UPDATE: he's posting through random hosts in the ICG netblock. presumably a dial-up-connection.
The following nFilter magic will catch all the ICG hosts You *WILL* need to have 'enable regular expressions' selected in the configuration panel.
rec.woodworking drop nntp-posting-host:.*206\.216\.[456]
For those who care, the 'general form' of an nFilter incantation is:
newsgroup_name action header:matchstring
The usual 'action' is 'drop', you can also 'flag', or 'score' see the manual 'header' is the header you want to filter on, and 'matchstring' is the 'regular expression' you want to match,
a 'regular expression' can be a literal string, that requires an exact match, or can contain 'patterns' that match any of a number things -- e.g. the '[456]' in the nFilter rule above is a pattern that matches "either a 4, or a 5, or a 6".
NOTE: '.' has a special meaning in a regular expression (i.e. 'match _any_ character'), so when you want to match *only* a '.', you have to precede it with a '', to indicate you mean the 'literal character .', not the 'match any' symbol. Caveat: the first '.' must -not- be 'escaped' that way, because it *is* being used as 'match any character'. a 'reading' of the rule is match the string 'nntp-posting-host' (*WITHOUT* regard to case), followed by a ':', followed by 'any character' (indicated by the '.') occurring ZERO OR MORE TIMES (indicated by the '*' following the '.') followed by the string '206', followed by a literal '.', followed by the string '216' followed by a literal '.', followed by one of the characters '4', '5', or '6'