Usenet Explorer

Posted: **Sat Jan 05, 2008 10:40 pm**

can anyone show me a quick way to filter the MI5 posts on N.S.R group

not by header or subject but by amount of servers crostposted to

all help appreciated
SnowMan

Posted: **Sun Jan 06, 2008 12:37 pm**

are they crossposted to more newsgroups than usual (i mean the newsgroups: field in the headers of the posted message)?

i didn't add max crosspost filter option, not a problem to add it but usually spam programs have an option to set the number of newsgroups to be crossposted, so if a post goes to many newsgroups it is posted repeatedly with a particular post is crossposted at few newsgroups if at all.

you cannot kill filter them by some criteria? give me an example where to find them i could check it out, just in newsgroups which i'm downloading from i don't see anything like that.

Posted: **Sun Jan 06, 2008 6:19 pm**

he posts in a lot of groups but the main one i want to filter his posts is from news.software.readers

he has cross posted to these groups this time

news.admin.net-abuse.misc,
news.groups,
news.misc,
news.software.nntp,
news.software.readers

Posted: **Tue Jan 08, 2008 6:40 am**

ok i see but i see he also puts letters M I 5.

you can use this filter:

"M{^a-z}I{^a-z}5"

i see he cross-posts as well in this particular case, but anyway you can delete headers on entry with this kill filter, so also if he won't cross-post it will work.

so how you do it:

edit menu->filter editor

then press green arrow button to insert new entry.

name e.g. "MI5 kill filter" you may leave only "kill filters" checked if you like.

then enter filter

subject contains "M{^a-z}I{^a-z}5"

or (it appears this signature is always in the beginning of the subject).

subject begins with "M{^a-z}I{^a-z}5"

(double quotes narrow the matches further)

press ok.

then in edit menu->properties->kill filters you'll see "MI5 kill filter" under "available kill filters".

select the topmost "Newsgroups" entry in the middle pane, select "MI5 kill filter" in the first pane and press the "Add" button, you'll see it appearing under "Kill filters" rightmost pane.

then press OK.

then newly incoming headers of the spammer will enter as deleted, e.g. if you reset the newsgroup and redownload headers then check "del" in the quick filter dialog you can see all those spam posts as deleted.

i checked with search service it appears only the spammer posts are hit, it found 3279 such posts in the indexed (binary) groups, only one other post which contains "M.I.5" in the middle.

i see (binary groups posts) he doesn't post regularly looks like it started two weeks days ago, maybe some kind of periodic mental disorder, full moon, new year i don't know

Posted: **Tue Jan 08, 2008 9:46 am**

alex wrote:i see (binary groups posts) he doesn't post regularly looks like it started two weeks days ago, maybe some kind of periodic mental disorder, full moon, new year i don't know

It's been going longer than that. I noticed them months ago and I would assume they've been around since before I saw them.

I'm not interested enough to waste my time to see who or how many people are posting these but it's yet another example of how (if it is an individual) one person can annoy many very easily.

Posted: **Tue Jan 08, 2008 10:45 am**

thanks for the info Alex, ill put it to good use ASAP

i read somewhere that the person behind the MI5 spam has been successfully spamming usenet since the mid / late 90's, varying his messages everytime to beat the filters

taken from

Code: Select all

Subject: Re: Clever MI  crap
From: bealoid <signup@bealoid.co.uk>
Date: Tue, 01 Jan 2008 16:20:43 GMT
Newsgroups: news.software.readers
Message-ID: <Xns9A18A52F4524FYAsfKJXSTO@194.117.143.53>

He's probably one of the most "sucessful"[1a] Usenet spammers.  
He's been posting since at least 1996.  The phrase "MI5 persecution" 
returns a couple of million Google hits, which is pretty impressive when 
you consider the amount of subject line shifting that he does as well.  
He's varied his tactics - at times he's used anon remailers, open proxies, 
real accounts and username, etc.  And his posts get follow-ups, and not all 
of those fups are people calling him insane.[1b]

[1a]Depends how you define sucessful.  As he just wants to get his message 
"out there", and his message is "out there", he would define it as a 
sucess.
[1b]And even when people call him insane - that's a sucess, because it 
shows just "how effective" the MI5 persecution has been at "discrediting" 
him.[1b]

Posted: **Tue Jan 08, 2008 10:57 am**

Why don't we just settle on referring to him as 'Mr. Fruitloop'?

Whatever the motivation, I struggle to comprehend any reasons to want to piss off so many people in as prolonged a length of time as possible.