OT - Status of rec.woodworking

[<administrator]

To all participants of the rec.woodworking whom have been affected by the trolls I offer the following report from my observations. I have been studying this group for the past 6 or 7 months since I learned about the rec.woodworking troll problem in NANAU.

It seems that at least two of the most recent troll attack posts have come from the same NNTP posting IP address as one of your regular NG users who goes by the nickname of "Bay Area Dave".

I will post several message IDs for header examination. Just go to

and do an advanced search by message ID for each message ID below.

Friday morning a troll post from screen name "The Source": Message ID:

Came from IP address:

4.246.3.188

The evening before this troll post was made, Bay Area Dave made a post from the exact same IP address: Message ID:

Came from IP address:

4.246.3.188

Coincidence? Read on.

Later Friday evening another troll post appeared under the screen name "Big Mouth" with a list of names of many of the regular posters of this newsgroup with their unprotected e-mail address listed next to each name. The message was crossposted to the alt.spam newsgroup in an obviously malicious attempt to have all of these e-mail addresses harvested and added to spam mailing lists. Message ID:

Came from IP address

4.246.36.207

Just a couple hours before this troll post made, Bay Area Dave made two posts from the exact same IP address: Message ID:

Message ID:

Came from IP address:

4.246.36.207

Is Bay Area Dave one of the major trolls of this newsgroup? This can not be answered with certainty, however I've demonstrated above that he HAS trolled here. He has certainly shown that he likes to be a skin changer and that he has been known to lash out at people unnecessarily.

Thank you for your time. I hope this information will be helpful to the NG community.

-Samuel T.

[Greg Millen]

Elaborate set-up or the truth?

The IPs seem to indicate this anonymous "benefactor" has presented a *grain* of truth. The hosts do indeed appear similar.

However, skimming news.admin.net-abuse.usenet doesn't show a recent conversation on wreck trolls, last comment was in mid Feb.

BTW, why is it the OP has no NNTP-Posting-Host info himself?

BAD used to post under 68.120.???.???, recently he seems to be using

4.246.???.??? as the OP states.

System configuration seems to match (for what that's worth) he sent a post recently with: User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)

On 18 Nov 2003: User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)

I think some expert netsleuths should spend a little time verifying this, just to make sure a kangaroo court doesn't hang an innocent party. After all, the best way to mislead someone is with a partial truth.

What say the experts?

Greg

[Dave Hinz]

That's a dialup IP address in San Jose, specifically: Name: dialup-4.246.36.207.Dial1.SanJose1.Level3.net

As such, that IP is probably the client rather than a remote (shared) newsserver.

[Bob Schmall]

This clown posted a similar troll on a digital camera group.

[Bay Area Dave]

I'm not the troll. nor is Mark and Juanita. nor Dave Balderstone. nor the few others the idiot has impersonated. Anyone who thinks it's me is more stupid than the troll himself...

dave

Greg Millen wrote:

[Bay Area Dave]

that's correct. I'm in sunny SJ.

dave

Dave H> >

[Bay Area Dave]

you're funny! YOU are the troll or a troll sympathizer. I'm just one of several folks here who have been impersonated, you flaming NUT CASE!

How could the troll post from the same IP address is me? I'm not a internet expert, but I'll go out on a limb and say it's not possible. Or ARE there ways for a hacker to fake an IP on a message? Doug Miller might know the answer. Doug, is it possible for someone to fake the IP?

dave

[e-mail] wrote:

[Pop Rivet]

...

say

... Not Dave, but... Yes, it is possible. Also not difficult for those with the right applications.

[Doug Miller]

DAGS on "IP address spoofing".

Yep.

-- Regards, Doug Miller (alphageek-at-milmac-dot-com)

For a copy of my TrollFilter for NewsProxy/Nfilter, send email to autoresponder at filterinfo-at-milmac-dot-com You must use your REAL email address to get a response.

[Bay Area Dave]

sigh... great! [sarcastically, of course]

dave

P> ...

[Swingman]

The line the troll (or someone fooled by the troll) is using for proof :

X-NNTP-Posting-Host: 4.246.3.188

Can be EASILY added to an NNTP message header by anyone knowledgeable enough to do so

... don't worry about it. It is the usual troll BS, he just looked at the message header in one of your posts and picked an ip address for a similar address block to yours, nothing clever about it.

[Bay Area Dave]

so why would he do that if the Organization shows up as Dizum? that's a dead giveaway that HE isn't ME, so what's the point of spoofing an IP? We need some new laws!!

dave

Sw>>I'm just one of several folks here who have been

[Pop Rivet]

Well, here's a little hint about admin...me: His post comes from tenlinks.com. Whois on tenlinks.com shows its complaint address located at: [e-mail] Who seems to be the actual hosting site. That said, it's possible the headers are forged, but not likely, based on the general makeup of the complete header area. The "interesting" part is that this person, with such a community-minded orientation is hiding behind a fictitious address and allows no method of contact. Were I to post such information, in order to give it credibility, I would add that I could be reached at a throw-away address such as my dilbert84AThotmailDOTcom account. But I see there is no hint of corrobating evidence that is easily checked; only assumptions and opinion.

Pop

PS - I don't read the dilbert account very often unless I am expecting mail there. So, be aware I'm not expecting mail there.

[Rossco in Oshawa]

This entire message was likely a cut and paste job! A little time and effort spent by anyone who can read headers could fake ANY IP address as the alleged source.

[Pop Rivet]

... Errr, you are aware how trollish that sounds, right?

ALSO, are you actually AT nospam.com? If you mean that as a fictitious name, be aware that your are possibly causing the real person with that address to receive spam! Parsing input: nospam.com host 204.228.229.164 (getting name) = 164.anything.com.

Reporting addresses for

[e-mail]

That is VERY BAD netiquette!!!! STOP!! Never make up an email name unless you KNOW it doesn't and WILL NOT exist!

Sorry, but I am an avid spamfighter and SO much spam is sent to innocent parties because of unthinking things like making up a name.

Here's a name you can use that's real, but guaranteed to put everything into the bit bin: [e-mail]. It exists just for the purpose of being phoney. If you don't like that one, check out heypete.com. He's got a whole slew of names you can use. Do NOT make up anything "@heypete.com": See his site - he has the FULL addresses there that can be used.

Pop

[Swingman]

So they can't be tracked ... spammers are famous for it.

Won't work ... you can't legislate morality, or the Internet.

It will eventually take a new ip protocol to get the thing done propoerly ... the guys who invented the underpinnings of the 'Internet" were idealist to a large extent and did not foresee the need to arm the protocols against human meanness and greed.

[Swingman]

That's come up a number of times down through the years and it's a long known fact that the advertisers who own nospam.com do not operate an e-mail server ... probably for a damn good reason.

[Leon]

I agree with you Greg. While the announcement sounds interesting, this post is not totally unlike the Troll posts, appearing to be from some one legitimate. How can we verify that this is not a troll attack against Dave?

[Bay Area Dave]

good point, Rossco.

dave

Rossco > This entire message was likely a cut and paste job! A little time and

[Bay Area Dave]

interesting. thank you. I didn't see the alternative domain names to use that you said are at heypete.com. could you be more specific by posting the link? thanks.

I'll be glad to change my fake domain name to whatever will make everybody happy. :)

dave

P>> Anyone who thinks it's me is more stupid than the troll