UK gardening - Advice on how to stop spam

Author

Advice on how to stop spam

Judith Lea

2005-07-26, 8:21 am

Could anyone tell me how to stop newsgroup spam - I have reported it to
Demon but nothing seems to be happening - is there anything I can do
this end?
--
Judith Lea

Mike

2005-07-26, 9:21 am

"Judith Lea" <lsplee@nanime.demon.co.uk> wrote in message
news:wdkay0Bneh5CFwsF@nanime.demon.co.uk...
> Could anyone tell me how to stop newsgroup spam - I have reported it to
> Demon but nothing seems to be happening - is there anything I can do
> this end?
> --
> Judith Lea

If it is Demon they won't do anything. The spam is not being fed out by one
of their clients. They will only attack you as a Demon client if someone
makes a complaint against you. They will act against you first, then ask
questions.

Been there, done that, threatened Solicitor action, got the apology.

Mike
Who never knowingly tells lies

Martin

2005-07-26, 9:21 am

On Tue, 26 Jul 2005 11:22:33 +0000 (UTC), "Mike" <not@here.thank.you>
wrote:

>
>"Judith Lea" <lsplee@nanime.demon.co.uk> wrote in message
>news:wdkay0Bneh5CFwsF@nanime.demon.co.uk...
>
>If it is Demon they won't do anything. The spam is not being fed out by one
>of their clients. They will only attack you as a Demon client if someone
>makes a complaint against you. They will act against you first, then ask
>questions.
>
>Been there, done that, threatened Solicitor action, got the apology.
>
>Mike
>Who never knowingly tells lies
>

and doesn't use Demon anymore?
--
Martin

Martin

2005-07-26, 9:21 am

On Tue, 26 Jul 2005 11:59:51 +0100, Judith Lea
<lsplee@nanime.demon.co.uk> wrote:

>Could anyone tell me how to stop newsgroup spam - I have reported it to
>Demon but nothing seems to be happening - is there anything I can do
>this end?

Try filtering out the subject and the posters?
--
Martin

Mike

2005-07-26, 9:21 am

>
> and doesn't use Demon anymore?
> --

:-))

correct :-))

Martin

2005-07-26, 9:21 am

On Tue, 26 Jul 2005 11:34:03 +0000 (UTC), "Mike" <not@here.thank.you>
wrote:

>
>:-))
>
>correct :-))
>

You picked a good ISP if you want to spam judging from ....

For BT's case 4 &5 ignore their advice, instead contact the local
police.

________________________________________________________

Please read this email carefully as it contains important information
about the BT Acceptable Use Policy and the BT Customer Security team.

The BT Customer Security team investigates every report we receive and
where applicable, we'll do our best to reply within three working
days, particularly if we need more information.

The BT Customer Security team will investigate all allegations of
misuse and if we find that a BT customer is in breach of the BT Terms
& Conditions and / or Acceptable Use Policy we'll take appropriate
action against the account holder.

All cases of abuse are taken very seriously. However, we can only take
action where the misuse originates from our network or customer base.

TYPES OF ABUSE THAT SHOULD BE REPORTED TO BT

First, please report abuse where someone using a BT domain or a BT IP
address has undertaken the activity.

The domains in question include:
btinternet.com
btopenworld.com
btconnect.com
btbusinessoffice.com
btbroadbandoffice.com
btclick.com
talk21.com

Secondly, you should report abuse to BT where the abuse originates
from an IP address used by BT. For more information, please go to
http://www.ripe.net

Thirdly, you should report abuse to BT if the abuse originates from a
BT service or application, i.e. a BT email service such as talk21,
btinternet.com or any other application supported or maintained by BT.

Please see the notes below for more information.

Legal constraints prevent us giving you specific information about any
action we may take against an offender, but if you believe a BT
customer has carried out an illegal activity over the internet, then
you should immediately contact your local police force to report this.
When going to the police you should make sure that you've any
supporting information that might be available. We're sorry, but BT
isn't in a position to report allegations of illegal activity to the
police on your behalf.

Please note: this is an automatic email and we're unable to respond to
replies sent to this address.

Thank you for reporting this case to us; we appreciate your help and
co-operation in this matter.

Yours sincerely,

BT Customer Security team
http://www.abuse-guidance.com/

For more information please see the notes below:

1. Abuse from a non-BT network
We're sorry, but BT can't take action where the origin of the abuse is
from a non-BT customer. In these circumstances please report the abuse
directly to the offender's Internet Service Provider (ISP). The
easiest way to identify the source ISP is to find the IP address from
where the abuse originates. You can identify the ISP using a web-based
tool - please go to
http://www.ripe.net
Select the Whois db and enter the relevant IP address. An email
address for reporting abuse is usually included in the page that
opens.

2. Reporting of unsolicited email (spam)
Please include your original email on this subject with any and all
subsequent emails, so that we can maintain continuity and quickly deal
with your concerns.
Because of the way the internet operates it isn't always possible to
trust the information shown in the 'From' and even 'To' address. We
therefore need the header information that shows the true origin of
the email (please see 6 below). Please include the full header
information that shows the IP address relevant to your report. It's
possible that emails appearing to be from trusted parties may have
been generated by a virus waiting for an unsuspecting person to open
it, so please take care.

Please send us reports of spam that originate only from our network.
We can't take action on behalf of other ISPs. Please make sure that
you include the header information so that we can act quickly.

3. Email not addressed to me
Senders of bulk email often put random email addresses in the 'To'
field of email being sent. They then Blind Carbon Copy (BCC) to other
recipients, so that the email appears to be addressed to someone else.

4. Child Abuse Online
If you're concerned about the comments, actions or behaviour of an
individual online, and if you fear that a child is at risk, please
send a report to the Virtual Global Taskforce at:
http://www.virtualglobaltaskforce.com. The Taskforce comprises police
forces from around the world, including the National Crime Squad in
the UK, and works to make the Internet a safer place for children.
The Taskforce website also provides related information, advice and
support.

5. Pornographic material
If you're faced with illegal material please send a report to the
Internet Watch Foundation. You can do this directly via the web at
http://www.iwf.org.uk/index.html

The IWF works with international bodies to remove illegal material
from the internet.

6. BT Yahoo! SpamGuard
BT Yahoo! Internet users can use email filtering to reduce the amount
of spam (unsolicited junk email) received. BT Yahoo! SpamGuard is
automatically switched on for all accounts when a customer signs up
for the service. It's impossible for any email filtering to be 100%
effective, so we recommend that you check any filtered email to make
sure that it hasn't been incorrectly identified as spam. This is easy
to do via webmail. In addition it's very easy to report mail that
hasn't been filtered, via the 'This is spam' tab at the top of the
webmail page.

7. Header information
Emails contain header information not usually seen by the recipient.
The header contains details of where the email came from and the path
it took through the internet. Please include this information with
reports of spam as it provides evidence of the email's origin.
Here's how to do this in Outlook Express:
- select the email in question and click on 'File' and
then 'Properties'
- please copy and paste this information into an email and
send it on to us

To find headers using other email software, please refer to that email
software's Help section. If you still need some help viewing email
headers, please contact your Internet Service Provider (ISP) for
advice or visit a free spam report web site for more information. One
such site is
http://spamcop.net/

8. Firewall logs and port scanning
Firewalls help prevent unwanted access to your computer by monitoring
the ports on your computer. Logs are produced by the firewall to show
the ports that are scanned. If you're contacting us about a possible
port scan please include your firewall log so that we can carry out a
full investigation. Before doing this, however, please be aware that
what is sometimes thought to be a port scan is nothing more than the
'background noise of the internet'. If you're still concerned, and you
run firewall software, you should be able to find your IP log in your
firewall software control panel - the IP log is sometimes called
'Events' or something similar. This will show us the time and origin
of the attack, and help us identify those responsible so that further
action may be taken.
We also need to know the time zone used by your computer (e.g.
Greenwich Mean Time). If you're not sure of this, please doubleclick
on the time display on your computer screen (usually in the bottom
right-hand corner). This will open a window showing your clock
settings.

9. BT port scan
To help protect our users and the network BT periodically carries out
port scanning activity. We do this to detect and contact customers
with open servers. Using open servers is a breach of the BT Terms &
Conditions / Acceptable Use Policies. For more details, please go to
http://www.abuse-guidance.com

--
Martin

Sacha

2005-07-26, 10:21 am

On 26/7/05 12:30, in article ql7ce1hi8s06fkroisj9i9qi15c9t5af2b@4ax.com,
"Martin" <me@privacy.net> wrote:

> On Tue, 26 Jul 2005 11:59:51 +0100, Judith Lea
> <lsplee@nanime.demon.co.uk> wrote:
>
>
> Try filtering out the subject and the posters?

Nobody can filter the amount of junk that's been sent to this group lately.
Judith needs an ISP that helps to do some of that. Freeserve, who I used,
seemed to stop a lot of it, but not all of it.
--
Sacha
www.hillhousenursery.co.uk
South Devon
(remove the weeds to email me)

usenet@isbd.co.uk

2005-07-26, 10:21 am

Sacha <sacha@gardenweedws506.fsnet.co.uk> wrote:
> On 26/7/05 12:30, in article ql7ce1hi8s06fkroisj9i9qi15c9t5af2b@4ax.com,
> "Martin" <me@privacy.net> wrote:
>
>
> Nobody can filter the amount of junk that's been sent to this group lately.
> Judith needs an ISP that helps to do some of that. Freeserve, who I used,
> seemed to stop a lot of it, but not all of it.

.... but with a decent newsreader it's trivial to ignore even that huge
amount of junk. It took me only a few seconds to realise what had
happened, look to see if anything interesting was interspersed and
then 'mark as read' the whole lot.

--
Chris Green

Martin

2005-07-26, 10:21 am

On Tue, 26 Jul 2005 13:32:41 +0100, Sacha
<sacha@gardenweedws506.fsnet.co.uk> wrote:

>On 26/7/05 12:30, in article ql7ce1hi8s06fkroisj9i9qi15c9t5af2b@4ax.com,
>"Martin" <me@privacy.net> wrote:
>
>
>Nobody can filter the amount of junk that's been sent to this group lately.
>Judith needs an ISP that helps to do some of that. Freeserve, who I used,
>seemed to stop a lot of it, but not all of it.

Somebody claimed to have filtered the whole lot. I only got one big
burst of troll messages.
--
Martin

Martin Brown

2005-07-26, 11:21 am

Judith Lea wrote:

> Could anyone tell me how to stop newsgroup spam - I have reported it to
> Demon but nothing seems to be happening - is there anything I can do
> this end?

The short answer is you can't reliably, but if you are prepared to
accept a small risk of collateral damage block the zones of the internet
that are littered with open mail relays and dozy sysops - notably:

*.hk
*.kr

Ask on d.i.s.turnpike for details of a custom rule to do it.

I think Custom rule reject /^X-Trace.*\.kr/h
or something like ought to do it NB UNTESTED

It will also bin anything posted by legit Hong kong users into u.r.g
Try it at your own risk!

Regards,
Martin Brown

Ceri Davies

2005-07-26, 12:21 pm

On 2005-07-26, Martin <me@privacy.net> wrote:
> On Tue, 26 Jul 2005 13:32:41 +0100, Sacha
><sacha@gardenweedws506.fsnet.co.uk> wrote:
>
>
> Somebody claimed to have filtered the whole lot. I only got one big
> burst of troll messages.

This basically got them all, but I doubt that there are many slrn users
here:

[uk.rec.gardening]
Score: =-9999 % Spamming twat
Expires: 12/31/2008
% Kill anything with one of these in
{::
NNTP-Posting-Host: 221.124.129.*
NNTP-Posting-Host: 222.106.21.*
X-Complaints-To: abuse@net-yan.com
Path: .*kornet.net.*
}

Ceri
--
Only two things are infinite, the universe and human stupidity, and I'm
not sure about the former. -- Einstein (attrib.)

Bob Hobden

2005-07-26, 12:21 pm

"Sacha" wrote after...
> "Martin" wrote in reply to Judith Lea
>
> Nobody can filter the amount of junk that's been sent to this group
> lately.
> Judith needs an ISP that helps to do some of that. Freeserve, who I used,
> seemed to stop a lot of it, but not all of it.
>
http://news.individual.net did a good job, well worth the 10 EUR (few £'s) a
year, some spam/crossposted junk appeared for a few hours then disappeared
when they caught up.

--
Regards
Bob
In Runnymede, 17 miles West of London

usenet@isbd.co.uk

2005-07-26, 12:21 pm

Ceri Davies <ceri_usenet@submonkey.net> wrote:
>
> This basically got them all, but I doubt that there are many slrn users
> here:
>
> [uk.rec.gardening]
> Score: =-9999 % Spamming twat
> Expires: 12/31/2008
> % Kill anything with one of these in
> {::
> NNTP-Posting-Host: 221.124.129.*
> NNTP-Posting-Host: 222.106.21.*
> X-Complaints-To: abuse@net-yan.com
> Path: .*kornet.net.*
> }
>
But was it worth the effort of doing even that, the IP addresses will
be different next time around (probably) so that's only a one off
filter. With slrn (as with tin that I use) it's a matter of only a
few seconds to skip past all the junk and then mark it as read.

--
Chris Green

Sacha

2005-07-26, 12:21 pm

On 26/7/05 13:41, in article 3kmpbiFugbbcU1@individual.net,
"usenet@isbd.co.uk" <usenet@isbd.co.uk> wrote:

> Sacha <sacha@gardenweedws506.fsnet.co.uk> wrote:
>
> ... but with a decent newsreader it's trivial to ignore even that huge
> amount of junk. It took me only a few seconds to realise what had
> happened, look to see if anything interesting was interspersed and
> then 'mark as read' the whole lot.

So what would you recommend Judith to use?
--
Sacha
www.hillhousenursery.co.uk
South Devon
(remove the weeds to email me)

Ceri Davies

2005-07-26, 1:21 pm

On 2005-07-26, usenet@isbd.co.uk <usenet@isbd.co.uk> wrote:
> Ceri Davies <ceri_usenet@submonkey.net> wrote:
> But was it worth the effort of doing even that, the IP addresses will
> be different next time around (probably) so that's only a one off
> filter.

Not really; it kills "anything with one of th[o]se in", as per the
comment.

> With slrn (as with tin that I use) it's a matter of only a
> few seconds to skip past all the junk and then mark it as read.

Assuming that the junk comes in blocks.

Either way, I have no desire to argue over whether this or that is a
good solution. I was simply pointing out that it was trivially possible
to get rid of all the crap posts having looked at two of them.

Ceri
--
Only two things are infinite, the universe and human stupidity, and I'm
not sure about the former. -- Einstein (attrib.)

Kay

2005-07-26, 2:21 pm

In article <3kmpbiFugbbcU1@individual.net>, usenet@isbd.co.uk writes
>Sacha <sacha@gardenweedws506.fsnet.co.uk> wrote:

Hardly. A mailbomb attack depends on each of the 1000 or so emails
having a different subject and apparent poster.[color=darkred]
>
>... but with a decent newsreader it's trivial to ignore even that huge
>amount of junk. It took me only a few seconds to realise what had
>happened, look to see if anything interesting was interspersed and
>then 'mark as read' the whole lot.
>
Fine if you have broadband but a pain if you have to wait for that lot
to download over a phone connection.

--
Kay
"Do not insult the crocodile until you have crossed the river"

Jaques d'Alltrades

2005-07-26, 4:21 pm

The message <3kmpbiFugbbcU1@individual.net>
from usenet@isbd.co.uk contains these words:

> .... but with a decent newsreader it's trivial to ignore even that huge
> amount of junk. It took me only a few seconds to realise what had
> happened, look to see if anything interesting was interspersed and
> then 'mark as read' the whole lot.

Depends on the newsreader - with an offline one like ours, and using the
system of compressed packets, you get the lot. However, the Zetgods are
very accommodating when it comes to blocking malicious stuff.

--
Rusty
Emus to: horrid dot squeak snailything zetnet point co full-stop uk
http://www.users.zetnet.co.uk/hi-fi/

Jaques d'Alltrades

2005-07-26, 4:21 pm

The message <3kn1h9Fv7b04U1@individual.net>
from usenet@isbd.co.uk contains these words:

> But was it worth the effort of doing even that, the IP addresses will
> be different next time around (probably) so that's only a one off
> filter. With slrn (as with tin that I use) it's a matter of only a
> few seconds to skip past all the junk and then mark it as read.

Only if you can do it on the server.

--
Rusty
Emus to: horrid dot squeak snailything zetnet point co full-stop uk
http://www.users.zetnet.co.uk/hi-fi/

Ian Cummings

2005-07-26, 4:21 pm

In message <wdkay0Bneh5CFwsF@nanime.demon.co.uk>, Judith Lea
<lsplee@nanime.demon.co.uk> writes
>Could anyone tell me how to stop newsgroup spam - I have reported it to
>Demon but nothing seems to be happening -

Demon, or any other ISP, will only really be interested if it's from
their customer/s, although some ISPs offer a "cleaner" feed than others.

>is there anything I can do
>this end?

If you mean the stuff like:

---x---
No carrots will be wet rude butchers.

Just living behind a diet outside the moon is too quiet for Elisa to
burn it. No cheap barbers throughout the noisy station were combing at
the weak shower. Edwin! You'll believe eggs. Just now, I'll pull the
yogi.

She'd rather change cruelly than play with Aloysius's easy cloud.
---x---

the first load that I saw all had the header

X-Complaints-To: usenet@feeder.kornet.net

so I just killed on that. Some might consider this a bit too broad-brush
an approach, but I don't really mind. I doubt there are very many
serious contributors here from Korea, and if there are I can always
refetch them later. It's only usenet, after all...

If you mean the stuff cross-posted to:

Newsgroups: demon.local, alt.animals.ethics.vegetarian,
talk.politics.animals, uk.environment.conservation, uk.rec.birdwatching,
scot.birds, uk.rec.gardening, uk.business.agriculture,
uk.rec.fishing.coarse, sci.agriculture.poultry

you could try killing anything that's cross-posted to more than, say, 3
groups. Decide for yourself if that would be OTT. I suspect not.

I also find anything (cross)posted to alt.talk.bollocks to be pretty
much what I'd expect from that group, and not worth seeing.

--
Ian Cummings

Janet Baraclough

2005-07-26, 5:21 pm

The message <BF0C110E.1C141%sacha@gardenweedws506.fsnet.co.uk>
from Sacha <sacha@gardenweedws506.fsnet.co.uk> contains these words:

> So what would you recommend Judith to use?

zimacs, the terrific inhouse newsreader provided by my dead cheap
superhelpful isp zetnet. One post to our internal "help" ng, with
details, and the nuisance was immediately filtered out.

Janet.

usenet@isbd.co.uk

2005-07-26, 6:21 pm

Sacha <sacha@gardenweedws506.fsnet.co.uk> wrote:
> On 26/7/05 13:41, in article 3kmpbiFugbbcU1@individual.net,
> "usenet@isbd.co.uk" <usenet@isbd.co.uk> wrote:
>
>
> So what would you recommend Judith to use?

I'd recommend her to do a bit of investigation and, maybe, ask around from
experienced people what they recommend. Without knowing her requirements and
what OS she is using it's not sensible to make suggestions.

A little bit of work done choosing one's software carefully repays the effort
many times over IMHO.

--
Chris Green

usenet@isbd.co.uk

2005-07-26, 6:21 pm

Kay <kay@scarboro.demon.co.uk> wrote:
> In article <3kmpbiFugbbcU1@individual.net>, usenet@isbd.co.uk writes
>
> Hardly. A mailbomb attack depends on each of the 1000 or so emails
> having a different subject and apparent poster.
> Fine if you have broadband but a pain if you have to wait for that lot
> to download over a phone connection.
>
I didn't, I only saw the headers. I used to use the same newsreader that I use
now back in the days of 2400baud (and slower) connections.

--
Chris Green

Bob Smith $UK$

2005-07-26, 8:21 pm

Chris French and Helen Johnson

2005-07-26, 10:21 pm

In message <3kn19pFv1euhU1@individual.net>, Bob Hobden <me@privacy.net>
writes
>
>"Sacha" wrote after...
>http://news.individual.net did a good job, well worth the 10 EUR (few £'s) a
>year, some spam/crossposted junk appeared for a few hours then disappeared
>when they caught up.

Can't say I've noticed much, but then I'm only skimmming urg at the
moment. I don't use n.i.n anymore, my ISP news service is outsourced to
Supernews and I suspect that they killed a lot of it as well.
--
Chris French and Helen Johnson, Leeds
urg Suppliers and References FAQ:
<http://www.familyfrench.co.uk/garden/urgfaq/index.html>

JennyC

2005-07-27, 3:21 am

Charlie Pridham

2005-07-27, 5:21 am

"Kay" <kay@scarboro.demon.co.uk> wrote in message
news:1P9HD+ABIm5CFwd7@scarboro.demon.co.uk...
> In article <3kmpbiFugbbcU1@individual.net>, usenet@isbd.co.uk writes
ql7ce1hi8s06fkroisj9i9qi15c9t5af2b@4ax.com,[color=darkred]
to[color=darkred]
>
> Hardly. A mailbomb attack depends on each of the 1000 or so emails
> having a different subject and apparent poster.
lately.[color=darkred]
used,[color=darkred]
> Fine if you have broadband but a pain if you have to wait for that lot
> to download over a phone connection.
>
> --
> Kay
> "Do not insult the crocodile until you have crossed the river"

Well as soon as I saw the number of headers I assumed this was not all my
missing posts :~) and stopped after down loading all the headers, all the
Urg stuff was at one end so I just marked everything as read then marked the
urg messages as unread and flagged them to down load next time, bit of a
pain but certainly not bad enough to change anything and I am using OE. took
about 60 seconds to sort.
I did not look at the other stuff, where did it come from? (I know someone
said it was from Hongkong) surely no one would bother to make up that many
messages just to annoy a few gardeners?

--
Charlie, gardening in Cornwall.
http://www.roselandhouse.co.uk
Holders of National Plant Collection of Clematis viticella (cvs)

Janet Tweedy

2005-07-27, 6:21 am

In article <3kmpbiFugbbcU1@individual.net>, usenet@isbd.co.uk writes

>... but with a decent newsreader it's trivial to ignore even that huge
>amount of junk. It took me only a few seconds to realise what had
>happened, look to see if anything interesting was interspersed and
>then 'mark as read' the whole lot.
>

Turnpike allows you to remove rather than label as 'read' so you don't
even have to see the junk after you select and remove. It frees up the
page.

Janet
--
Janet Tweedy
Dalmatian Telegraph
http://www.lancedal.demon.co.uk

Janet Tweedy

2005-07-27, 6:21 am

In article <1P9HD+ABIm5CFwd7@scarboro.demon.co.uk>, Kay
<kay@scarboro.demon.co.uk> writes

>Fine if you have broadband but a pain if you have to wait for that lot
>to download over a phone connection.
>

Can you not see it Online Kay so that it can be deleted quickly?

janet
--
Janet Tweedy
Dalmatian Telegraph
http://www.lancedal.demon.co.uk

Kay

2005-07-28, 9:21 am

In article <4nFMhLCF005CFw$V@ukonline.co.uk>, Janet Tweedy
<jan@lancedal.demon.co.uk> writes
>In article <1P9HD+ABIm5CFwd7@scarboro.demon.co.uk>, Kay
><kay@scarboro.demon.co.uk> writes
>
>
>
>Can you not see it Online Kay so that it can be deleted quickly?
>
I'm broadband, so I don't care :-) Took me about 10 secs to scan for the
few urg posts and then hit 'mark all as read'.
--
Kay
"Do not insult the crocodile until you have crossed the river"

Kay

2005-07-28, 9:21 am

In article <42e739fc$1_3@mk-nntp-1.news.uk.worldonline.com>, Charlie
Pridham <charlie.pridham@lineone.net> writes
>Well as soon as I saw the number of headers I assumed this was not all my
>missing posts :~) and stopped after down loading all the headers, all the
>Urg stuff was at one end so I just marked everything as read then marked the
>urg messages as unread and flagged them to down load next time, bit of a
>pain but certainly not bad enough to change anything and I am using OE. took
>about 60 seconds to sort.
>I did not look at the other stuff, where did it come from? (I know someone
>said it was from Hongkong) surely no one would bother to make up that many
>messages just to annoy a few gardeners?

It's automatically generated so it's no bother ;-)
--
Kay
"Do not insult the crocodile until you have crossed the river"

LinkBot