Hi,

Is anyone else seeing spam from @gmail.com addresses with the Path:
showing that the messages are coming from news.xlned.com / ams1 (in some
permutation)?

I've seen six messages today when I haven't seen much non-GG / non-troll
spam in quite a while.

I'm wondering if some of the spammers have realized that the free ride
that was GG is over and starting to look elsewhere for service.

N.B. I've set Followup-To: news.admin.net-abuse.usenet.

--
Grant. . . .

Am 14.12.2023 um 21:39:16 Uhr schrieb Grant Taylor:

> I'm wondering if some of the spammers have realized that the free
> ride that was GG is over and starting to look elsewhere for service.

IIRC I read that some already tried to use E-S to post Thai spam, but
the filter stopped them.

Marco Moock wrote:
> Am 14.12.2023 um 21:39:16 Uhr schrieb Grant Taylor:
>
>> I'm wondering if some of the spammers have realized that the free
>> ride that was GG is over and starting to look elsewhere for service.
>
> IIRC I read that some already tried to use E-S to post Thai spam, but
> the filter stopped them.
>

I would hope that attempts to spam via E-S - or other similar candidates
- would give the admins of these servers a better clue as to who is
behind this stuff.
That's the optimistic standpoint, the pessimistic one is that they will
find another server whose admins simply don't care.

Am 15.12.2023 um 12:15:16 Uhr schrieb Andrew:

> Marco Moock wrote:
> > Am 14.12.2023 um 21:39:16 Uhr schrieb Grant Taylor:
> >
> >> I'm wondering if some of the spammers have realized that the free
> >> ride that was GG is over and starting to look elsewhere for
> >> service.
> >
> > IIRC I read that some already tried to use E-S to post Thai spam,
> > but the filter stopped them.
> >
>
> I would hope that attempts to spam via E-S - or other similar
> candidates
> - would give the admins of these servers a better clue as to who is
> behind this stuff.
> That's the optimistic standpoint, the pessimistic one is that they
> will find another server whose admins simply don't care.

Google already gives that - the IP addresses of the spamming systems
are known, the ISP of them mostly don't care.
Just check those IPs and network in dnsbl list about email spam.
They are full of email spammers too and the ISPs accept that.

On Thu, 14 Dec 2023 21:39:16 -0600, Grant Taylor wrote:

> Hi,
>
> Is anyone else seeing spam from @gmail.com addresses with the Path:
> showing that the messages are coming from news.xlned.com / ams1 (in some
> permutation)?
>
> I've seen six messages today when I haven't seen much non-GG / non-troll
> spam in quite a while.

I noticed that a few days ago and modified my filters. I haven't been
watching if it's continuing as I don't see the spam now.

Whether they have a @gmail.com address or not, I didn't check. That's not
a header I filter, it's too simple to spoof.

On 12/15/23 08:03, Retro Guy wrote:
> I noticed that a few days ago and modified my filters. I haven't been
> watching if it's continuing as I don't see the spam now.

I saw a few more messages already today.

> Whether they have a @gmail.com address or not, I didn't check. That's
> not a header I filter, it's too simple to spoof.

Agreed.

I just wonder if some spammers are finding that their playground is
coming to and end and the rats are jumping ship.

--
Grant. . . .

In article <ulhcq8$1sc3p$1@dont-email.me>,
Marco Moock <mm+usenet-es@dorfdsl.de> wrote:
>Am 15.12.2023 um 12:15:16 Uhr schrieb Andrew:
>
>> Marco Moock wrote:
>> > Am 14.12.2023 um 21:39:16 Uhr schrieb Grant Taylor:
>> >
>> >> I'm wondering if some of the spammers have realized that the free
>> >> ride that was GG is over and starting to look elsewhere for
>> >> service.
>> >
>> > IIRC I read that some already tried to use E-S to post Thai spam,
>> > but the filter stopped them.
>> >
>>
>> I would hope that attempts to spam via E-S - or other similar
>> candidates
>> - would give the admins of these servers a better clue as to who is
>> behind this stuff.
>> That's the optimistic standpoint, the pessimistic one is that they
>> will find another server whose admins simply don't care.
>
>Google already gives that - the IP addresses of the spamming systems
>are known, the ISP of them mostly don't care.
>Just check those IPs and network in dnsbl list about email spam.
>They are full of email spammers too and the ISPs accept that.
>

Incompetence for you!
--
Member - Liberal International This is doctor@nk.ca Ici doctor@nk.ca
Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism ; unsubscribe from Google Groups to be seen
Merry Christmas 2023 and Happy New year 2024 Beware https://mindspring.com

In article <ulhmcb$3qb38$2@i2pn2.org>, Retro Guy <retroguy@i2pn2.org> wrote:
>On Thu, 14 Dec 2023 21:39:16 -0600, Grant Taylor wrote:
>
>> Hi,
>>
>> Is anyone else seeing spam from @gmail.com addresses with the Path:
>> showing that the messages are coming from news.xlned.com / ams1 (in some
>> permutation)?
>>
>> I've seen six messages today when I haven't seen much non-GG / non-troll
>> spam in quite a while.
>
>I noticed that a few days ago and modified my filters. I haven't been
>watching if it's continuing as I don't see the spam now.
>
>Whether they have a @gmail.com address or not, I didn't check. That's not
>a header I filter, it's too simple to spoof.
>

I will filter GG until 1 MArch 2024!
--
Member - Liberal International This is doctor@nk.ca Ici doctor@nk.ca
Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism ; unsubscribe from Google Groups to be seen
Merry Christmas 2023 and Happy New year 2024 Beware https://mindspring.com

In article <ulhrmb$em1$2@tncsrv09.home.tnetconsulting.net>,
Grant Taylor <gtaylor@tnetconsulting.net> wrote:
>On 12/15/23 08:03, Retro Guy wrote:
>> I noticed that a few days ago and modified my filters. I haven't been
>> watching if it's continuing as I don't see the spam now.
>
>I saw a few more messages already today.
>
>> Whether they have a @gmail.com address or not, I didn't check. That's
>> not a header I filter, it's too simple to spoof.
>
>Agreed.
>
>I just wonder if some spammers are finding that their playground is
>coming to and end and the rats are jumping ship.
>
>

WEll I will not sign up Google abusers!

>
>--
>Grant. . . .

--
Member - Liberal International This is doctor@nk.ca Ici doctor@nk.ca
Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism ; unsubscribe from Google Groups to be seen
Merry Christmas 2023 and Happy New year 2024 Beware https://mindspring.com

Hi,
Grant Taylor a tapoté le 15/12/2023 04:39:
> I noticed that a few days ago and modified my filters. I haven't been
> watching if it's continuing as I don't see the spam now.

Could you give some Message-ID, Newsgroups?

--
Stéphane

On Sat, 16 Dec 2023 10:23:38 +0100, yamo' wrote:

> Hi,
> Grant Taylor a tapoté le 15/12/2023 04:39:
>> I noticed that a few days ago and modified my filters. I haven't been
>> watching if it's continuing as I don't see the spam now.
>
> Could you give some Message-ID, Newsgroups?

These are some from 13 Dec. They are listed in NoCeM:
<bot-spam-a221995051807e31@i2pn2.org>

-----
<vh0inid7otcth5nrcnvtemssi27kqm3md5@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<oh0inilsnt7ttq6oiv8bn1b8nvaspmp91c@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<vh0inid7otcth5nrcnvtemssi27kqm3md5@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<oh0inilsnt7ttq6oiv8bn1b8nvaspmp91c@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<vh0inid7otcth5nrcnvtemssi27kqm3md5@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<oh0inilsnt7ttq6oiv8bn1b8nvaspmp91c@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<vh0inid7otcth5nrcnvtemssi27kqm3md5@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<oh0inilsnt7ttq6oiv8bn1b8nvaspmp91c@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<mtqhni1om62ipk082l2fccp0mlcmfegchp@4ax.com> comp.compression
<rh0ini9uicpfd5s0sn6d398l4umsi1icaa@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<rh0ini9uicpfd5s0sn6d398l4umsi1icaa@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<rh0ini9uicpfd5s0sn6d398l4umsi1icaa@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<rh0ini9uicpfd5s0sn6d398l4umsi1icaa@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<qh0inilg0enpr94vn7b6j0h1cftip1pppr@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<qh0inilg0enpr94vn7b6j0h1cftip1pppr@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<qh0inilg0enpr94vn7b6j0h1cftip1pppr@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<qh0inilg0enpr94vn7b6j0h1cftip1pppr@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<4vqhnip0d8bvpljqki3uvncgiiro2qhpp1@4ax.com> comp.compression
<6vqhni16cdlidbfuro9ebvo7gl4e8v3tki@4ax.com> comp.compression
<2vqhnid7ug97nqln4a2cdalhvar6emalhh@4ax.com> comp.compression
<9vqhnitpopuivk8r0bjrslragh9g3423u3@4ax.com> comp.compression
<cj0inid04aokbpp7bn3i6lbl5qrvpgr244@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<cj0inid04aokbpp7bn3i6lbl5qrvpgr244@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<cj0inid04aokbpp7bn3i6lbl5qrvpgr244@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp
<cj0inid04aokbpp7bn3i6lbl5qrvpgr244@4ax.com>
microsoft.public.word.docmanagement,soc.culture.punjab,microsoft.public.project,comp.lang.lisp

On 12/16/23 03:23, yamo' wrote:
> Could you give some Message-ID, Newsgroups?

Sure.

Message-ID: <93plnilkuhg9pc2rg4kef827vk6bgm51d3@4ax.com>
Message-ID: <cibmnil6b4beq1u60s9v31n7slcu7poqib@4ax.com>
Message-ID: <eannniddjs67dv9n5j8h7p7vra90be25ug@4ax.com>
Message-ID: <gannnilpm9ev9t8uhfv94d68g19oseords@4ax.com>
Message-ID: <hannnil8cnunvssgjflnemm924huloluh7@4ax.com>
Message-ID: <i3plnilpko41oj7smmen3q2f6d355v8lv9@4ax.com>
Message-ID: <k5ppnih1qgjakptdbr000fak4obumllurs@4ax.com>
Message-ID: <o6npnipe2vhk0eicdi9us60frcobgkc4pi@4ax.com>

Let me know if you want anything else.

--
Grant. . . .

Grant Taylor <gtaylor@tnetconsulting.net> wrote:
> On 12/16/23 03:23, yamo' wrote:
> > Could you give some Message-ID, Newsgroups?
>
> Sure.
>
> Message-ID: <93plnilkuhg9pc2rg4kef827vk6bgm51d3@4ax.com>
> Message-ID: <cibmnil6b4beq1u60s9v31n7slcu7poqib@4ax.com>
> Message-ID: <eannniddjs67dv9n5j8h7p7vra90be25ug@4ax.com>
> Message-ID: <gannnilpm9ev9t8uhfv94d68g19oseords@4ax.com>
> Message-ID: <hannnil8cnunvssgjflnemm924huloluh7@4ax.com>
> Message-ID: <i3plnilpko41oj7smmen3q2f6d355v8lv9@4ax.com>
> Message-ID: <k5ppnih1qgjakptdbr000fak4obumllurs@4ax.com>
> Message-ID: <o6npnipe2vhk0eicdi9us60frcobgkc4pi@4ax.com>
>
> Let me know if you want anything else.

I've only looked at the first one, but not only their drugs are
psychedelic, but so is their list of Newsgroups:

Newsgroups: comp.compression,microsoft.public.mac.office.word,alt.sys.pdp10,comp.lang.lisp,bit.listserv.ibm-main,mmicrosoft.public.word.docmanagement

Note the pdp10, the microsoft.*, the stuttering, etc.! :-)

Their NSP is UsenetServer, which is not evident from the Path:, but is
shown in the X-Complaints-To and Organization:

Path: ...!npeer.as286.net!npeer-ng0.as286.net!peer02.ams1!peer.ams1.xlned.com!news.xlned.com!fx10.ams1.POSTED!not-for-mail
X-Complaints-To: abuse@usenetserver.com
Organization: UsenetServer - www.usenetserver.com

Judging from their User-Agent header, they're cheapskates (unless
that's faked (but then the Message-ID is faked as well)):

User-Agent: ForteAgent/8.00.32.1272 trialware

FWIW, I've a filter for all-caps Subject:s since eons:

Subject: BEST DMT CARTS FOR SALE AND DMT VAPE PENS FOR SALE IN UK

All in all, AFAICT, this is 'normal' Usenet spam, nothing out of the
ordinary.

P.S. Sorry for the Dutch aspects. Normally the slogan is "If it ain't
Dutch, it ain't much!", but in this case, the slogan doesn't seem to
apply! :-)

On 12/16/23 14:21, Frank Slootweg wrote:
> I've only looked at the first one, but not only their drugs are
> psychedelic, but so is their list of Newsgroups:

Agreed.

> Their NSP is UsenetServer, which is not evident from the Path:,
> but is shown in the X-Complaints-To and Organization:

I noticed that too.

> Judging from their User-Agent header, they're cheapskates (unless
> that's faked (but then the Message-ID is faked as well)):

The Message-ID may be a forgery, but it is the ID that the message goes
by none-the-less. So ... is it really a /fake/? }:-)

> FWIW, I've a filter for all-caps Subject:s since eons:

Prior to the recent Google BS I largely left cleanfeed at defaults.
I've had to get more stringent before simply adding Google as a banned
host in the Path: header.

> All in all, AFAICT, this is 'normal' Usenet spam, nothing out of
> the ordinary.

Agreed.

> P.S. Sorry for the Dutch aspects. Normally the slogan is "If it ain't
> Dutch, it ain't much!", but in this case, the slogan doesn't seem to
> apply! :-)

You're fine.

--
Grant. . . .

Hi,
Retro Guy a tapoté le 16/12/2023 11:42:
> These are some from 13 Dec. They are listed in NoCeM:
> <bot-spam-a221995051807e31@i2pn2.org>

Thanks!
So they have been catched by the bot, good news.

I have also updated my cleanfeed.local

--
Stéphane

Hi,
Grant Taylor a tapoté le 16/12/2023 20:46:
> Let me know if you want anything else.

Thanks a lot Grant!

--
Stéphane

On 12/17/23 13:18, yamo' wrote:
> Thanks a lot Grant!

You're welcome.

--
Grant. . . .