4955-bdbd-71d42c36b6ea> de.rec.sport.misc
    <ba96bd92-9@02e-4f10-8aef-7e3974d3ab42> de.sci.misc
    Looks like you changed something, Ray :)
    Something's wrong with these IDs. @ is inserted at the fixed position, and last character of the identifier (and @, and FQDN) is missing.

    If you take a closer look at these articles, you will find more
    indications that these articles are generated by a bot.

    There are thousands of these in de.*

    Please mail me for details. When I posted my observations about the
    From: addresses in this group, they were changed within 2 hours.

    --
    Пу́тін — хуйло́
    http://www.eternal-september.org

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Adam W.@21:1/5 to Ray Banana on Sat Oct 28 22:48:32 2023
    Ray Banana <rayban@raybanana.net> wrote:

    Please mail me for details. When I posted my observations about the
    From: addresses in this group, they were changed within 2 hours.

    Hm, so spammers read this group... hopefully Thai ones don't.

    BTW, in recent NoCeMs I found a couple of false-positives:

    <01d424f1-1d96-49e8-abc3-015f005e1b4en@googlegroups.com> <dbd4409d-8c86-4dbb-84cf-8a07ebb22e1an@googlegroups.com> <c55ea3af-dae5-4c6e-9257-3a9d039ecfd8n@googlegroups.com> <2868c8cb-8997-4a36-831f-5dbe6703b3e7n@googlegroups.com> <5e94cf15-a197-4cfb-a959-9371769bfea2n@googlegroups.com> <b18188c8-9827-4cdc-8cd4-6497c82f5e45n@googlegroups.com> <8cdbb446-0f18-462b-aaaf-fbd98f895e20n@googlegroups.com> <d1d68151-1d76-4333-9a69-98152cf81147n@googlegroups.com>

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Spiros Bousbouras@21:1/5 to Adam W. on Sun Oct 29 02:39:44 2023
    On Sat, 28 Oct 2023 22:48:32 -0000 (UTC) gof-cut-this-news@cut-this-chmurka.net.invalid (Adam W.) wrote:
    Ray Banana <rayban@raybanana.net> wrote:

    Please mail me for details. When I posted my observations about the
    From: addresses in this group, they were changed within 2 hours.

    Hm, so spammers read this group... hopefully Thai ones don't.

    Perhaps it's a coincidence ?

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Adam W.@21:1/5 to Spiros Bousbouras on Sun Oct 29 04:43:56 2023
    Spiros Bousbouras <spibou@gmail.com> wrote:

    Hm, so spammers read this group... hopefully Thai ones don't.

    Perhaps it's a coincidence ?

    Maybe yes, maybe not. Why take chances?

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)