On Sat, 02 Jul 2022 19:05:51 -0400, David W. Hodgins wrote:
>
> On Sat, 02 Jul 2022 18:19:28 -0400, The Doctor <doctor@doctor.nl2k.ab.ca> wrote:
>> In article <59781171-88d3-47ec-98c7-97fc78859159n@googlegroups.com>,
>> hester holt <hesterholt7@gmail.com> wrote:
>> This abusive spamtroll came from
>> whois 146.70.103.22
>> This could be coming from a botnet!
>
> It is coming from a botnet. If you check the headers of the articles, there
> are a few from each of many ip addresses. Makes filtering on posting host
> useless.

It's posted via Google. I don't think a botnet is involved.

> It's may be trying to expand the botnet by getting people to open the pdf
> files using adobe reader. It may only infect systems with users running old
> version. I haven't bothered checking to see what it does. Just basing my
> guess on what I've seen in the past.
>
> Given current trends, it may be trying to deploy ransomware that encrypts the
> user's files. That way it doesn't need to elevate privileges after the user
> opens the pdf file.

I don't see a file attached in the spam. When I visited the URL in the
spam I placed a test order to gather date from the spammer. It then goes
to a legit PayPal page to pay. Since the order (of course) failed I hope
the spammer contact me via the throw-away email address I provided. Will
post what I get then in the abuse group (I set a followup-to here).
--
Andreas

On Sun, 03 Jul 2022 12:54:00 -0400, Andreas Kohlbach <ank@spamfence.net> wrote:
> It's posted via Google. I don't think a botnet is involved.

The Injection-Info header in the articles shows it's coming from a wide variety
of ip addresses (hence botnet), and using multiple google accounts.

All done to ensure filtering is more difficult without using wider rules that
may block non spam articles. It also ensures that even if google were handling
spam reports properly, it would be a game of whack-a-mole.

Regards, Dave Hodgins

In article <87zghq16jb.fsf@usenet.ankman.de>,
Andreas Kohlbach <ank@spamfence.net> wrote:
>On Sat, 02 Jul 2022 19:05:51 -0400, David W. Hodgins wrote:
>>
>> On Sat, 02 Jul 2022 18:19:28 -0400, The Doctor
><doctor@doctor.nl2k.ab.ca> wrote:
>>> In article <59781171-88d3-47ec-98c7-97fc78859159n@googlegroups.com>,
>>> hester holt <hesterholt7@gmail.com> wrote:
>>> This abusive spamtroll came from
>>> whois 146.70.103.22
>>> This could be coming from a botnet!
>>
>> It is coming from a botnet. If you check the headers of the articles, there
>> are a few from each of many ip addresses. Makes filtering on posting host
>> useless.
>
>It's posted via Google. I don't think a botnet is involved.
>
>> It's may be trying to expand the botnet by getting people to open the pdf
>> files using adobe reader. It may only infect systems with users running old
>> version. I haven't bothered checking to see what it does. Just basing my
>> guess on what I've seen in the past.
>>
>> Given current trends, it may be trying to deploy ransomware that encrypts the
>> user's files. That way it doesn't need to elevate privileges after the user
>> opens the pdf file.
>
>I don't see a file attached in the spam. When I visited the URL in the
>spam I placed a test order to gather date from the spammer. It then goes
>to a legit PayPal page to pay. Since the order (of course) failed I hope
>the spammer contact me via the throw-away email address I provided. Will
>post what I get then in the abuse group (I set a followup-to here).
>--
>Andreas

This botnot is really complicated to explain.
--
Member - Liberal International This is doctor@nk.ca Ici doctor@nk.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b
To use too much mercy is to end up with too little. -unknown Beware https://mindspring.com

In article <op.1oq0e4gda3w0dxdave@hodgins.homeip.net>,
David W. Hodgins <dwhodgins@nomail.afraid.org> wrote:
>On Sun, 03 Jul 2022 12:54:00 -0400, Andreas Kohlbach <ank@spamfence.net> wrote:
>> It's posted via Google. I don't think a botnet is involved.
>
>The Injection-Info header in the articles shows it's coming from a wide variety
>of ip addresses (hence botnet), and using multiple google accounts.
>
>All done to ensure filtering is more difficult without using wider rules that
>may block non spam articles. It also ensures that even if google were handling
>spam reports properly, it would be a game of whack-a-mole.
>
>Regards, Dave Hodgins

Europe and Asia. I thought I saw Africa as well.
--
Member - Liberal International This is doctor@nk.ca Ici doctor@nk.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b
To use too much mercy is to end up with too little. -unknown Beware https://mindspring.com

On Sun, 03 Jul 2022 16:55:42 -0400, David W. Hodgins wrote:
>
> On Sun, 03 Jul 2022 12:54:00 -0400, Andreas Kohlbach <ank@spamfence.net> wrote:
>> It's posted via Google. I don't think a botnet is involved.
>
> The Injection-Info header in the articles shows it's coming from a wide variety
> of ip addresses (hence botnet), and using multiple google accounts.

Good point. I overlooked this. Although it could be TOR?
--
Andreas

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[ note followups-to ]

On Monday, 04 July 2022 14:25 -0400,
in article <87zghozqdx.fsf@usenet.ankman.de>,
Andreas Kohlbach <ank@spamfence.net> wrote:

> On Sun, 03 Jul 2022 16:55:42 -0400, David W. Hodgins wrote:

>> On Sun, 03 Jul 2022 12:54:00 -0400,
>> Andreas Kohlbach <ank@spamfence.net> wrote:

>>> It's posted via Google. I don't think a botnet is involved.

>> The Injection-Info header in the articles shows it's coming from a
>> wide variety of ip addresses (hence botnet), and using multiple
>> google accounts.

Those wildly guessing 'botnet' have failed to do even the most
rudimentary research, before reaching this erroneous and quite
muddleheaded conclusion.

> Good point. I overlooked this. Although it could be TOR?

TOR seems much closer, but slightly off-target, as none of the
addresses I checked were identified as Tor exit nodes.

After looking up the original article,
<59781171-88d3-47ec-98c7-97fc78859159n@googlegroups.com>
(http://al.howardknight.net/?ID=165696354700), I took a look at the
most recent spam from "hester holt <hesterholt7@gmail.com>"blq, in
comp.os.linux.misc.

NNTP-Posting-Host: 68.235.38.177
NNTP-Posting-Host: 217.138.255.202
NNTP-Posting-Host: 198.55.126.214
NNTP-Posting-Host: 104.129.56.166
NNTP-Posting-Host: 149.57.28.198
NNTP-Posting-Host: 178.170.158.41
NNTP-Posting-Host: 45.87.214.77
NNTP-Posting-Host: 149.57.28.76
NNTP-Posting-Host: 45.87.212.78
NNTP-Posting-Host: 37.120.137.72
NNTP-Posting-Host: 217.138.255.203
NNTP-Posting-Host: 208.78.41.158
NNTP-Posting-Host: 146.70.103.22
NNTP-Posting-Host: 178.170.183.64

Running a query for the IP address with the term 'proxy', identifies
some as the Windscribe VPNs (windscribe.com), likely acting as
proxies.

https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/45.87.212.78
https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/149.57.28.198
https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/208.78.41.158
https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/217.138.255.202

All of this suggests each article is posted manually via Google
Groups. I see nothing to even vaguely suggest the involvement of
automation, let alone a botnet.

- --
David Ritz <dritz@mindspring.com>
Be kind to animals; kiss a shark.

-----BEGIN PGP SIGNATURE-----

iF0EARECAB0WIQSc0FU3XAVGYDjSGUhSvCmZGhLe6wUCYsNIxgAKCRBSvCmZGhLe
6+s2AJ9A1ymdSh/UvlBPte4GctWO2EsKwACeJfNerHrpi1BX4kSDISVMwa+9HNM=
=SeAu
-----END PGP SIGNATURE-----

In article <87zghozqdx.fsf@usenet.ankman.de>,
Andreas Kohlbach <ank@spamfence.net> wrote:
>On Sun, 03 Jul 2022 16:55:42 -0400, David W. Hodgins wrote:
>>
>> On Sun, 03 Jul 2022 12:54:00 -0400, Andreas Kohlbach
><ank@spamfence.net> wrote:
>>> It's posted via Google. I don't think a botnet is involved.
>>
>> The Injection-Info header in the articles shows it's coming from a
>wide variety
>> of ip addresses (hence botnet), and using multiple google accounts.
>
>Good point. I overlooked this. Although it could be TOR?

TOR! Can it bypass a botnet?

>--
>Andreas

--
Member - Liberal International This is doctor@nk.ca Ici doctor@nk.ca
Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising!
Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b
Those who have no argument turn to slander. -unknown Beware https://mindspring.com

[ note followup-to ]

On Monday, 04 July 2022 21:52 -0000,
in article <t9vnfp$in4$32@gallifrey.nk.ca>,
The Doctor <doctor@doctor.nl2k.ab.ca> wrote:

> In article <87zghozqdx.fsf@usenet.ankman.de>,

> Andreas Kohlbach <ank@spamfence.net> wrote:

> >On Sun, 03 Jul 2022 16:55:42 -0400, David W. Hodgins wrote:

>>> On Sun, 03 Jul 2022 12:54:00 -0400, Andreas Kohlbach
>><ank@spamfence.net> wrote:

>>>> It's posted via Google. I don't think a botnet is involved.

>>> The Injection-Info header in the articles shows it's coming from a
>>> wide variety of ip addresses (hence botnet), and using multiple
>>> google accounts.

>>Good point. I overlooked this. Although it could be TOR?

> TOR!

Stop guessing; don't be in such a hurry to demonstrate your ignorance.
This is unrelated to TOR, bots and botnets. The Usenet spam in
question is being posted, individually, by hand. This is true for
every single article I've seen, coming from groups.google.com's G2
http2nntp interface.

These are the IP addresses shown in the NPH of the articles appearing
in comp.os.linux.misc, posted by "hester holt <hesterholt7@gmail.com>"
via Google Groups. See
<817p663n-9n89-q827-s822-77271rsp351@zvaqfcevat.pbz>
(http://al.howardknight.net/?ID=165699000400). tor.dnsbl.sectoor.de
provides a database of Tor exit nodes, which can be checked in the
same manner as most other DNSBLs.

178.170.183.64 : tor.dnsbl.sectoor.de : ok
68.235.38.177 : tor.dnsbl.sectoor.de : ok
217.138.255.202 : tor.dnsbl.sectoor.de : ok
198.55.126.214 : tor.dnsbl.sectoor.de : ok
104.129.56.166 : tor.dnsbl.sectoor.de : ok
149.57.28.198 : tor.dnsbl.sectoor.de : ok
178.170.158.41 : tor.dnsbl.sectoor.de : ok
45.87.214.77 : tor.dnsbl.sectoor.de : ok
149.57.28.76 : tor.dnsbl.sectoor.de : ok
45.87.212.78 : tor.dnsbl.sectoor.de : ok
37.120.137.72 : tor.dnsbl.sectoor.de : ok
217.138.255.203 : tor.dnsbl.sectoor.de : ok
208.78.41.158 : tor.dnsbl.sectoor.de : ok
146.70.103.22 : tor.dnsbl.sectoor.de : ok
178.170.183.64 : tor.dnsbl.sectoor.de : ok

These are known proxies, for which I provided evidence. If you're
going to contradict me, Dave, the least you can do is to support your
assertion.

> Can it bypass a botnet?

If you're asking, "Can Tor bypass a botnet?", I'd ask you to rephrase.
As stated, it makes no sense. You are asking, can a network of
anonymous proxies get around a network of compromised hosts, which act
at the behest of nefarious third parties. WTF?

--
David Ritz <dritz@mindspring.com>
"There are no good girls gone wrong, just bad girls found out."
- Mae West (1892-1980)