Rogue cancels in gnu.emacs.gnus?

Rogue cancels in gnu.emacs.gnus?

[Per Abrahamsen]

In <URL: nntp://quimby.gnus.org/control/> there is a lot of cancel
messsages for Kai Großjohann (and others) articles, which doesn't seem
to origin from Kai, but from somewhere in Malaysia.  Kai also claim
they are not from him.

Does anyone here know what is happening?

Message-ID: <qbcdx1dee1l.dca@lucy.cs.uni-dortmund.de>
Control: cancel <lcaby6cac1o.fda@lucy.cs.uni-dortmund.de>
Subject: cmsg cancel <lcaby6cac1o.fda@lucy.cs.uni-dortmund.de>
From: Kai.Grossjohann@CS.Uni-Dortmund.DE (Kai Großjohann)
Newsgroups: gnu.emacs.gnus
Date: 1 Jul 2000 15:39:59 GMT
NNTP-Posting-Host: 202.188.146.165
X-NNTP-Posting-Host: 202.188.146.165
X-Trace: 1 Jul 2000 23:55:34 +0800, 202.188.146.165
Organization: TMnet Malaysia
Lines: 2
Path: quimby!news.oche.de!news.rwth-aachen.de!news-koe1.dfn.de!do.de.uu.net!newsfeed01.sul.t-online.de!newsfeed00.sul.t-online.de!t-online.de!diablo.theplanet.net!europa.netcrusader.net!204.71.34.3!newsfeed.cwix.com!news1.tm.net.my!202.188.146.165
Xref: quimby control:103

<lcaby6cac1o.fda@lucy.cs.uni-dortmund.de>

Re: Rogue cancels in gnu.emacs.gnus?

[Kai Großjohann]

I have also sent a message to postmaster at the last two hops
mentioned in the Path header.  We'll see what they say.

Thanks for bringing this up, Per.
kai
-- 
I like BOTH kinds of music.

Re: Rogue cancels in gnu.emacs.gnus?

[Miroslav Zubcic]

Per Abrahamsen <abraham@dina.kvl.dk> writes:

> In <URL: nntp://quimby.gnus.org/control/> there is a lot of cancel
> messsages for Kai Großjohann (and others) articles, which doesn't seem
> to origin from Kai, but from somewhere in Malaysia.  Kai also claim
> they are not from him.

Hi Per

This is maybe little off topic, but it is very interesting, I have
seen such messages in some groups (most of them are comp.mail.*
groups) with faked posts and exactly same headers.

A week ago 270 messages with 30-75 lines each, has arrived on group
comp.mail.sendmail in short time (couple of minutes). This messages
was faked two weeks old articles from various people on that groups
(according to subjects and from lines with bodys changed to something
which looks like ROT13 and "super" like first word.

> Does anyone here know what is happening?

Somebody is trying to make a mess probably...

> Message-ID: <qbcdx1dee1l.dca@lucy.cs.uni-dortmund.de>
              ^^^^^^^^^^^^^^^^^
Exactly same way, faked localpart of `Message-Id: ' and real domain.

> Organization: TMnet Malaysia
              ^^^^^^^^^^^^^^^^^
Yes, 270 articles with this same organization, header, all of them
faked old articles from real people... including mine too.

-- 
This signature intentionally left blank