Forged posting (was: Re: alternator problems on 94 imprezza)

Dec 25, 2004 4 Replies

A message with some forged headers, purportedly with message ID: and purportedly with NNTP-Posting-Host: 66.42.103.94, having the lines From: David Ryeburn and Approved: David Ryeburn in the forged portions of the headers, has been posted to this group and others, with followups to news.admin.net-abuse.email. That message was a reply to the message which started the"alternator problems on 94 imprezza" thread. I believe that the message with forged headers actually originated in the Netherlands, although I may be mistaken about that, and I believe that the NNTP-Posting-Host IP address and the message ID in it are also forged.



I did not post that obscene message, nor did my computer do it for me behind my back (it's a Mac running OS 10.3.7 and using MT-NewsWatcher, not a Windows machine using Outlook Express, and it does have a firewall as well as full virus software installed and regularly updated so as to catch wandering Windows worms and viruses and not act as a Typhoid Mary). As you may determine from other legitimate postings of mine, I have at the moment NNTP-Posting-Host: 64.180.226.48 in the appropriate header (this may change if the computer is off long enough to get a new IP address when re-booted and Telus ADSL gives me a different IP address).



(I did post a legitimate reply to the original message in the thread; that's Message-ID: .)



Be careful, as always, to inspect the Newsgroups: header and delete inappropriate ones. Too much of this stuff is going on in various newsgroups. I think the aim is to overload newsgroups such as news.admin.net-abuse.email by means of multiple newsgroup postings; newsgroup trimming will help defeat that aim.



David


ya, i posted the original thread, and i got a baby cooking recipe from 'me' as well. anywyas, no harm felt, except my dead ass car.

Hi all,

An identical series of events occured with the posting I made three threads below, and with the reply I received to that.

I cannot work out how it was done, but don't people have better things to do?

(Obvously not)

Agreed...

It seem my address has been "harvested" recently (from a different NG) and it seems I'm posting cooking recipes... at least according to a German site that alerted me to this situation. Anyone who knows me would know I'm the last person on the planet to post anything having to do with cooking (LOL)

Anyone have any good ways to eliminate this kind of stuff? Munged addresses haven't worked for me in the past...

Rick

Emigrate to another planet where idiots like the one involved don't exist?

You'll notice I use a munged address (with instructions in my signature for easy address repair). That does seem to help with the e-mail received SPAM problem, and messing up the "ca" part of the domain insures that the SPAM involved bounces immediately since "caz" doesn't exist, rather than going all the way to SFU before bouncing and thus clogging the e-mail system (which is what would happen if I munged the "ryeburn" part of the address). Also non-delivery messages for e-mail with my address forged into the "From:" line get sent to the "caz" address, immediately bounce, and thus also don't bother me.

The forged posting in this newsgroup yesterday picked up and used my munged address. At least any complaints that I would have otherwise gotten, for allegedly posting a message appropriate only for cannibals, got de-railed.

There is more discussion of this over in the newsgroup comp.mail.eudora.mac, which has suffered similarly. And lots more over in rec.radio.amateur.antenna. I don't think it's hit rec.backcountry, rec.climbing, etc., yet.

David, who'd rather talk about his Subaru

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required