novaBBS - news.admin.net-abuse.usenet - Shroomies-Milk Chocolate Edibles for sale online

computers / news.admin.net-abuse.usenet / Shroomies-Milk Chocolate Edibles for sale online

Subject

Author

Shroomies-Milk Chocolate Edibles for sale online

Daniel Lamirande

Shroomies-Milk Chocolate Edibles for sale online

David Ritz

Shroomies-Milk Chocolate Edibles for sale online

<a4e0eab5-a4da-4bc9-af6c-e5d3549d2f33n@googlegroups.com>

copy mid

https://www.novabbs.com/computers/article-flat.php?id=1585&group=news.admin.net-abuse.usenet#1585

copy link Newsgroups: news.admin.net-abuse.usenet

X-Received: by 2002:a05:622a:15c2:b0:3f5:a07:e6d5 with SMTP id d2-20020a05622a15c200b003f50a07e6d5mr883802qty.8.1684031860711;
Sat, 13 May 2023 19:37:40 -0700 (PDT)
X-Received: by 2002:a05:622a:506:b0:3ef:415f:189 with SMTP id
l6-20020a05622a050600b003ef415f0189mr10677157qtx.6.1684031860499; Sat, 13 May
2023 19:37:40 -0700 (PDT)
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!news.misty.com!border-2.nntp.ord.giganews.com!nntp.giganews.com!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: news.admin.net-abuse.usenet
Date: Sat, 13 May 2023 19:37:40 -0700 (PDT)
Injection-Info: google-groups.googlegroups.com; posting-host=213.171.205.132; posting-account=bWfsVwoAAAB3fDBFk44kICh8ZXY6Eier
NNTP-Posting-Host: 213.171.205.132
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <a4e0eab5-a4da-4bc9-af6c-e5d3549d2f33n@googlegroups.com>
Subject: Shroomies-Milk Chocolate Edibles for sale online
From: daniella...@gmail.com (Daniel Lamirande)
Injection-Date: Sun, 14 May 2023 02:37:40 +0000
Content-Type: text/plain; charset="UTF-8"
Lines: 108

by: Daniel Lamirande - Sun, 14 May 2023 02:37 UTC

Re: Shroomies-Milk Chocolate Edibles for sale online

<s5842077-n360-2s9r-17rr-879394943549@zvaqfcevat.pbz>

copy mid

https://www.novabbs.com/computers/article-flat.php?id=1588&group=news.admin.net-abuse.usenet#1588

copy link Newsgroups: news.admin.net-abuse.usenet

Path: i2pn2.org!i2pn.org!news.neodome.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: dri...@mindspring.com (David Ritz)
Newsgroups: news.admin.net-abuse.usenet
Subject: Re: Shroomies-Milk Chocolate Edibles for sale online
Date: Wed, 17 May 2023 20:24:54 -0500
Organization: SpamBusters!
Lines: 293
Message-ID: <s5842077-n360-2s9r-17rr-879394943549@zvaqfcevat.pbz>
References: <a4e0eab5-a4da-4bc9-af6c-e5d3549d2f33n@googlegroups.com> <u3qih7$2grs$45@gallifrey.nk.ca>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
X-Trace: individual.net ZgTAnDLcxBBeRglURl+aMAlVXpG/aNQ6IPpvUM9MTnN6j1g3ai
X-Orig-Path: not-for-mail
Cancel-Lock: sha1:C7Reo5Xq6wOp/iLDQcydKm6kbTc=
In-Reply-To: <u3qih7$2grs$45@gallifrey.nk.ca>
OpenPGP: id=9CD055375C05466038D2194852BC29991A12DEEB
X-Comment-1: Spam is bad. <http://trillian.mit.edu/~jc/humor/WhatIsSpam.html>
X-Comment-2: LART a spammer for Dobbs.
X-Comment-3: Invalid assumptions tend to produce invalid conclusions.
X-Comment-4: This message is intended to be read with a monospaced font.
X-Meow: yes

by: David Ritz - Thu, 18 May 2023 01:24 UTC

On Sunday, 14 May 2023 12:00 -0000,
in article <u3qih7$2grs$45@gallifrey.nk[.]ca>,
Dave "The Doctor" Yadallee <doctor@doctor.nl2k.ab[.]ca> wrote:

> In article <a4e0eab5-a4da-4bc9-af6c-e5d3549d2f33n@googlegroups.com>,
> Daniel Lamirande <daniellamirande45@gmail.com> wrote:
>
> This abusive spamtroll came from

"Spamtrolls" only exist in your mind, Dave. This is spam. It was not
intended to troll you into posting your spammed boiler plate. That,
I'm afraid, is on you.

> news.admin.net-abuse.usenet #127422
^^^^^^
No one particularly cares what the article number is, as it appears in
nan-a.usenet on your server. Additionally, you provide the same
information in the quoted Xref header. added by news.nk[.]ca.

: $ dig +short news.nk[.]ca
: 204.209.81.3

: $ dig +short -x 204.209.81.3
: ns2.nk[.]ca.
: gallifrey.nk[.]ca.
: ns2.nl2k.ab[.]ca.
: uucp.nk[.]ca.

FYI, news.admin.net-abuse.usenet IS NOT a forum for reporting network
abuse incidents.

news.admin.net-abuse.usenet IS a discussion group.

>>>> ftp://ftp.isc[.]org/pub/usenet/control/news/news.admin.net-abuse.gz

If you're going to post, you should be ready to discuss. Spammers see
Usenet as write only medium.

> X-Received: by 2002:a05:622a:15c2:b0:3f5:a07:e6d5 with SMTP id d2-
> + 20020a05622a15c200b003f50a07e6d5mr883802qty.8.1684031860711;
> + Sat, 13 May 2023 19:37:40 -0700 (PDT)
> X-Received: by 2002:a05:622a:506:b0:3ef:415f:189 with SMTP id
> + l6-20020a05622a050600b003ef415f0189mr10677157qtx.6.1684031860499;
> + Sat, 13 May
> + 2023 19:37:40 -0700 (PDT)

These GG internally generated X-Received headers are useful to only
the GOOG. Did you happen to send them where they might be of use, or
were you only interested spreading bovine manure? Posting your
followups to spam is not beneficial to anyone nor anything beyond
buoying your misguided, frivolous and quite meaningless posting count
pursuit.

: $ whois -h whois.abuse[.]net googlegoups[.]com
: abuse@google.com (for googlegoups[.]com)
: abuse@googlegoups[.]com (for googlegroups.com)

> Path: news.nk.ca!news.snarked.org!border-2.nntp.ord.giganews.com!nntp.
> + giganews.com!news-out.google.com!nntp.google.com!postnews.google.com!
> + google-groups.googlegroups.com!not-for-mail
> Newsgroups: news.admin.net-abuse.usenet
> Date: Sat, 13 May 2023 19:37:40 -0700 (PDT)
> Injection-Info: google-groups.googlegroups.com; posting-host=213.171.205.132;
> + posting-account=bWfsVwoAAAB3fDBFk44kICh8ZXY6Eier
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The posting account is unique to this luser and tied to the email address
shown in the From header, daniellamirande45@gmail.com.

Yes, the spam in question did, indeed, propagate via Google Groups.
It ended up littering your news spool. It didn't have to, as the
original did not appear on some of the servers I checked.

: STAT <a4e0eab5-a4da-4bc9-af6c-e5d3549d2f33n@googlegroups.com>
: 430 No such article

> NNTP-Posting-Host: 213.171.205.132

This, not Google, is the source of the spam in question.

: $ dig +short -x 213.171.205.132
: server205-132.live-servers.net.

: $ whois -h whois.ripe.net -- -B 213.171.205.132 | grep -i abuse
: % Abuse contact for '213.171.204.0 - 213.171.207.255' is 'abuse@fasthosts.co.uk'
: abuse-c: FH4126-RIPE
: abuse-mailbox: abuse@fasthosts.co.uk
: remarks: Please report abuse to abuse@fasthosts.co.uk
: remarks: Abuse reports via other channels may be ignored

So, !The Doctor, is there any chance you might have reported the spam
in question to fasthosts.co.uk?

What about notifying their routing provider, if you cannot get a
response:

: $ ripe -- -B 213.171.205.132 | grep ^origin
: origin: AS8560

$ whois -h whois.ripe.net -- -B AS8560 | grep -i abuse
% Abuse contact for 'AS8560' is 'abuse@ionos[.]com'
remarks: abuse issues : abuse(at)oneandone[.]net
abuse-c: ABDE2-RIPE
abuse-mailbox: abuse@ionos[.]com
abuse-mailbox: abuse@ionos[.]com

> User-Agent: G2/1.0

G2 (Google Groups)) is the most popular news client in the world. I
wouldn't wish it on my worst enemy.

> MIME-Version: 1.0
> Message-ID: <a4e0eab5-a4da-4bc9-af6c-e5d3549d2f33n@googlegroups.com>

See http://al.howardknight.net/?ID=168435896700

The spamvertised domain is primepsychedelicz[.]com. It's currently
located at 172.93.123.169.

: $ dig +short primepsychedelicz[.]com
: 172.93.123.169

Is there any chance you reported the spam to the entity hosting the
spamvertised web site, Host4Geeks LLC?

: $ whois -h whois.arin[.]net 172.93.123.169 | grep -i org
: Organization: Host4Geeks LLC (HOSTG-6)
: OrgName: Host4Geeks LLC
: OrgId: HOSTG-6
: OrgTechHandle: TECHP39-ARIN
: OrgTechName: Tech POC
: OrgTechPhone: +1-855-737-4335
: OrgTechEmail: support@h4g[.]co
: OrgTechRef: https://rdap.arin[.]net/registry/entity/TECHP39-ARIN
: OrgAbuseHandle: ART20-ARIN
: OrgAbuseName: Abuse Response Team
: OrgAbusePhone: +1-855-737-4335
: OrgAbuseEmail: abuse.support@h4g[.]co
: OrgAbuseRef: https://rdap.arin[.]net/registry/entity/ART20-ARIN
: OrgNOCHandle: HOSTG-ARIN
: OrgNOCName: Host4Geeks NOC
: OrgNOCPhone: +1-855-737-4335
: OrgNOCEmail: noc@h4g[.]co
: OrgNOCRef: https://rdap.arin[.]net/registry/entity/HOSTG-ARIN

: $ whois -h whois.arin[.]net 172.93.123.169 | grep -i abuse
: OrgAbuseHandle: ART20-ARIN
: OrgAbuseName: Abuse Response Team
: OrgAbusePhone: +1-855-737-4335
: OrgAbuseEmail: abuse.support@h4g[.]co
: OrgAbuseRef: https://rdap.arin[.]net/registry/entity/ART20-ARIN
: RAbuseHandle: ART20-ARIN
: RAbuseName: Abuse Response Team
: RAbusePhone: +1-855-737-4335
: RAbuseEmail: abuse.support@h4g[.]co
: RAbuseRef: https://rdap.arin[.]net/registry/entity/ART20-ARIN

Was this the same hosting, as when you first posted your templated and
scripted response, or have they moved?

> Subject: Shroomies-Milk Chocolate Edibles for sale online
> From: Daniel Lamirande <daniellamirande45@gmail.com>

While vaguely interesting, this throw-away freemail address refers to a
validated GG posting account. For the account to post, it must be valid.

: $ dig +short MX gmail.com
: 5 gmail-smtp-in.l.google[.]com.
: 40 alt4.gmail-smtp-in.l.google[.]com.
: 10 alt1.gmail-smtp-in.l.google[.]com.
: 30 alt3.gmail-smtp-in.l.google[.]com.
: 20 alt2.gmail-smtp-in.l.google[.]com.

: $ telnet alt1.gmail-smtp-in.l.google[.]com 25
: Trying 2a00:1450:4010:c1c::1b...
: telnet: connect to address 2a00:1450:4010:c1c::1b: No route to host
: Trying 142.250.150.27...
: Connected to alt1.gmail-smtp-in.l.google[.]com.
: Escape character is '^]'.
: 220 mx.google[.]com ESMTP u4-20020a2e91c4000000b002ab0fdbae75si10603180ljg.81 - gsmtp
: EHLO X.X.X.X
: 250-mx.google[.]com at your service, [X.X.X.X]
: 250-SIZE 157286400
: 250-8BITMIME
: 250-STARTTLS
: 250-ENHANCEDSTATUSCODES
: 250-PIPELINING
: 250-CHUNKING
: 250 SMTPUTF8
: MAIL FROM:<daniellamirande45@gmail.com>
: 250 2.1.0 OK u4-20020a2e91c4000000b002ab0fdbae75si10603180ljg.81 - gsmtp
: RCPT TO:<daniellamirande45@gmail.com>
: 250 2.1.5 OK u4-20020a2e91c4000000b002ab0fdbae75si10603180ljg.81 - gsmtp
: RSET
: 250 2.1.5 Flushed u4-20020a2e91c4000000b002ab0fdbae75si10603180ljg.81 - gsmtp
: QUIT
: 221 2.0.0 closing connection u4-20020a2e91c4000000b002ab0fdbae75si10603180ljg.81 - gsmtp
: Connection closed by foreign host.

> Injection-Date: Sun, 14 May 2023 02:37:40 +0000
> Content-Type: text/plain; charset="UTF-8"
> Lines: 108
> Xref: news.nk.ca news.admin.net-abuse.usenet:127422
^^^^^^

One of these references is redundant, but so are you, Dave.

> Spamtrollers are trolls posting useless spam thinking it is content
> but are posting useless noise. Spamtrolls are newsgroup vandals!
> Thoses trolls are as bad as Donald
> Trump on Twitter.

Posting this boiler plate again and again, all over the network, is what,
in part, defines you as a spammer, Dave. You set quite the example.

Recent stats for rec.arts.drwho (used as an example):

: $ grep ^Trump mail/dy.txt | count
: 519 Trump on Twitter.

> This makes
> https://groups.google.com/search/conversations?q=Depeer%20Google%20Groups

groups.google.com shows 55200 matches for your spammed string, Dave. When
might you consider following your own advice?

> Depeer Google groups Now!!

Please do so, Dave. It would be far more productive than your experiment
in public masturbation. Your spam is regressive. It cannot cause
progress.

> Spamtroller TiSaBr, thou art rebuked in the Name of Yahweh the Father,
> Lord Jesus Christ the Son and the Holy Spirit for Jesus has all authority here
> and Satan has no authority here!

Q. Where have I previously encountered that spammed religiosity?

Click here to read the complete article

"my terminal is a lethal teaspoon." -- Patricia O Tuama

computers / news.admin.net-abuse.usenet / Shroomies-Milk Chocolate Edibles for sale online