View Single Post
  #7  
Old August 13th 07, 06:53 PM posted to rec.aviation.piloting
Peter Dohm
external usenet poster
 
Posts: 1,754
Default Any Ideas on Turning off the Spammer?

It would seem that the rec.aviation.piloting newsgroup, like many
other newsgroups, is being targeted for a "sporge" flood. In this
first flood, the articles were injected into Usenet from 13:30 to
11:21 (local), about ten hours. It is unclear to me at this time why
this is occurring, but it may be more than a malicious prank. ...

While I have not yet found a method of filtering out the sporge
articles, I have found some promising leads:

Each article is crossposted to the sci.crypt newsgroup.

The 'Path:' header field always contains:
news.isoc.lu!news.grnet.gr

The 'Subject:' header field always begins with a lower-case letter

Interesting series of observations.

The feature of the cross posted group (sci.script) is the only criteria that
appears to show promise in OE; however, it appears that the group must be
subscribed in order for the criteria to be entered in the Message Rules.

Unfortunately, sci.crypt does not appear to be carried on any server to
which I have known access. Therefore, I am not able to determine
experimentally whether the technique will work.

Fortunately, the "flood" has not reached a level which would mandate much
effort--it is currently only about as irritating as a resident troll.

Peter