Watch, Follow, &
Connect with Us

Welcome, Guest
Guest Settings
Help

Thread: Korean spam



Permlink Replies: 18 - Last Post: Apr 19, 2016 2:16 AM Last Post By: Rudy Velthuis (...
Helmuth J.H. Ad...

Posts: 96
Registered: 2/28/01
Korean spam
Click to report abuse...   Click to reply to this thread Reply
  Posted: Mar 1, 2016 4:45 AM
This message is no longer available.
Pieter Zijlstra

Posts: 7
Registered: 5/18/01
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Mar 25, 2016 6:08 PM   in response to: Helmuth J.H. Ad... in response to: Helmuth J.H. Ad...
Helmuth J.H. Adolph wrote:

This message is no longer available.

Resetting message count.

--
Pieter

"Humor is the great thing, the saving thing. The minute it crops
up, all our irritations and resentments slip away and a sunny
spirit takes their place." -- Mark Twain (1835-1910)
Rudy Velthuis (...


Posts: 6,890
Registered: 9/22/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Mar 26, 2016 3:21 AM   in response to: Pieter Zijlstra in response to: Pieter Zijlstra
Pieter Zijlstra wrote:

Helmuth J.H. Adolph wrote:

This message is no longer available.

Resetting message count.

How do I do that?

--
Rudy Velthuis http://www.rvelthuis.de

"The secret to creativity is knowing how to hide your sources."
-- Albert Einstein
Pieter Zijlstra

Posts: 7
Registered: 5/18/01
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Mar 26, 2016 6:06 PM   in response to: Rudy Velthuis (... in response to: Rudy Velthuis (...
Rudy Velthuis (TeamB) wrote:

Pieter Zijlstra wrote:

Helmuth J.H. Adolph wrote:

This message is no longer available.

Resetting message count.

How do I do that?

Hi Rudy,

By just posting a new message to this group ;-)

I noticed that XN was continuously attempting to download a lot of non-existing messages of this group (I guess it is caused by the deleted Korean spam messages). What XN does is asking the highest message number of the server (24130) and tries to download all message numbers since the last time I downloaded a message from this server (7961). With the previous situation, with no new messages, it will do this over and over again. Now with some new messages everything is OK again.

--
Pieter

"We don't like their sound, and guitar music is on the way out."
-- Decca Recording Co. rejecting the Beatles, 1962
Rudy Velthuis (...


Posts: 6,890
Registered: 9/22/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Mar 28, 2016 11:47 PM   in response to: Pieter Zijlstra in response to: Pieter Zijlstra
Pieter Zijlstra wrote:

Rudy Velthuis (TeamB) wrote:

Pieter Zijlstra wrote:

Helmuth J.H. Adolph wrote:

This message is no longer available.

Resetting message count.

How do I do that?

Hi Rudy,

By just posting a new message to this group ;-)

I noticed that XN was continuously attempting to download a lot of
non-existing messages of this group (I guess it is caused by the
deleted Korean spam messages). What XN does is asking the highest
message number of the server (24130) and tries to download all
message numbers since the last time I downloaded a message from this
server (7961). With the previous situation, with no new messages, it
will do this over and over again. Now with some new messages
everything is OK again.

Ah, that explains the delay. Thanks.

How's life?
--
Rudy Velthuis http://www.rvelthuis.de

AMAZING BUT TRUE ...
There is so much sand in Northern Africa that if it were spread
out it would completely cover the Sahara Desert.
Pieter Zijlstra

Posts: 7
Registered: 5/18/01
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Mar 26, 2016 7:03 PM   in response to: Rudy Velthuis (... in response to: Rudy Velthuis (...
Rudy Velthuis (TeamB) wrote:

Pieter Zijlstra wrote:

Helmuth J.H. Adolph wrote:

This message is no longer available.

Resetting message count.

How do I do that?

PS the current "spam attack" is coming from the Philippines with IP-address http://en.utrace.de/?query=112.206.114.244 it shouldn't be that hard to block.

--
Pieter

"It has been said that the great scientific disciplines are
examples of giants standing on the shoulders of other giants.
It has also been said that the software industry is an example
of midgets standing on the toes of other midgets."
-- Alan Cooper About Face
Pieter Zijlstra

Posts: 7
Registered: 5/18/01
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Mar 26, 2016 7:17 PM   in response to: Pieter Zijlstra in response to: Pieter Zijlstra
Pieter Zijlstra wrote:

Rudy Velthuis (TeamB) wrote:

Pieter Zijlstra wrote:

Helmuth J.H. Adolph wrote:

This message is no longer available.

Resetting message count.

How do I do that?

PS the current "spam attack" is coming from the Philippines with IP-address http://en.utrace.de/?query=112.206.114.244 it shouldn't be that hard to block.

Maybe the legal-department of EMBT should have a go with this IP-address and hunt down this spammer?

--
Pieter

On the value of binary; the Bible says: "But let your communication
be Yea, yea; nay, nay: for whatsoever is more than these cometh
of evil." -- (Matthew 5:37)
Rudy Velthuis (...


Posts: 6,890
Registered: 9/22/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Mar 28, 2016 11:47 PM   in response to: Pieter Zijlstra in response to: Pieter Zijlstra
Pieter Zijlstra wrote:

Pieter Zijlstra wrote:

Rudy Velthuis (TeamB) wrote:

Pieter Zijlstra wrote:

Helmuth J.H. Adolph wrote:

This message is no longer available.

Resetting message count.

How do I do that?

PS the current "spam attack" is coming from the Philippines with
IP-address http://en.utrace.de/?query=112.206.114.244 it shouldn't
be that hard to block.

Maybe the legal-department of EMBT should have a go with this
IP-address and hunt down this spammer?

I'm not so sure it is illegal in the Philippines, just like copyright
laws don't seem to be very strict there.

--
Rudy Velthuis http://www.rvelthuis.de

"A foolish consistency is the hobgoblin of little minds, adored by
little statesmen and philosophers and divines."
-- Ralph Waldo Emerson
Rudy Velthuis (...


Posts: 6,890
Registered: 9/22/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Mar 28, 2016 11:47 PM   in response to: Pieter Zijlstra in response to: Pieter Zijlstra
Pieter Zijlstra wrote:

Rudy Velthuis (TeamB) wrote:

Pieter Zijlstra wrote:

Helmuth J.H. Adolph wrote:

This message is no longer available.

Resetting message count.

How do I do that?

PS the current "spam attack" is coming from the Philippines with
IP-address http://en.utrace.de/?query=112.206.114.244 it shouldn't be
that hard to block.

I know. We (well, Jeff) blocked a lot of them already. We keep on
finding new ones. <g>

--
Rudy Velthuis http://www.rvelthuis.de

"Giving money and power to government is like giving whiskey
and car keys to teenage boys."
-- P. J. O'Rourke
Jeff Overcash (...

Posts: 1,328
Registered: 9/23/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Mar 29, 2016 12:41 PM   in response to: Rudy Velthuis (... in response to: Rudy Velthuis (...
Rudy Velthuis (TeamB) wrote:
Pieter Zijlstra wrote:

Rudy Velthuis (TeamB) wrote:

Pieter Zijlstra wrote:

Helmuth J.H. Adolph wrote:

This message is no longer available.
Resetting message count.
How do I do that?
PS the current "spam attack" is coming from the Philippines with
IP-address http://en.utrace.de/?query=112.206.114.244 it shouldn't be
that hard to block.

I know. We (well, Jeff) blocked a lot of them already. We keep on
finding new ones. <g>

And I'm blocking 256 at a time, unfortunately that range from that company only
has 1/2 the range (they have like 112.206.0-112.206.127) which needs 128 entries
to block. I ought to look at the other half and see if it is also a Philippines
company. I'm trying to not be wide on what I am blocking but get as much as I
can. Basically I reverse lookup the IP address and if all 256 are owned by the
same company I block them all in one go.

We've seen a few from India but those I've been baning the user and it isn't
coming back, baning the user in this case doesn't seem to help.

Unfortunately cleanup is very slow through the web interface. XanaNews is
faster but for some reason only allows 1 at a time AFAICT.

--
Jeff Overcash (TeamB)
(Please do not email me directly unless asked. Thank You)
Learning is finding out what you already know. Doing is demonstrating that you
know it. Teaching is reminding others that they know it as well as you. We are
all leaners, doers, teachers. (R Bach)

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus
Rudy Velthuis (...


Posts: 6,890
Registered: 9/22/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Mar 29, 2016 11:32 PM   in response to: Jeff Overcash (... in response to: Jeff Overcash (...
Jeff Overcash (TeamB) wrote:

Unfortunately cleanup is very slow through the web interface.
XanaNews is faster but for some reason only allows 1 at a time AFAICT.

There is a secret registry key (made especially for TeamB!) that lets
you and me cancel thousands of messages at once, if necessary. I
thought you knew it. I'll email it to you.

--
Rudy Velthuis http://www.rvelthuis.de

"I don't pray because I don't want to bore God." -- Orson Welles.
Jeff Overcash (...

Posts: 1,328
Registered: 9/23/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Mar 30, 2016 11:20 AM   in response to: Rudy Velthuis (... in response to: Rudy Velthuis (...
Rudy Velthuis (TeamB) wrote:
Jeff Overcash (TeamB) wrote:

Unfortunately cleanup is very slow through the web interface.
XanaNews is faster but for some reason only allows 1 at a time AFAICT.

There is a secret registry key (made especially for TeamB!) that lets
you and me cancel thousands of messages at once, if necessary. I
thought you knew it. I'll email it to you.

Sure, send it. I didn't know it, actually I am thinking of doing something like
we did when LAME was attacking off topic all those years ago and writing
something and killing everything with WLD333.COM in the a subject and just have
it cleaning up every minute So need to look at the Xananews code to see how the
cancel is sent (since IIRC Jive does not accept cmsg type posts like the old
netscape server did).

--
Jeff Overcash (TeamB)
(Please do not email me directly unless asked. Thank You)
Learning is finding out what you already know. Doing is demonstrating that you
know it. Teaching is reminding others that they know it as well as you. We are
all leaners, doers, teachers. (R Bach)

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus
Rudy Velthuis (...


Posts: 6,890
Registered: 9/22/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Apr 6, 2016 1:31 PM   in response to: Jeff Overcash (... in response to: Jeff Overcash (...
Jeff Overcash (TeamB) wrote:

(since IIRC Jive does not accept cmsg type posts like the old
netscape server did).

Yes, it does. That is exactly how XanaNews does it.

It sends messages in the form

cmsg cancel <818904 at forums dot embarcadero dot com>

(that is an actual example, a cancel message sent March 5, one of
thousands I have in my archives).

The difference with the "olden days" is that the current setup does not
expose (or have?) a control.cancel group where you can see them.

--
Rudy Velthuis http://www.rvelthuis.de

"Contraction of theological influence has at once been the best
measure, and the essential condition of intellectual advance."
-- William H. Lecky
Jeff Overcash (...

Posts: 1,328
Registered: 9/23/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Apr 6, 2016 3:49 PM   in response to: Rudy Velthuis (... in response to: Rudy Velthuis (...
Rudy Velthuis (TeamB) wrote:
Jeff Overcash (TeamB) wrote:

(since IIRC Jive does not accept cmsg type posts like the old
netscape server did).

Yes, it does. That is exactly how XanaNews does it.

It sends messages in the form

cmsg cancel <818904 at forums dot embarcadero dot com>

(that is an actual example, a cancel message sent March 5, one of
thousands I have in my archives).

The difference with the "olden days" is that the current setup does not
expose (or have?) a control.cancel group where you can see them.

Maybe that is what I was trying to do when it failed all those years ago I tried it.

Setting up an NT service that checks for new posts every minute and canceling
them if they have certain properties shouldn't take too much time. I'll look
into it later this week or weekend maybe.

Either that or I just ban that whole ISP :) You are more tolerant to them than
I am, I am banning with a wider brush.

--
Jeff Overcash (TeamB)
(Please do not email me directly unless asked. Thank You)
Learning is finding out what you already know. Doing is demonstrating that you
know it. Teaching is reminding others that they know it as well as you. We are
all leaners, doers, teachers. (R Bach)

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus
Rudy Velthuis (...


Posts: 6,890
Registered: 9/22/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Apr 14, 2016 3:34 AM   in response to: Jeff Overcash (... in response to: Jeff Overcash (...
Jeff Overcash (TeamB) wrote:

Rudy Velthuis (TeamB) wrote:
Pieter Zijlstra wrote:

Rudy Velthuis (TeamB) wrote:

Pieter Zijlstra wrote:

Helmuth J.H. Adolph wrote:

This message is no longer available.
Resetting message count.
How do I do that?
PS the current "spam attack" is coming from the Philippines with
IP-address http://en.utrace.de/?query=112.206.114.244 it shouldn't
be >> that hard to block.

I know. We (well, Jeff) blocked a lot of them already. We keep on
finding new ones. <g>

And I'm blocking 256 at a time, unfortunately that range from that
company only has 1/2 the range

FWIW, "that company" is the PLDT, the main telephone and Internet
provider for the Philippines. <g>

--
Rudy Velthuis http://www.rvelthuis.de

AMAZING BUT TRUE ...
There is so much sand in Northern Africa that if it were spread
out it would completely cover the Sahara Desert.

Jeff Overcash (...

Posts: 1,328
Registered: 9/23/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Apr 14, 2016 9:35 AM   in response to: Rudy Velthuis (... in response to: Rudy Velthuis (...
Rudy Velthuis (TeamB) wrote:
Jeff Overcash (TeamB) wrote:

Rudy Velthuis (TeamB) wrote:
Pieter Zijlstra wrote:

Rudy Velthuis (TeamB) wrote:

Pieter Zijlstra wrote:

Helmuth J.H. Adolph wrote:

This message is no longer available.
Resetting message count.
How do I do that?
PS the current "spam attack" is coming from the Philippines with
IP-address http://en.utrace.de/?query=112.206.114.244 it shouldn't
be >> that hard to block.
I know. We (well, Jeff) blocked a lot of them already. We keep on
finding new ones. <g>
And I'm blocking 256 at a time, unfortunately that range from that
company only has 1/2 the range

FWIW, "that company" is the PLDT, the main telephone and Internet
provider for the Philippines. <g>


for a while it was a different company, but has lately been switched to the main
ISP. I am tempted to just block the whole 49.150. range.

--
Jeff Overcash (TeamB)
(Please do not email me directly unless asked. Thank You)
Learning is finding out what you already know. Doing is demonstrating that you
know it. Teaching is reminding others that they know it as well as you. We are
all leaners, doers, teachers. (R Bach)

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus
Rudy Velthuis (...


Posts: 6,890
Registered: 9/22/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Apr 19, 2016 2:16 AM   in response to: Jeff Overcash (... in response to: Jeff Overcash (...
Jeff Overcash (TeamB) wrote:

for a while it was a different company, but has lately been switched
to the main ISP. I am tempted to just block the whole 49.150. range.

I have a feeling that blocking xx.yy.zz.* does not work. I still get
spam from those blocks. Only single IP numbers seem to work reliably.

--
Rudy Velthuis http://www.rvelthuis.de

"I'll sleep when I'm dead." -- Warren Zevon
Rudy Velthuis (...


Posts: 6,890
Registered: 9/22/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Apr 11, 2016 3:39 AM   in response to: Pieter Zijlstra in response to: Pieter Zijlstra
Pieter Zijlstra wrote:

Helmuth J.H. Adolph wrote:

This message is no longer available.

Resetting message count.

And again.

--
Rudy Velthuis http://www.rvelthuis.de

Weinberg's Corollary: An expert is a person who avoids the small
errors while sweeping on to the grand fallacy.
Quentin Correll


Posts: 2,205
Registered: 12/1/99
Re: Korean spam [Edit]
Click to report abuse...   Click to reply to this thread Reply
  Posted: Apr 11, 2016 12:03 PM   in response to: Rudy Velthuis (... in response to: Rudy Velthuis (...
Rudy,

| | Resetting message count.
|
| And again.

Thank you kind Sir!

--

Q -- XanaNews 1.19.1.372 - 2016-04-11 12:03:54
Legend
Helpful Answer (5 pts)
Correct Answer (10 pts)

Server Response from: ETNAJIVE02