XPost: news.admin.peering, news.admin.misc

Hi,

Is anyone else seeing spam from @gmail.com addresses with the Path:
showing that the messages are coming from news.xlned.com / ams1 (in some permutation)?

I've seen six messages today when I haven't seen much non-GG / non-troll
spam in quite a while.

I'm wondering if some of the spammers have realized that the free ride
that was GG is over and starting to look elsewhere for service.

N.B. I've set Followup-To: news.admin.net-abuse.usenet.



--
Grant. . . .

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Am 14.12.2023 um 21:39:16 Uhr schrieb Grant Taylor:

I'm wondering if some of the spammers have realized that the free
ride that was GG is over and starting to look elsewhere for service.

IIRC I read that some already tried to use E-S to post Thai spam, but
the filter stopped them.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Marco Moock wrote:

Am 14.12.2023 um 21:39:16 Uhr schrieb Grant Taylor:

I'm wondering if some of the spammers have realized that the free
ride that was GG is over and starting to look elsewhere for service.

IIRC I read that some already tried to use E-S to post Thai spam, but
the filter stopped them.

I would hope that attempts to spam via E-S - or other similar candidates
- would give the admins of these servers a better clue as to who is
behind this stuff.
That's the optimistic standpoint, the pessimistic one is that they will
find another server whose admins simply don't care.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Am 15.12.2023 um 12:15:16 Uhr schrieb Andrew:

Marco Moock wrote:

Am 14.12.2023 um 21:39:16 Uhr schrieb Grant Taylor:

I'm wondering if some of the spammers have realized that the free
ride that was GG is over and starting to look elsewhere for
service.

IIRC I read that some already tried to use E-S to post Thai spam,
but the filter stopped them.

I would hope that attempts to spam via E-S - or other similar
candidates
- would give the admins of these servers a better clue as to who is
behind this stuff.
That's the optimistic standpoint, the pessimistic one is that they
will find another server whose admins simply don't care.

Google already gives that - the IP addresses of the spamming systems
are known, the ISP of them mostly don't care.
Just check those IPs and network in dnsbl list about email spam.
They are full of email spammers too and the ISPs accept that.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Thu, 14 Dec 2023 21:39:16 -0600, Grant Taylor wrote:

Hi,

Is anyone else seeing spam from @gmail.com addresses with the Path:
showing that the messages are coming from news.xlned.com / ams1 (in some permutation)?

I've seen six messages today when I haven't seen much non-GG / non-troll
spam in quite a while.

I noticed that a few days ago and modified my filters. I haven't been
watching if it's continuing as I don't see the spam now.

Whether they have a @gmail.com address or not, I didn't check. That's not
a header I filter, it's too simple to spoof.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 12/15/23 08:03, Retro Guy wrote:

I noticed that a few days ago and modified my filters. I haven't been watching if it's continuing as I don't see the spam now.

I saw a few more messages already today.

Whether they have a @gmail.com address or not, I didn't check. That's
not a header I filter, it's too simple to spoof.

Agreed.

I just wonder if some spammers are finding that their playground is
coming to and end and the rats are jumping ship.



--
Grant. . . .

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

In article <ulhcq8$1sc3p$[email protected]>,
Marco Moock <[email protected]> wrote:

Am 15.12.2023 um 12:15:16 Uhr schrieb Andrew:

Marco Moock wrote:

Am 14.12.2023 um 21:39:16 Uhr schrieb Grant Taylor:

I'm wondering if some of the spammers have realized that the free
ride that was GG is over and starting to look elsewhere for
service.

IIRC I read that some already tried to use E-S to post Thai spam,
but the filter stopped them.

I would hope that attempts to spam via E-S - or other similar
candidates
- would give the admins of these servers a better clue as to who is
behind this stuff.
That's the optimistic standpoint, the pessimistic one is that they
will find another server whose admins simply don't care.

Google already gives that - the IP addresses of the spamming systems
are known, the ISP of them mostly don't care.
Just check those IPs and network in dnsbl list about email spam.
They are full of email spammers too and the ISPs accept that.

Incompetence for you!
--
Member - Liberal International This is [email protected] Ici [email protected]
Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism ; unsubscribe from Google Groups to be seen Merry Christmas 2023 and Happy New year 2024 Beware https://mindspring.com

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

In article <ulhmcb$3qb38$[email protected]>, Retro Guy <[email protected]> wrote: >On Thu, 14 Dec 2023 21:39:16 -0600, Grant Taylor wrote:

Hi,

Is anyone else seeing spam from @gmail.com addresses with the Path:
showing that the messages are coming from news.xlned.com / ams1 (in some
permutation)?

I've seen six messages today when I haven't seen much non-GG / non-troll
spam in quite a while.

I noticed that a few days ago and modified my filters. I haven't been >watching if it's continuing as I don't see the spam now.

Whether they have a @gmail.com address or not, I didn't check. That's not
a header I filter, it's too simple to spoof.

I will filter GG until 1 MArch 2024!
--
Member - Liberal International This is [email protected] Ici [email protected]
Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism ; unsubscribe from Google Groups to be seen Merry Christmas 2023 and Happy New year 2024 Beware https://mindspring.com

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

In article <ulhrmb$em1$[email protected]>,
Grant Taylor <[email protected]> wrote:

On 12/15/23 08:03, Retro Guy wrote:

I noticed that a few days ago and modified my filters. I haven't been
watching if it's continuing as I don't see the spam now.

I saw a few more messages already today.

Whether they have a @gmail.com address or not, I didn't check. That's
not a header I filter, it's too simple to spoof.

Agreed.

I just wonder if some spammers are finding that their playground is
coming to and end and the rats are jumping ship.

WEll I will not sign up Google abusers!

--
Grant. . . .

--
Member - Liberal International This is [email protected] Ici [email protected]
Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism ; unsubscribe from Google Groups to be seen Merry Christmas 2023 and Happy New year 2024 Beware https://mindspring.com

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi,
Grant Taylor a tapoté le 15/12/2023 04:39:

I noticed that a few days ago and modified my filters. I haven't been watching if it's continuing as I don't see the spam now.

Could you give some Message-ID, Newsgroups?

--
Stéphane

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Sat, 16 Dec 2023 10:23:38 +0100, yamo' wrote:

Hi,
Grant Taylor a tapoté le 15/12/2023 04:39:

I noticed that a few days ago and modified my filters. I haven't been
watching if it's continuing as I don't see the spam now.

Could you give some Message-ID, Newsgroups?

These are some from 13 Dec. They are listed in NoCeM: <[email protected]>

-----
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> comp.compression <[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> comp.compression <[email protected]> comp.compression <[email protected]> comp.compression <[email protected]> comp.compression <[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<[email protected]> microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 12/16/23 03:23, yamo' wrote:

Could you give some Message-ID, Newsgroups?

Sure.

Message-ID: <[email protected]>
Message-ID: <[email protected]>
Message-ID: <[email protected]>
Message-ID: <[email protected]>
Message-ID: <[email protected]>
Message-ID: <[email protected]>
Message-ID: <[email protected]>
Message-ID: <[email protected]>

Let me know if you want anything else.



--
Grant. . . .

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Grant Taylor <[email protected]> wrote:

On 12/16/23 03:23, yamo' wrote:

Could you give some Message-ID, Newsgroups?

Sure.

Message-ID: <[email protected]>
Message-ID: <[email protected]>
Message-ID: <[email protected]>
Message-ID: <[email protected]>
Message-ID: <[email protected]>
Message-ID: <[email protected]>
Message-ID: <[email protected]>
Message-ID: <[email protected]>

Let me know if you want anything else.

I've only looked at the first one, but not only their drugs are
psychedelic, but so is their list of Newsgroups:

Newsgroups: comp.compression,microsoft.public.mac.office.word,alt.sys.pdp10,comp.lang.lisp,bit.listserv.ibm-main,mmicrosoft.public.word.docmanagement

Note the pdp10, the microsoft.*, the stuttering, etc.! :-)

Their NSP is UsenetServer, which is not evident from the Path:, but is
shown in the X-Complaints-To and Organization:

Path: ...!npeer.as286.net!npeer-ng0.as286.net!peer02.ams1!peer.ams1.xlned.com!news.xlned.com!fx10.ams1.POSTED!not-for-mail
X-Complaints-To: [email protected]
Organization: UsenetServer - www.usenetserver.com

Judging from their User-Agent header, they're cheapskates (unless
that's faked (but then the Message-ID is faked as well)):

User-Agent: ForteAgent/8.00.32.1272 trialware

FWIW, I've a filter for all-caps Subject:s since eons:

Subject: BEST DMT CARTS FOR SALE AND DMT VAPE PENS FOR SALE IN UK

All in all, AFAICT, this is 'normal' Usenet spam, nothing out of the ordinary.

P.S. Sorry for the Dutch aspects. Normally the slogan is "If it ain't
Dutch, it ain't much!", but in this case, the slogan doesn't seem to
apply! :-)

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 12/16/23 14:21, Frank Slootweg wrote:

I've only looked at the first one, but not only their drugs are
psychedelic, but so is their list of Newsgroups:

Agreed.

Their NSP is UsenetServer, which is not evident from the Path:,
but is shown in the X-Complaints-To and Organization:

I noticed that too.

Judging from their User-Agent header, they're cheapskates (unless
that's faked (but then the Message-ID is faked as well)):

The Message-ID may be a forgery, but it is the ID that the message goes
by none-the-less. So ... is it really a /fake/? }:-)

FWIW, I've a filter for all-caps Subject:s since eons:

Prior to the recent Google BS I largely left cleanfeed at defaults.
I've had to get more stringent before simply adding Google as a banned
host in the Path: header.

All in all, AFAICT, this is 'normal' Usenet spam, nothing out of
the ordinary.

Agreed.

P.S. Sorry for the Dutch aspects. Normally the slogan is "If it ain't
Dutch, it ain't much!", but in this case, the slogan doesn't seem to
apply! :-)

You're fine.



--
Grant. . . .

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi,
Retro Guy a tapoté le 16/12/2023 11:42:

These are some from 13 Dec. They are listed in NoCeM: <[email protected]>

Thanks!
So they have been catched by the bot, good news.

I have also updated my cleanfeed.local

--
Stéphane

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi,
Grant Taylor a tapoté le 16/12/2023 20:46:

Let me know if you want anything else.

Thanks a lot Grant!

--
Stéphane

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 12/17/23 13:18, yamo' wrote:

Thanks a lot Grant!

You're welcome.



--
Grant. . . .

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)