Cancel messages

[Rob Mitchell]

Gerhard Häring <gh_pythonlist at gmx.de> wrote in message news:<mailman.1009779577.25166.python-list at python.org>...
> Le 28/12/01 à 07:18, Syver Enstad écrivit:
> > [...]
> > ========= WAS CANCELLED BY =======:
> > Path: news.sol.net!spool1-nwblwi.newsops.execpc.com!newsfeeds.sol.net!newspump.sol.net!newsfeed.direct.ca!look.ca!newshub2.rdc1.sfba.home.com!news.home.com!sjc1.nntp.concentric.net!newsfeed.concentric.net!newsfeed.ozemail.com.au!ozemail.com.au!not-for-mail
> > Message-ID: <cancel.u7kr73m1w.fsf at online.no>
> > Control: cancel <u7kr73m1w.fsf at online.no>
> > Subject: cmsg cancel <u7kr73m1w.fsf at online.no>
> > From: Syver Enstad <syver-en+usenet at online.no>
> > Newsgroups: comp.lang.python
> > X-No-Archive: yes
> > Lines: 2
> > NNTP-Posting-Host: wonenara.ozemail.com.au
> > X-Trace: ozemail.com.au 1009643103 203.108.164.177 (Sun, 30 Dec 2001 03:25:03 EST)
> > NNTP-Posting-Date: Sun, 30 Dec 2001 03:25:03 EST
> > Organization: OzEmail Ltd, Australia
> > Distribution: world
> > Date: Sat, 29 Dec 2001 13:32:11 GMT
> > 
> > This message was cancelled from within Mozilla.
> 
> Just curious.
> 
> What's going on here? A mailman bug from the mail <-> news gateway, or
> somebody coverage-testing their Mozilla?!

It's HipCrime, who does this sort of thing all the time.  Google has
archived thousands of these rogue cancels all originating from
203.108.164.177 on December 13, 14, 15, 16, 17, 18, 20, 21, 29, 30, &
31:

http://groups.google.com/groups?q=203.108.164.177&num=100&hl=en&scoring=d

I would first try complaining to abuse at ozemail.com.au , & then if the
rogue cancels continue after that date, to the newsfeeds propagating
the rogue cancel forgery floods to the rest of Usenet, as shown on the
Path line.  For example, for the header above, one would complain to
concentric.net, home.com, look.ca, etc.  If the abuse still continues
after that, these newsfeeds should be asked to block Ozemail entirely
until it demonstrates itself to be a responsible ISP.

Rob