Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

6 May, 2024: The networking issue during the past two days has been identified and fixed.


interests / alt.obituaries / Re: Kill file recipe and legitimate Google Groups users (was: Looks like this site has been hacked)

SubjectAuthor
* Looks like this site has been hackedBill Smith
+* Re: Looks like this site has been hackedA Friend
|`* Re: Looks like this site has been hackedKenny McCormack
| `- Re: Looks like this site has been hackedBill Smith
+- Re: Looks like this site has been hackedLouis Epstein
+- Re: Looks like this site has been hackedMJ Emigh
`* Re: Looks like this site has been hackedMeteorite Debris
 `* Kill file recipe and legitimate Google Groups users (was: Looks like this site hAdam H. Kerman
  `- Re: Kill file recipe and legitimate Google Groups users (was: LooksMINe109

1
Looks like this site has been hacked

<456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com>

  copy mid

https://www.novabbs.com/interests/article-flat.php?id=19301&group=alt.obituaries#19301

  copy link   Newsgroups: alt.obituaries
X-Received: by 2002:a05:620a:151:b0:774:f02:7e59 with SMTP id e17-20020a05620a015100b007740f027e59mr39050qkn.11.1695852211523; Wed, 27 Sep 2023 15:03:31 -0700 (PDT)
X-Received: by 2002:a05:6870:9565:b0:1d6:c007:ff90 with SMTP id v37-20020a056870956500b001d6c007ff90mr1358111oal.6.1695852211303; Wed, 27 Sep 2023 15:03:31 -0700 (PDT)
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!diablo1.usenet.blueworldhosting.com!feeder.usenetexpress.com!tr1.iad1.usenetexpress.com!69.80.99.11.MISMATCH!border-1.nntp.ord.giganews.com!nntp.giganews.com!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: alt.obituaries
Date: Wed, 27 Sep 2023 15:03:30 -0700 (PDT)
Injection-Info: google-groups.googlegroups.com; posting-host=2607:fea8:341e:6000:a8d0:4062:6cd9:13d5; posting-account=A4Aq-woAAAB5qbc18uqghZqKweBNjz1C
NNTP-Posting-Host: 2607:fea8:341e:6000:a8d0:4062:6cd9:13d5
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com>
Subject: Looks like this site has been hacked
From: billcs...@gmail.com (Bill Smith)
Injection-Date: Wed, 27 Sep 2023 22:03:31 +0000
Content-Type: text/plain; charset="UTF-8"
Lines: 0
 by: Bill Smith - Wed, 27 Sep 2023 22:03 UTC

Hopefully someone can clean it up!

Re: Looks like this site has been hacked

<270920231817409515%nope@noway.com>

  copy mid

https://www.novabbs.com/interests/article-flat.php?id=19302&group=alt.obituaries#19302

  copy link   Newsgroups: alt.obituaries
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!diablo1.usenet.blueworldhosting.com!peer02.iad!feed-me.highwinds-media.com!news.highwinds-media.com!fx17.iad.POSTED!not-for-mail
Subject: Re: Looks like this site has been hacked
From: nop...@noway.com (A Friend)
Newsgroups: alt.obituaries
Reply-To: A Friend
Message-ID: <270920231817409515%nope@noway.com>
References: <456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-transfer-encoding: 8bit
User-Agent: Thoth/1.9.1 (Mac OS X)
Lines: 11
X-Complaints-To: abuse(at)newshosting.com
NNTP-Posting-Date: Wed, 27 Sep 2023 22:17:40 UTC
Organization: Newshosting.com - Highest quality at a great price! www.newshosting.com
Date: Wed, 27 Sep 2023 18:17:40 -0400
X-Received-Bytes: 999
 by: A Friend - Wed, 27 Sep 2023 22:17 UTC

In article <456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com>,
Bill Smith <billcs777@gmail.com> wrote:

> Hopefully someone can clean it up!

This isn't a site, it hasn't been hacked, and it can't be cleaned up.

Filter the spam by deleting/skipping over/etc. any post with six or
more question marks in the subject.

Re: Looks like this site has been hacked

<uf2a34$pk6$1@reader2.panix.com>

  copy mid

https://www.novabbs.com/interests/article-flat.php?id=19303&group=alt.obituaries#19303

  copy link   Newsgroups: alt.obituaries
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!panix!.POSTED.12.144.5.2!not-for-mail
From: le...@main.lekno.ws (Louis Epstein)
Newsgroups: alt.obituaries
Subject: Re: Looks like this site has been hacked
Date: Wed, 27 Sep 2023 22:24:36 -0000 (UTC)
Organization: PANIX Public Access Internet and UNIX, NYC
Message-ID: <uf2a34$pk6$1@reader2.panix.com>
References: <456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com>
Injection-Date: Wed, 27 Sep 2023 22:24:36 -0000 (UTC)
Injection-Info: reader2.panix.com; posting-host="12.144.5.2";
logging-data="26246"; mail-complaints-to="abuse@panix.com"
User-Agent: tin/2.6.2-20221225 ("Pittyvaich") (FreeBSD/13.2-RELEASE-p3 (amd64))
 by: Louis Epstein - Wed, 27 Sep 2023 22:24 UTC

Bill Smith <billcs777@gmail.com> wrote:
> Hopefully someone can clean it up!

Newsgroups aren't "sites",they mirror across lots of NNTP servers.

Someone is directing spam to the group.

-=-=-
The World Trade Center towers MUST rise again,
at least as tall as before...or terror has triumphed.

Re: Looks like this site has been hacked

<uf2dvh$1ejqk$1@news.xmission.com>

  copy mid

https://www.novabbs.com/interests/article-flat.php?id=19308&group=alt.obituaries#19308

  copy link   Newsgroups: alt.obituaries
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!xmission!nnrp.xmission!.POSTED.shell.xmission.com!not-for-mail
From: gaze...@shell.xmission.com (Kenny McCormack)
Newsgroups: alt.obituaries
Subject: Re: Looks like this site has been hacked
Date: Wed, 27 Sep 2023 23:30:57 -0000 (UTC)
Organization: The official candy of the new Millennium
Message-ID: <uf2dvh$1ejqk$1@news.xmission.com>
References: <456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com> <270920231817409515%nope@noway.com>
Injection-Date: Wed, 27 Sep 2023 23:30:57 -0000 (UTC)
Injection-Info: news.xmission.com; posting-host="shell.xmission.com:166.70.8.4";
logging-data="1527636"; mail-complaints-to="abuse@xmission.com"
X-Newsreader: trn 4.0-test77 (Sep 1, 2010)
Originator: gazelle@shell.xmission.com (Kenny McCormack)
 by: Kenny McCormack - Wed, 27 Sep 2023 23:30 UTC

In article <270920231817409515%nope@noway.com>, A Friend <A Friend> wrote:
>In article <456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com>,
>Bill Smith <billcs777@gmail.com> wrote:
>
>> Hopefully someone can clean it up!
>
>
>
>This isn't a site, it hasn't been hacked, and it can't be cleaned up.
>
>Filter the spam by deleting/skipping over/etc. any post with six or
>more question marks in the subject.

They aren't really question marks. They are weird high ASCII characters
that (some) newsreaders render onscreen as question marks. The point being
that, in general, you won't be able to match them using question marks.
Apparently, one newsreaders (Forte, used by David Carson) does, as a
special feature, match question mark as a standin for unprintable
characters. This is a good thing, but not generalizable to other
newsreaders.

--
Elect a clown, expect a circus.

Re: Looks like this site has been hacked

<fc9d0c3a-8ec3-4ecc-9341-ebb53c012467n@googlegroups.com>

  copy mid

https://www.novabbs.com/interests/article-flat.php?id=19310&group=alt.obituaries#19310

  copy link   Newsgroups: alt.obituaries
X-Received: by 2002:a05:620a:4d82:b0:76f:1614:575c with SMTP id uw2-20020a05620a4d8200b0076f1614575cmr33763qkn.2.1695865356329;
Wed, 27 Sep 2023 18:42:36 -0700 (PDT)
X-Received: by 2002:a05:6870:638c:b0:1dd:69a:665d with SMTP id
t12-20020a056870638c00b001dd069a665dmr3276356oap.3.1695865356098; Wed, 27 Sep
2023 18:42:36 -0700 (PDT)
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!border-2.nntp.ord.giganews.com!nntp.giganews.com!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: alt.obituaries
Date: Wed, 27 Sep 2023 18:42:35 -0700 (PDT)
In-Reply-To: <uf2dvh$1ejqk$1@news.xmission.com>
Injection-Info: google-groups.googlegroups.com; posting-host=2607:fea8:341e:6000:45ca:389a:8531:a69b;
posting-account=A4Aq-woAAAB5qbc18uqghZqKweBNjz1C
NNTP-Posting-Host: 2607:fea8:341e:6000:45ca:389a:8531:a69b
References: <456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com>
<270920231817409515%nope@noway.com> <uf2dvh$1ejqk$1@news.xmission.com>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <fc9d0c3a-8ec3-4ecc-9341-ebb53c012467n@googlegroups.com>
Subject: Re: Looks like this site has been hacked
From: billcs...@gmail.com (Bill Smith)
Injection-Date: Thu, 28 Sep 2023 01:42:36 +0000
Content-Type: text/plain; charset="UTF-8"
Lines: 0
 by: Bill Smith - Thu, 28 Sep 2023 01:42 UTC

Thanks for the explanations. For now I'm just gonna search convos with "the" in them.

Re: Looks like this site has been hacked

<0cc6b8db-23fe-4bcf-b517-11a05da83e81n@googlegroups.com>

  copy mid

https://www.novabbs.com/interests/article-flat.php?id=19311&group=alt.obituaries#19311

  copy link   Newsgroups: alt.obituaries
X-Received: by 2002:a05:6214:974:b0:649:c819:1b15 with SMTP id do20-20020a056214097400b00649c8191b15mr38541qvb.0.1695866543761;
Wed, 27 Sep 2023 19:02:23 -0700 (PDT)
X-Received: by 2002:aca:d19:0:b0:3ad:aeed:7eeb with SMTP id
25-20020aca0d19000000b003adaeed7eebmr1437332oin.6.1695866543370; Wed, 27 Sep
2023 19:02:23 -0700 (PDT)
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!border-2.nntp.ord.giganews.com!nntp.giganews.com!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: alt.obituaries
Date: Wed, 27 Sep 2023 19:02:23 -0700 (PDT)
In-Reply-To: <456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com>
Injection-Info: google-groups.googlegroups.com; posting-host=2603:8080:f803:390a:48c:d0e5:8c6e:9d4;
posting-account=DJu2qAoAAACtwFGEutZRKqu8vKjM8BGp
NNTP-Posting-Host: 2603:8080:f803:390a:48c:d0e5:8c6e:9d4
References: <456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <0cc6b8db-23fe-4bcf-b517-11a05da83e81n@googlegroups.com>
Subject: Re: Looks like this site has been hacked
From: mj...@mjmagician.com (MJ Emigh)
Injection-Date: Thu, 28 Sep 2023 02:02:23 +0000
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Lines: 9
 by: MJ Emigh - Thu, 28 Sep 2023 02:02 UTC

On Wednesday, September 27, 2023 at 5:03:33 PM UTC-5, Bill Smith wrote:
> Hopefully someone can clean it up!

Doesn't look very promising. I tried to mark all conversations as read, but didn't know I could only do one page at a time, which takes care of (I think) about 50 entries on each page. There are HUNDREDS of pages! This has happened before; just not to this extent. Hopefully, the fun has ended for whoever chose to do this, and we can just pick up where we left off. Cheers, folks!

Re: Looks like this site has been hacked

<13cf25b6-6362-451f-9fc4-a5f7477c2faan@googlegroups.com>

  copy mid

https://www.novabbs.com/interests/article-flat.php?id=19320&group=alt.obituaries#19320

  copy link   Newsgroups: alt.obituaries
X-Received: by 2002:a05:622a:1a1a:b0:40f:e2a5:3100 with SMTP id f26-20020a05622a1a1a00b0040fe2a53100mr15078qtb.6.1695903867838;
Thu, 28 Sep 2023 05:24:27 -0700 (PDT)
X-Received: by 2002:a05:6808:23d1:b0:3a7:86b2:1950 with SMTP id
bq17-20020a05680823d100b003a786b21950mr375789oib.0.1695903867465; Thu, 28 Sep
2023 05:24:27 -0700 (PDT)
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!border-2.nntp.ord.giganews.com!nntp.giganews.com!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: alt.obituaries
Date: Thu, 28 Sep 2023 05:24:27 -0700 (PDT)
In-Reply-To: <456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com>
Injection-Info: google-groups.googlegroups.com; posting-host=66.203.112.96; posting-account=wH6pjgoAAAB3kCu11PkEl71FGWOTLO_p
NNTP-Posting-Host: 66.203.112.96
References: <456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <13cf25b6-6362-451f-9fc4-a5f7477c2faan@googlegroups.com>
Subject: Re: Looks like this site has been hacked
From: peter.gr...@gmail.com (Meteorite Debris)
Injection-Date: Thu, 28 Sep 2023 12:24:27 +0000
Content-Type: text/plain; charset="UTF-8"
Lines: 3
 by: Meteorite Debris - Thu, 28 Sep 2023 12:24 UTC

On Thursday, 28 September 2023 at 07:33:33 UTC+9:30, Bill Smith wrote:
> Hopefully someone can clean it up!

I've reported a lot of these messages as spam. Don't know if it will do any good.

Kill file recipe and legitimate Google Groups users (was: Looks like this site has been hacked)

<uf4223$3neov$1@dont-email.me>

  copy mid

https://www.novabbs.com/interests/article-flat.php?id=19322&group=alt.obituaries#19322

  copy link   Newsgroups: alt.obituaries
Path: i2pn2.org!i2pn.org!eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: ahk...@chinet.com (Adam H. Kerman)
Newsgroups: alt.obituaries
Subject: Kill file recipe and legitimate Google Groups users (was: Looks like this site has been hacked)
Date: Thu, 28 Sep 2023 14:19:47 -0000 (UTC)
Organization: A noiseless patient Spider
Lines: 49
Message-ID: <uf4223$3neov$1@dont-email.me>
References: <456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com> <13cf25b6-6362-451f-9fc4-a5f7477c2faan@googlegroups.com>
Injection-Date: Thu, 28 Sep 2023 14:19:47 -0000 (UTC)
Injection-Info: dont-email.me; posting-host="7a6ad4d1d4636ff7916d1171f4aac5d3";
logging-data="3914527"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19ejzHqRuQ1vw/MJUQF32EPGnSVTgjUkKo="
Cancel-Lock: sha1:AzyCXAX5FpGyUbwenATSVt1Zvu0=
X-Newsreader: trn 4.0-test77 (Sep 1, 2010)
 by: Adam H. Kerman - Thu, 28 Sep 2023 14:19 UTC

Meteorite Debris <peter.gregory.kelly@gmail.com> wrote:
>On Thursday, 28 September 2023 at 07:33:33 UTC+9:30, Bill Smith wrote:

>>Hopefully someone can clean it up!

>I've reported a lot of these messages as spam. Don't know if it will do
>any good.

It doesn't. Google devotes as little staff time to Google Groups as
possible and almost never TOSses a spammer.

You personally can make the decision to become a user on a genuine News
server and use a genuine newsreader that offers flexible kill filing and
scoring techniques. Until you make that decision, you will have no
access to effective techniques eliminating spam originating in Google
Groups.

I am advising those of you using Google Groups to stop using it and
become users on genuine News servers.

After all these days, I've grown weary of the spam. I wrote the recipe
for the trn4 kill file. In my opinion, it's simpler and superior to the
recipe that Kenny wrote for himself.

I'm ignoring From. There are people who use a Gmail address on From who
are ordinary posters and may be users on genuine News servers.

This recipe junks articles injected through Google Groups.

/User-Agent: G2\/1.0/h+:j

/h header
+ act on just the article and not the other articles in the thread
:j junk the article (mark the article read)

Note that the "/" is escaped with "\"

I made exceptions for the four posters who aren't spammers by putting
their recipes ABOVE that line and using /f+:M. I'm including the email
address of "Michael Rhodes" even though whoever's account that is
doesn't participate in discussion, just posts the first paragraph of
articles with a URL.

/h From (faster because the header is available in NEWSOVERVIEW)
+ act on the article only and not the other articles in the thread
:M mark the article

A marked article is hidden till "Y" command is used. The article has to
be hidden from the action that marks articles as read.

Re: Kill file recipe and legitimate Google Groups users (was: Looks like this site has been hacked)

<a0b14472-b7a5-4a3b-a85f-942f9809962cn@googlegroups.com>

  copy mid

https://www.novabbs.com/interests/article-flat.php?id=19323&group=alt.obituaries#19323

  copy link   Newsgroups: alt.obituaries
X-Received: by 2002:a05:622a:1823:b0:412:233d:39dc with SMTP id t35-20020a05622a182300b00412233d39dcmr23331qtc.0.1695912261749;
Thu, 28 Sep 2023 07:44:21 -0700 (PDT)
X-Received: by 2002:a05:6808:178f:b0:3ae:1691:c59f with SMTP id
bg15-20020a056808178f00b003ae1691c59fmr605102oib.1.1695912261498; Thu, 28 Sep
2023 07:44:21 -0700 (PDT)
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!diablo1.usenet.blueworldhosting.com!peer01.iad!feed-me.highwinds-media.com!news.highwinds-media.com!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: alt.obituaries
Date: Thu, 28 Sep 2023 07:44:21 -0700 (PDT)
In-Reply-To: <uf4223$3neov$1@dont-email.me>
Injection-Info: google-groups.googlegroups.com; posting-host=72.177.9.79; posting-account=4f2qDQoAAADUsuUPV-6ImzdOwaXpPtOn
NNTP-Posting-Host: 72.177.9.79
References: <456c42dd-4b2d-4119-bc1f-29d8e75d1ea7n@googlegroups.com>
<13cf25b6-6362-451f-9fc4-a5f7477c2faan@googlegroups.com> <uf4223$3neov$1@dont-email.me>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <a0b14472-b7a5-4a3b-a85f-942f9809962cn@googlegroups.com>
Subject: Re: Kill file recipe and legitimate Google Groups users (was: Looks
like this site has been hacked)
From: smcelr...@austin.rr.com (MINe109)
Injection-Date: Thu, 28 Sep 2023 14:44:21 +0000
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Received-Bytes: 1637
 by: MINe109 - Thu, 28 Sep 2023 14:44 UTC

On Thursday, September 28, 2023 at 9:19:53 AM UTC-5, Adam H. Kerman wrote:

> After all these days, I've grown weary of the spam. I wrote the recipe
> for the trn4 kill file. In my opinion, it's simpler and superior to the
> recipe that Kenny wrote for himself.

Anyone have something that works for Thunderbird?

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor