[original spam not saved] ###### From: ab528@FreeNet.Carleton.CA (Heinz W. Wiggeshoff) Newsgroups: alt.folklore.computers Subject: Re: This is a great product Date: 28 Jul 2001 18:11:10 GMT Organization: The National Capital FreeNet Lines: 5 Message-ID: <9juv7u$7jj$1@freenet9.carleton.ca> References: Reply-To: ab528@FreeNet.Carleton.CA (Heinz W. Wiggeshoff) NNTP-Posting-Host: freenet10 X-Trace: freenet9.carleton.ca 996343870 7795 134.117.136.30 (28 Jul 2001 18:11:10 GMT) X-Complaints-To: complaints@ncf.ca NNTP-Posting-Date: 28 Jul 2001 18:11:10 GMT X-Given-Sender: ab528@freenet10.carleton.ca (Heinz W. Wiggeshoff) Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!news.maxwell.syr.edu!feed2.news.rcn.net!rcn!feeder.qis.net!nntp1.roc.gblx.net!nntp.gblx.net!nntp.gblx.net!xcski.com!freenet-news!FreeNet.Carleton.CA!ab528 Xref: chonsp.franklin.ch alt.folklore.computers:86036 > > sedygixikkhrhgopleqbkulseeszezdpki And you thought my name was a mouthful. ###### From: Peter Newsgroups: alt.folklore.computers Subject: Re: This is a great product Date: 01 Aug 2001 21:10:42 +0200 Organization: XS4ALL Internet BV Lines: 12 Sender: leela@localhost.localdomain Message-ID: References: <9juv7u$7jj$1@freenet9.carleton.ca> NNTP-Posting-Host: as19-4-8.mt.g.bonet.se X-Trace: news1.xs4all.nl 996692978 23171 194.237.245.53 (1 Aug 2001 19:09:38 GMT) X-Complaints-To: abuse@xs4all.nl NNTP-Posting-Date: 1 Aug 2001 19:09:38 GMT Original-Sender: leela@xs4all.nl X-Newsreader: Gnus v5.7/Emacs 20.7 Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!news-fra1.dfn.de!news-lei1.dfn.de!newsfeed00.sul.t-online.de!newsfeed01.sul.t-online.de!t-online.de!news.netcologne.de!newsfeed.wirehub.nl!transit.news.xs4all.nl!chaucer!nobody Xref: chonsp.franklin.ch alt.folklore.computers:86336 >> "HWW" == Heinz W Wiggeshoff writes: >> >> sedygixikkhrhgopleqbkulseeszezdpki HWW> And you thought my name was a mouthful. Hmm...I've noticed that all these spam postings end with some seemingly random sequence of letters. Is this some code?? -peter ###### From: ab528@FreeNet.Carleton.CA (Heinz W. Wiggeshoff) Newsgroups: alt.folklore.computers Subject: Re: This is a great product Date: 1 Aug 2001 19:59:13 GMT Organization: The National Capital FreeNet Lines: 13 Message-ID: <9k9n2h$1r8$1@freenet9.carleton.ca> References: <9juv7u$7jj$1@freenet9.carleton.ca> Reply-To: ab528@FreeNet.Carleton.CA (Heinz W. Wiggeshoff) NNTP-Posting-Host: freenet10 X-Trace: freenet9.carleton.ca 996695953 1896 134.117.136.30 (1 Aug 2001 19:59:13 GMT) X-Complaints-To: complaints@ncf.ca NNTP-Posting-Date: 1 Aug 2001 19:59:13 GMT X-Given-Sender: ab528@freenet10.carleton.ca (Heinz W. Wiggeshoff) Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!newsfeed-zh.ip-plus.net!news.ip-plus.net!news.tesion.net!news.belwue.de!fu-berlin.de!feeder.qis.net!nntp1.roc.gblx.net!nntp.gblx.net!nntp.gblx.net!xcski.com!freenet-news!FreeNet.Carleton.CA!ab528 Xref: chonsp.franklin.ch alt.folklore.computers:86295 Peter (leela@xs4all.nl) writes: >>> "HWW" == Heinz W Wiggeshoff writes: > > >> > >> sedygixikkhrhgopleqbkulseeszezdpki > > HWW> And you thought my name was a mouthful. > > Hmm...I've noticed that all these spam postings end with some > seemingly random sequence of letters. Is this some code?? No, it's an Enigma. ###### Path: chonsp.franklin.ch!not-for-mail From: Neil Franklin Newsgroups: alt.folklore.computers Subject: Re: This is a great product Date: 01 Aug 2001 23:59:53 +0200 Organization: My own Private Self Lines: 39 Message-ID: <6u3d7b30h2.fsf@chonsp.franklin.ch> References: <9juv7u$7jj$1@freenet9.carleton.ca> <9k9n2h$1r8$1@freenet9.carleton.ca> NNTP-Posting-Host: chonsp.franklin.ch X-Trace: chonsp.franklin.ch 996703193 1798 10.0.3.2 (1 Aug 2001 21:59:53 GMT) X-Complaints-To: news@chonsp.franklin.ch NNTP-Posting-Date: 1 Aug 2001 21:59:53 GMT X-Newsreader: Gnus v5.7/Emacs 20.4 Xref: chonsp.franklin.ch alt.folklore.computers:86356 ab528@FreeNet.Carleton.CA (Heinz W. Wiggeshoff) writes: > Peter (leela@xs4all.nl) writes: > >>> "HWW" == Heinz W Wiggeshoff writes: > > > > >> > > >> sedygixikkhrhgopleqbkulseeszezdpki > > > > HWW> And you thought my name was a mouthful. > > > > Hmm...I've noticed that all these spam postings end with some Actually only some. Depends on the spamware used. > > seemingly random sequence of letters. Is this some code?? > > No, it's an Enigma. Nonsense. Its history, reason and use are known. It stems the spammer vs anti-spam bot wars. Anti-spam bots were written to kill exessively crossposted spams. So spammers stared sending individual copies to each newsgroup (or max 3 or 5 groups). So bots were made to compare new posts with existing ones in other groups. So spamware writers added random characters to their posts to defeat these tests. The 4 or 5 digit numbers, separated by 2 or more spaces, at the end of Subject: lines of spams have the same origin, trying to evade Subject: comparing bots. Neil "spamkiller, 10 mails to abuse@... a day" Franklin -- Neil Franklin, neil@franklin.ch.remove http://neil.franklin.ch/ Hacker, Unix Guru, El Eng HTL/BSc, Sysadmin, Archer, Roleplayer - Intellectual Property is Intellectual Robbery ###### From: jmfbahciv@aol.com Newsgroups: alt.folklore.computers Subject: Re: This is a great product Date: Thu, 02 Aug 01 09:14:13 GMT Organization: UltraNet Communications, Inc. Lines: 30 Message-ID: <9kbf5m$4c8$3@bob.news.rcn.net> References: <9juv7u$7jj$1@freenet9.carleton.ca> <756.613T2016T9145805@nowhere.in.particular> X-Trace: UmFuZG9tSVY+MmP7XIcFm0HJMBko/Ozrg1y63T1tRADpjrWfYS2bC3EdXbEYv/NC X-Complaints-To: abuse@rcn.com NNTP-Posting-Date: 2 Aug 2001 11:56:38 GMT X-Newsreader: News Xpress Version 1.0 Beta #4 Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!news.maxwell.syr.edu!feed2.news.rcn.net!feed1.news.rcn.net!rcn!207-172-245-183 Xref: chonsp.franklin.ch alt.folklore.computers:86393 In article <756.613T2016T9145805@nowhere.in.particular>, "Charlie Gibbs" wrote: >In article leela@xs4all.nl >(Peter) writes: > >> "HWW" == Heinz W Wiggeshoff writes: >> >>>> sedygixikkhrhgopleqbkulseeszezdpki >>> >>> And you thought my name was a mouthful. >> >>Hmm...I've noticed that all these spam postings end with some >>seemingly random sequence of letters. Is this some code?? > >No, it's an attempt by the spammer to defeat software that >detects spam by finding identical message text in multiple >newsgroups. Each copy differs only in this last line, >which is indeed randomy-generated. > >Another trick is to append a random number (again, different >for each copy) to the Subject: line. oh, yea. And the screening heuristic for that manages to eliminate all legitimate posts that have the year 2001 at the end of the subject line. I can come up with better way to sift the crap. /BAH Subtract a hundred and four for e-mail. ###### From: jmfbahciv@aol.com Newsgroups: alt.folklore.computers Subject: Re: This is a great product Date: Fri, 03 Aug 01 09:07:43 GMT Organization: UltraNet Communications, Inc. Lines: 35 Message-ID: <9ke35o$8rt$6@bob.news.rcn.net> References: <9juv7u$7jj$1@freenet9.carleton.ca> <756.613T2016T9145805@nowhere.in.particular> <9kbf5m$4c8$3@bob.news.rcn.net> <793.614T1435T5844348@nowhere.in.particular> X-Trace: UmFuZG9tSVY52FRRI8KPqB7sj5Opm0/GfG3/Xz3WLuh5dxTO7lc0IKo3slqx2KHd X-Complaints-To: abuse@rcn.com NNTP-Posting-Date: 3 Aug 2001 11:50:16 GMT X-Newsreader: News Xpress Version 1.0 Beta #4 Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!newsfeed00.sul.t-online.de!t-online.de!news-lei1.dfn.de!news-was.dfn.de!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!feed2.news.rcn.net!feed1.news.rcn.net!rcn!207-172-245-17 Xref: chonsp.franklin.ch alt.folklore.computers:86400 In article <793.614T1435T5844348@nowhere.in.particular>, "Charlie Gibbs" wrote: >In article <9kbf5m$4c8$3@bob.news.rcn.net> jmfbahciv@aol.com (jmfbahciv) >writes: > >>In article <756.613T2016T9145805@nowhere.in.particular>, >>"Charlie Gibbs" wrote: >> >>>Another trick is to append a random number (again, different >>>for each copy) to the Subject: line. >> >>oh, yea. And the screening heuristic for that manages to >>eliminate all legitimate posts that have the year 2001 >>at the end of the subject line. I can come up with better >>way to sift the crap. > >After a bit of thought, so did I. Such spam subjects tend >to have at least two spaces before the number, so the filter >can check for that. It's still not perfect, but it's a step >in the right direction. > There comes a point where one can spend CPU time trying to stay a step behind the spammers or just simply start over with one simple rule....two rules. 1. Write x-posts to NUL:. That takes care of cranks, too. 2. Begin to establish a binary net outside of newsgroups. No ASCII, write to NUL:. /BAH /BAH Subtract a hundred and four for e-mail. ###### From: "Charlie Gibbs" Newsgroups: alt.folklore.computers Subject: Re: This is a great product Date: 01 Aug 01 15:14:40 -0800 Organization: http://extra.newsguy.com Lines: 24 Message-ID: <756.613T2016T9145805@nowhere.in.particular> References: <9juv7u$7jj$1@freenet9.carleton.ca> NNTP-Posting-Host: p-294.newsdawg.com X-Newsreader: THOR 2.5a (Amiga;TCP/IP) Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!newsfeed-zh.ip-plus.net!news.ip-plus.net!Amsterdam.Infonet!News.Amsterdam.UnisourceCS!newshunter!cosy.sbg.ac.at!news.cs.utwente.nl!pln-w!spln!dex!extra.newsguy.com!newsp.newsguy.com!news3 Xref: chonsp.franklin.ch alt.folklore.computers:86458 In article leela@xs4all.nl (Peter) writes: > "HWW" == Heinz W Wiggeshoff writes: > >>> sedygixikkhrhgopleqbkulseeszezdpki >> >> And you thought my name was a mouthful. > >Hmm...I've noticed that all these spam postings end with some >seemingly random sequence of letters. Is this some code?? No, it's an attempt by the spammer to defeat software that detects spam by finding identical message text in multiple newsgroups. Each copy differs only in this last line, which is indeed randomy-generated. Another trick is to append a random number (again, different for each copy) to the Subject: line. -- cgibbs@nowhere.in.particular (Charlie Gibbs) I'm switching ISPs - watch this space. ###### From: "Charlie Gibbs" Newsgroups: alt.folklore.computers Subject: Re: This is a great product Date: 02 Aug 01 09:44:28 -0800 Organization: http://extra.newsguy.com Lines: 23 Message-ID: <793.614T1435T5844348@nowhere.in.particular> References: <9juv7u$7jj$1@freenet9.carleton.ca> <756.613T2016T9145805@nowhere.in.particular> <9kbf5m$4c8$3@bob.news.rcn.net> NNTP-Posting-Host: p-791.newsdawg.com X-Newsreader: THOR 2.5a (Amiga;TCP/IP) Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!news.maxwell.syr.edu!news-hog.berkeley.edu!newsfeed.berkeley.edu!ucberkeley!pln-w!spln!dex!extra.newsguy.com!newsp.newsguy.com!news2 Xref: chonsp.franklin.ch alt.folklore.computers:86460 In article <9kbf5m$4c8$3@bob.news.rcn.net> jmfbahciv@aol.com (jmfbahciv) writes: >In article <756.613T2016T9145805@nowhere.in.particular>, >"Charlie Gibbs" wrote: > >>Another trick is to append a random number (again, different >>for each copy) to the Subject: line. > >oh, yea. And the screening heuristic for that manages to >eliminate all legitimate posts that have the year 2001 >at the end of the subject line. I can come up with better >way to sift the crap. After a bit of thought, so did I. Such spam subjects tend to have at least two spaces before the number, so the filter can check for that. It's still not perfect, but it's a step in the right direction. -- cgibbs@nowhere.in.particular (Charlie Gibbs) I'm switching ISPs - watch this space. ###### From: QSB@QRM-QRN.net (Allodoxaphobia) Newsgroups: alt.folklore.computers Subject: Re: This is a great product References: <9juv7u$7jj$1@freenet9.carleton.ca> Reply-To: If You Reply Message-ID: User-Agent: slrn/0.9.6.2 (Linux) Date: 01 Aug 2001 21:29:52 GMT Lines: 28 NNTP-Posting-Host: 63.105.232.12 X-Trace: reader1.news.uu.net 996701392 882 63.105.232.12 Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!newsfeed00.sul.t-online.de!t-online.de!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!nntp.abs.net!uunet!dca.uu.net!ash.uu.net!spool0.news.uu.net!reader1.news.uu.net!not-for-mail Xref: chonsp.franklin.ch alt.folklore.computers:86490 On 01 Aug 2001 21:10:42 +0200, Peter scribbled: >>> "HWW" == Heinz W Wiggeshoff writes: > > >> sedygixikkhrhgopleqbkulseeszezdpki > > HWW> And you thought my name was a mouthful. > >Hmm...I've noticed that all these spam postings end with some >seemingly random sequence of letters. Is this some code?? No. Each piece of spam will have *it's own* "random sequence of letters." It prevents the spam catchers programs from identifying identical series'es of posts on usenet. You'll see this 'trick' as trailing 'serial numbers', and/or trailing gooble-de-gook on Subject: lines, and as trailing gibberish at the bottom of the message bodies. The Subject: line 'trick' is used to the same end on email spam. It's still pretty easy to filter for.... Jonesy -- | Marvin L Jones | jonz | W3DHJ | OS/2 | Gunnison, Colorado | @ | Jonesy | linux __ | 7,703' -- 2,345m | frontier.net | DM68mn SK ###### From: quirk@swcp.com (Taki Kogoma) Newsgroups: alt.folklore.computers Subject: Re: This is a great product Date: 1 Aug 2001 15:30:06 -0600 Organization: Nit-Pickers for a Better Tomorrow Afternoon Lines: 17 Message-ID: <9k9scu$q36@boofura.swcp.com> References: <9juv7u$7jj$1@freenet9.carleton.ca> NNTP-Posting-Host: boofura.swcp.com Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!newsfeed-zh.ip-plus.net!news.ip-plus.net!news.tesion.net!news.belwue.de!news-stu1.dfn.de!news-mue1.dfn.de!news-was.dfn.de!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!news.stealth.net!cyclone2.usenetserver.com!usenetserver.com!feeder.nmix.net!feeder.swcp.com!sloth.swcp.com!boofura.swcp.com!not-for-mail Xref: chonsp.franklin.ch alt.folklore.computers:86395 On 01 Aug 2001 21:10:42 +0200, did Peter , to alt.folklore.computers decree... >>> "HWW" == Heinz W Wiggeshoff writes: > > >> > >> sedygixikkhrhgopleqbkulseeszezdpki > > HWW> And you thought my name was a mouthful. > >Hmm...I've noticed that all these spam postings end with some >seemingly random sequence of letters. Is this some code?? Hashbuster to supposedly evade spam detectors. -- Capt. Gym Z. Quirk (Known to some as Taki Kogoma) quirk @ swcp.com Just an article detector on the Information Supercollider. ###### From: Peter Newsgroups: alt.folklore.computers Subject: Re: This is a great product Date: 03 Aug 2001 17:34:59 +0200 Organization: XS4ALL Internet BV Lines: 9 Sender: leela@localhost.localdomain Message-ID: References: <9juv7u$7jj$1@freenet9.carleton.ca> NNTP-Posting-Host: as19-4-8.mt.g.bonet.se X-Trace: news1.xs4all.nl 996899603 20598 194.237.245.53 (4 Aug 2001 04:33:23 GMT) X-Complaints-To: abuse@xs4all.nl NNTP-Posting-Date: 4 Aug 2001 04:33:23 GMT Original-Sender: leela@xs4all.nl X-Newsreader: Gnus v5.7/Emacs 20.7 Path: chonsp.franklin.ch!pfaff.ethz.ch!news-zh.switch.ch!news-ge.switch.ch!news.tele.dk!193.190.198.17!newsfeeds.belnet.be!news.belnet.be!transit.news.xs4all.nl!chaucer!nobody Xref: chonsp.franklin.ch alt.folklore.computers:86564 >> "A" == Allodoxaphobia writes: A> No. A> Each piece of spam will have *it's own* "random sequence of letters." A> It prevents the spam catchers programs from identifying identical A> series'es of posts on usenet. Ah, yes, of course. Thanks all who replied! -peter