Hi,

the big spam waves are over and that's a good thing.

Consulting the excellent
<https://www.novabbs.com/SEARCH/search_nocem.php?stats=daily&msgid=
tool>
I noticed that, on certain days, a lot of messages were still being
tagged by Nocem

So I'm going to take a look at the types of messages targeted by the
various nocems issuers.

I'll start with what surprised me most as a French speaker: there would
be daily spam on groups in the "fr" hierarchy. Having consulted a
sample of nocem, it's "nono le petit robot" who seems to produce them.

--------------------------------------------------------
"nono le petit robot"
Analysis(1) of March 31st nocems from 10:35am to 3:15pm
--------------------------------------------------------

Type "spam"
4 nocems over the period studied: <uubao6$qqd$1@rasp.pasdenom.info>,
<uubei3$2dv$1@rasp.pasdenom.info>, <uubnbb$jnh$1@rasp.pasdenom.info>
and <uubnkm$kd1$1@rasp.pasdenom.info>

That's 8 users messages, all on the "fr.soc.politique" group.
None of these messages is spam.
The false positive rate is 100%.

Type "spam2"
5 nocems over the period studied: <uubgaa$5g0$1@rasp.pasdenom.info>,
<uubl9m$fna$1@rasp.pasdenom.info>, <uublj3$g8q$1@rasp.pasdenom.info>,
<uubmoj$ie0$1@rasp.pasdenom.info> and <uubn1v$j48$1@rasp.pasdenom.info>

That's 6 users messages, all on the "fr.soc.politique" group.
None of these messages is spam.
The false positive rate is 100%.

Type "spam3":
2 nocems over the period studied: <uubelr$2k5$1@rasp.pasdenom.info> and
<uublmq$gj7$1@rasp.pasdenom.info>

This represents 13 users messages, 11 of which concern the
"fr.soc.politique" group and 1 message is not accessible (on
nemo.bavardages),
the others are not spam.
The false positive rate is therefore 92%.

Conclusion: The spam detection success rates claimed by the robot(2)
are not reflected in the annalyzed sample. Instead of the 99.99%
success rate expected for the "spam" type, here we're at 0%.

The rest of the nocems review in a future post.

(1) Why didn't you analyze the whole day or a week or a month? I didn't
have the courage to go any further, given that the analysis is the same
for each nocem looked at and that it corresponds to the reading
experience of the "fr" groups where spam is not visible.
(2) <https://pasdenom.info/nocem.html>

--
Admin of news.usenet.ovh

On 31.03.2024 um 19:32 Uhr llp wrote:

> the big spam waves are over and that's a good thing.

Those from Google. Not those from Abavia.

--
kind regards
Marco

Send spam to 1711906327muell@cartoonies.org

Thus spake Marco Moock <mm+usenet-es@dorfdsl.de>
> On 31.03.2024 um 19:32 Uhr llp wrote:
>> the big spam waves are over and that's a good thing.
> Those from Google. Not those from Abavia.

Abavia seems to have stopped propagating articles to their peers several
days ago,

--
Пу́тін — хуйло́
https://www.eternal-september.org

On 31.03.2024 um 21:01 Uhr Ray Banana wrote:

> Thus spake Marco Moock <mm+usenet-es@dorfdsl.de>
>
> > On 31.03.2024 um 19:32 Uhr llp wrote:
> >> the big spam waves are over and that's a good thing.
> > Those from Google. Not those from Abavia.
>
> Abavia seems to have stopped propagating articles to their peers
> several days ago,

Entirely or only the spam?

--
kind regards
Marco

Send spam to 1711911718muell@cartoonies.org

Thus spake Marco Moock <mm+usenet-es@dorfdsl.de>
> On 31.03.2024 um 21:01 Uhr Ray Banana wrote:
>> Thus spake Marco Moock <mm+usenet-es@dorfdsl.de>
>> > On 31.03.2024 um 19:32 Uhr llp wrote:
>> >> the big spam waves are over and that's a good thing.
>> > Those from Google. Not those from Abavia.
>> Abavia seems to have stopped propagating articles to their peers
>> several days ago,
> Entirely or only the spam?

No incoming articles at all from Abavia.

--
Пу́тін — хуйло́
https://www.eternal-september.org

Marco Moock wrote:

> On 31.03.2024 um 21:01 Uhr Ray Banana wrote:
>> Abavia seems to have stopped propagating articles to their peers
>> several days ago,
>
> Entirely or only the spam?

There was a difference?

Ray Banana <rayban@raybanana.net> wrote at 19:40 this Sunday (GMT):
> Thus spake Marco Moock <mm+usenet-es@dorfdsl.de>
>
>> On 31.03.2024 um 21:01 Uhr Ray Banana wrote:
>>> Thus spake Marco Moock <mm+usenet-es@dorfdsl.de>
>>> > On 31.03.2024 um 19:32 Uhr llp wrote:
>>> >> the big spam waves are over and that's a good thing.
>>> > Those from Google. Not those from Abavia.
>>> Abavia seems to have stopped propagating articles to their peers
>>> several days ago,
>> Entirely or only the spam?
>
> No incoming articles at all from Abavia.

Are they still operating?
--
user <candycane> is generated from /dev/urandom

Thus spake candycanearter07 <candycanearter07@candycanearter07.nomail.afraid>
> Ray Banana <rayban@raybanana.net> wrote at 19:40 this Sunday (GMT):
>> Thus spake Marco Moock <mm+usenet-es@dorfdsl.de>
>>> On 31.03.2024 um 21:01 Uhr Ray Banana wrote:
>>>> Thus spake Marco Moock <mm+usenet-es@dorfdsl.de>
>>>> > On 31.03.2024 um 19:32 Uhr llp wrote:
>>>> >> the big spam waves are over and that's a good thing.
>>>> > Those from Google. Not those from Abavia.
>>>> Abavia seems to have stopped propagating articles to their peers
>>>> several days ago,
>>> Entirely or only the spam?
>> No incoming articles at all from Abavia.
> Are they still operating?

They are still accepting articles from peers, just their outgoing
feeders seem to be inoperative, although I have seen ~100 articles
from them travelling on strange paths.

--
Пу́тін — хуйло́
https://www.eternal-september.org

Ray Banana <rayban@raybanana.net> wrote at 16:11 this Monday (GMT):
> Thus spake candycanearter07 <candycanearter07@candycanearter07.nomail.afraid>
>
>> Ray Banana <rayban@raybanana.net> wrote at 19:40 this Sunday (GMT):
>>> Thus spake Marco Moock <mm+usenet-es@dorfdsl.de>
>>>> On 31.03.2024 um 21:01 Uhr Ray Banana wrote:
>>>>> Thus spake Marco Moock <mm+usenet-es@dorfdsl.de>
>>>>> > On 31.03.2024 um 19:32 Uhr llp wrote:
>>>>> >> the big spam waves are over and that's a good thing.
>>>>> > Those from Google. Not those from Abavia.
>>>>> Abavia seems to have stopped propagating articles to their peers
>>>>> several days ago,
>>>> Entirely or only the spam?
>>> No incoming articles at all from Abavia.
>> Are they still operating?
>
> They are still accepting articles from peers, just their outgoing
> feeders seem to be inoperative, although I have seen ~100 articles
> from them travelling on strange paths.

Weird.. maybe some servers started blocking their messages?
--
user <candycane> is generated from /dev/urandom

Thus spake candycanearter07 <candycanearter07@candycanearter07.nomail.afraid>

>>>> No incoming articles at all from Abavia.
>>> Are they still operating?
>> They are still accepting articles from peers, just their outgoing
>> feeders seem to be inoperative, although I have seen ~100 articles
>> from them travelling on strange paths.
> Weird.. maybe some servers started blocking their messages?

I don't see any incoming connections from them and I have certainly not
blocked them (I need their bot spam without any delay to create NoCeMs).
They have probably messed up their reverse DNS settings again.

--
Пу́тін — хуйло́
https://www.eternal-september.org

Ray Banana <rayban@raybanana.net> wrote at 17:10 this Monday (GMT):
> Thus spake candycanearter07 <candycanearter07@candycanearter07.nomail.afraid>
>
>
>>>>> No incoming articles at all from Abavia.
>>>> Are they still operating?
>>> They are still accepting articles from peers, just their outgoing
>>> feeders seem to be inoperative, although I have seen ~100 articles
>>> from them travelling on strange paths.
>> Weird.. maybe some servers started blocking their messages?
>
> I don't see any incoming connections from them and I have certainly not
> blocked them (I need their bot spam without any delay to create NoCeMs).
> They have probably messed up their reverse DNS settings again.

Oh, ok.
--
user <candycane> is generated from /dev/urandom