REPOST: Re: SCI.CRYPT is turning into CRAP

From: Francois Grieu (fgrieu_at_francenet.fr)
Date: 10/27/05


Date: Thu, 27 Oct 2005 17:19:24 +0200

Esa A E Peuha <esa.peuha@helsinki.fi> wrote:

> Just in case you didn't notice, this "Mouse" is posting from the
> exact same IP address and through the same server that the latest
> batch of cancels came from.

Brilliant observation. From what I see at my point of the net,
24.47.60.236 ool-182f3cec.dyn.optonline.net.
has posted a flow of 1038 cancel
on Wed, 26 Oct 2005, from 15:24:35 to 16:28:05 MST
one of which with the headers copied below [1]

And his message
Message-ID: <wypcire.11600$hifnapy.78147@fe12.lga>
titled "SCI.CRYPT is turning into CRAP"
was sent on Wed, 26 Oct 2005 15:43:47 MST
right when the cancels where flowing.

There is thus apparent evidence that the very machine
used to send said message was in the middle of spitting
a batch of cancels.

Mouse could have been using an "owned" "zombie"; in which
case I hope he or she is smart enough to find out how this
happened, and who the perp is.

  François Grieu

[1]
Path: news.free.fr!xref-2.proxad.net!spooler3-2.proxad.net!infeed-4.proxad.net!proxad.net!nx01.iad01.newshosting.com!newshosting.com!news.glorb.com!hwmnpeer01.lga!hwmedia!hw-filter.lga!fe10.lga.POSTED!53ab2750!not-for-mail
From: Bryan Olson <fakeaddress@nowhere.org>
Control: cancel <gd56f.6672$Zv5.1405@newssvr25.news.prodigy.net>
Subject: Cancel "Re: advice sought on key/data histogram analysis of rijndael/128 and serpent"
Newsgroups: sci.crypt
Message-ID: <yc85a.8623$Jy8.7300@newssvr25.news.prodigy.net>
X-Newsreader: NN version 6.5.0 #10 (NOV)
Lines: 2
Date: Wed, 26 Oct 2005 21:48:37 GMT
NNTP-Posting-Host: 24.47.60.236
X-Complaints-To: abuse@cv.net
X-Trace: fe10.lga 1130366629 24.47.60.236 (Wed, 26 Oct 2005 15:43:49 MST)
NNTP-Posting-Date: Wed, 26 Oct 2005 15:43:49 MST
Organization: Optimum Online
Xref: news.free.fr control.cancel:82289174

========= WAS CANCELLED BY =======:
Path: ...hammer.uoregon.edu!news.glorb.com!hwmnpeer01.lga!hwmedia!hw-filter.lga!fe08.lga.POSTED!53ab2750!not-for-mail
From: Francois Grieu <fgrieu@francenet.fr>
Control: cancel <fgrieu-639696.17192427102005@news16-e.proxad.net>
Subject: Re: SCI.CRYPT is turning into CRAP
Newsgroups: sci.crypt
Message-ID: <dueueh-110163.03077076102652@news16-e.proxad.net>
User-Agent: MT-NewsWatcher/3.0b11 (PPC)
Lines: 2
Date: Thu, 27 Oct 2005 21:14:50 GMT
NNTP-Posting-Host: 67.87.195.212
X-Complaints-To: abuse@cv.net
X-Trace: fe08.lga 1130458136 67.87.195.212 (Thu, 27 Oct 2005 17:08:56 MST)
NNTP-Posting-Date: Thu, 27 Oct 2005 17:08:56 MST
Organization: Optimum Online

========= WAS CANCELLED BY =======:
Path: ...news.mailgate.org!newscore.univie.ac.at!newsfeed01.chello.at!newsfeed02.chello.at!news.chello.at.POSTED!not-for-mail
From: Francois Grieu <fgrieu@francenet.fr>
Control: cancel <1$%$$-%_$_%$%%-_$$$@news.noc.cabal.int>
Subject: Cancel "REPOST: Re: SCI.CRYPT is turning into CRAP"
Newsgroups: sci.crypt
Date: Fri, 28 Oct 2005 20:04:34 GMT
Message-ID: <0%%%%$%-%_--$-_--%-@news.noc.cabal.int>
User-Agent: tin/pre-1.4-980818 ("Donovan") (UNIX) (FreeBSD/2.2.8-STABLE (i386))
X-Complaints-To: abuse@chello.at
Organization: chello.at
Lines: 2
NNTP-Posting-Host: 80.108.28.208 (80.108.28.208)
NNTP-Posting-Date: Fri, 28 Oct 2005 22:19:46 +0200
X-Trace: 95427436287e2f5c9b97515947



Relevant Pages