Note to everyone: Beware forged posts

[Jim Logajan]

I see someone has targeted several people who post to r.a.p and r.a.h and
begun forging their names in the "From" headers and posted troll-like posts
in an attempt to "Joe Job" the targets. Or it may simply be an attempt to
disrupt the newsgroups (more than usual, that is!). At the moment all the
forged posts _seem_ to have "albasani.net" in the "Path" header and can be
identified that way, though of course the perp may switch to an alternate
provider.

If you see an unexpectedly anal post from someone, check the headers of the
post in question and try to compare it to much older (presumably less anal)
posts from that same person.

[BobR]

On Apr 6, 6:47*pm, Jim Logajan > wrote:
> I see someone has targeted several people who post to r.a.p and r.a.h and
> begun forging their names in the "From" headers and posted troll-like posts
> in an attempt to "Joe Job" the targets. Or it may simply be an attempt to
> disrupt the newsgroups (more than usual, that is!). At the moment all the
> forged posts _seem_ to have "albasani.net" in the "Path" header and can be
> identified that way, though of course the perp may switch to an alternate
> provider.
>
> If you see an unexpectedly anal post from someone, check the headers of the
> post in question and try to compare it to much older (presumably less anal)
> posts from that same person.

Yep, just found a couple of posts that I made when I haven't even been
home to get on the computer. Now that is sick.

[Mxsmanic]

On Sun, 06 Apr 2008 18:47:26 -0500, Jim Logajan wrote:

> I see someone has targeted several people who post to r.a.p and r.a.h and
> begun forging their names in the "From" headers and posted troll-like posts
> in an attempt to "Joe Job" the targets. Or it may simply be an attempt to
> disrupt the newsgroups (more than usual, that is!). At the moment all the
> forged posts _seem_ to have "albasani.net" in the "Path" header and can be
> identified that way, though of course the perp may switch to an alternate
> provider.
>
> If you see an unexpectedly anal post from someone, check the headers of the
> post in question and try to compare it to much older (presumably less anal)
> posts from that same person.

YAWN.

[Jim Logajan]

Forger went:
> YAWN.

Okay, so far you appear to have used the following free servers (probably
others I haven't noticed):

http://news.motzarella.org/
http://www.albasani.net/index.html.en
http://www.aioe.org/

Why not stick with one until you get bounced from it so you can move on to
the next?

[clare at snyder dot ontario dot canada]

On Sun, 6 Apr 2008 16:55:56 -0700 (PDT), BobR
> wrote:

>On Apr 6, 6:47Â*pm, Jim Logajan > wrote:
>> I see someone has targeted several people who post to r.a.p and r.a.h and
>> begun forging their names in the "From" headers and posted troll-like posts
>> in an attempt to "Joe Job" the targets. Or it may simply be an attempt to
>> disrupt the newsgroups (more than usual, that is!). At the moment all the
>> forged posts _seem_ to have "albasani.net" in the "Path" header and can be
>> identified that way, though of course the perp may switch to an alternate
>> provider.
>>
>> If you see an unexpectedly anal post from someone, check the headers of the
>> post in question and try to compare it to much older (presumably less anal)
>> posts from that same person.
>
>Yep, just found a couple of posts that I made when I haven't even been
>home to get on the computer. Now that is sick.

Not the first time that's happened on R.A.H.

Wonder who they were talking about???????????

--
Posted via a free Usenet account from http://www.teranews.com

[Bertie the Bunyip[_25_]]

Mxsmanic > wrote in
:

> On Sun, 06 Apr 2008 18:47:26 -0500, Jim Logajan wrote:
>
>> I see someone has targeted several people who post to r.a.p and r.a.h
>> and begun forging their names in the "From" headers and posted
>> troll-like posts in an attempt to "Joe Job" the targets. Or it may
>> simply be an attempt to disrupt the newsgroups (more than usual, that
>> is!). At the moment all the forged posts _seem_ to have
>> "albasani.net" in the "Path" header and can be identified that way,
>> though of course the perp may switch to an alternate provider.
>>
>> If you see an unexpectedly anal post from someone, check the headers
>> of the post in question and try to compare it to much older
>> (presumably less anal) posts from that same person.
>
> YAWN.
>
Snort.


bertie

[Larry Dighera]

On Sun, 06 Apr 2008 18:47:26 -0500, Jim Logajan >
wrote:

>I see someone has targeted several people who post to r.a.p and r.a.h and
>begun forging their names in the "From" headers and posted troll-like posts
>in an attempt to "Joe Job" the targets.

Forged messages are a violation of many anonymous news gateways.

http://www.albasani.net/info/terms_of_use.html.en
Addresses specified in From:, Reply-To: and Sender: must be valid
and at the user's disposal. The top level domain (TLD) invalid may
be used for the From: address, e.g. . See
also RFC2606: http://www.faqs.org/rfcs/rfc2606.html

[[email protected]]

On Apr 6, 7:55 pm, BobR > wrote:

> Yep, just found a couple of posts that I made when I haven't even been
> home to get on the computer. Now that is sick.

It's been happening to me ever since WJRFlyBoy "left" the group.

How circumstantial.

I've also received some threatening emails on my blog form
"anonymous," spouting higher-octane venom of the same putrescence on
display here.

The list of servers Jim provided matches what I've seen in the blog
comments.

MX is FakeFlyBoy.

We'll see if he responds to this....



Dan McCormack

[[email protected]]

On Apr 7, 6:56 am, " > wrote:
> On Apr 6, 7:55 pm, BobR > wrote:
>
> > Yep, just found a couple of posts that I made when I haven't even been
> > home to get on the computer. Now that is sick.
>
> It's been happening to me ever since WJRFlyBoy "left" the group.
>
> How circumstantial.
>
> I've also received some threatening emails on my blog form
> "anonymous," spouting higher-octane venom of the same putrescence on
> display here.
>
> The list of servers Jim provided matches what I've seen in the blog
> comments.
>
> MX is FakeFlyBoy.
>
> We'll see if he responds to this....
>
> Dan McCormack

[[email protected]]

On Apr 6, 9:16 pm, Jim Logajan > wrote:

> Okay, so far you appear to have used the following free servers (probably
> others I haven't noticed):
>
> http://news.motzarella.org/http://www.albasani.net/index.html.enhttp://www.aioe.org/
>
> Why not stick with one until you get bounced from it so you can move on to
> the next?


More evidence:
--------------------------------------------------------------------------
WJRFlyboy > wrote in news:MPG.
:
--------------------------------------------------------------------------

And, most damning:
--------------------------------------------------------------------------
Newsgroups: rec.aviation.student, rec.aviation.piloting
From: WJRFlyBoy >
Date: Tue, 1 Apr 2008 14:23:19 -0400
Local: Tues, Apr 1 2008 2:23 pm
Subject: Re: Rod Machado's New PPL Manual

{snipped usual crap}

Here's free post and read text servers.
www.motzarella.org
nntp.aioe.org
news.albasani.net

See, you're all set, My Little Trick Pony. Bet you don't do it, bet
you don't. Bet you lied, again, Dan.
--------------------------------------------------------------------------

Pretty clear who's bile we're seeing.

[Mxsmanic]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

writes:

> MX is FakeFlyBoy.

There is no connection between myself and FakeFlyBoy,
or whomever you are talking about. I always post under
the same name.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2

iQA/AwUBR/qGPRv8knkS0DI6EQLqQQCfYI/+jhW28/0AaBVgq58mnuYYo2AAnRMP
r/ChOzrJkKnGHZcngwRffPMG
=2EPt
-----END PGP SIGNATURE-----

[Benjamin Dover]

Mxsmanic > wrote in
:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> writes:
>
>> MX is FakeFlyBoy.
>
> There is no connection between myself and FakeFlyBoy,
> or whomever you are talking about. I always post under
> the same name.
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 8.0.2
>
> iQA/AwUBR/qGPRv8knkS0DI6EQLqQQCfYI/+jhW28/0AaBVgq58mnuYYo2AAnRMP
> r/ChOzrJkKnGHZcngwRffPMG
> =2EPt
> -----END PGP SIGNATURE-----
>
>

Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!
Liar. Liar. Pants on fire!

[C J Campbell[_1_]]

On 2008-04-06 16:47:26 -0700, Jim Logajan > said:

> I see someone has targeted several people who post to r.a.p and r.a.h and
> begun forging their names in the "From" headers and posted troll-like posts
> in an attempt to "Joe Job" the targets. Or it may simply be an attempt to
> disrupt the newsgroups (more than usual, that is!). At the moment all the
> forged posts _seem_ to have "albasani.net" in the "Path" header and can be
> identified that way, though of course the perp may switch to an alternate
> provider.
>
> If you see an unexpectedly anal post from someone, check the headers of the
> post in question and try to compare it to much older (presumably less anal)
> posts from that same person.

Haven't seen them. Are they coming from Google Groups? I have filtered
those guys out because of all the spam.
--
Waddling Eagle
World Famous Flight Instructor

[Mxsmanic]

On Mon, 07 Apr 2008 22:05:58 GMT, Benjamin Dover wrote:

> Mxsmanic > wrote in
> :
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> writes:
>>
>>> MX is FakeFlyBoy.
>>
>> There is no connection between myself and FakeFlyBoy,
>> or whomever you are talking about. I always post under
>> the same name.
>>
>> -----BEGIN PGP SIGNATURE-----
>> Version: PGP 8.0.2
>>
>> iQA/AwUBR/qGPRv8knkS0DI6EQLqQQCfYI/+jhW28/0AaBVgq58mnuYYo2AAnRMP
>> r/ChOzrJkKnGHZcngwRffPMG
>> =2EPt
>> -----END PGP SIGNATURE-----
>>
>
> Liar. Liar. Pants on fire!

What a conceited clown you are.
--
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2
iQA/AwUBR/qGPRv8knkS0DI6EQLqQQCfYI/+jhW28/0AaBVgq58mnuYYo2AAnRMP
r/ChOzrJkKnGHZcngwRffPMG
=2EPt
-----END PGP SIGNATURE-----

[Bear Bottoms]

On Mon, 7 Apr 2008 04:14:52 -0700 (PDT), wrote:

> On Apr 6, 9:16 pm, Jim Logajan > wrote:
>
>> Okay, so far you appear to have used the following free servers (probably
>> others I haven't noticed):
>>
>> http://news.motzarella.org/http://www.albasani.net/index.html.enhttp://www.aioe.org/
>>
>> Why not stick with one until you get bounced from it so you can move on to
>> the next?
>
> More evidence:
> --------------------------------------------------------------------------
> WJRFlyboy > wrote in news:MPG.
> :
> --------------------------------------------------------------------------
>
> And, most damning:
> --------------------------------------------------------------------------
> Newsgroups: rec.aviation.student, rec.aviation.piloting
> From: WJRFlyBoy >
> Date: Tue, 1 Apr 2008 14:23:19 -0400
> Local: Tues, Apr 1 2008 2:23 pm
> Subject: Re: Rod Machado's New PPL Manual
>
> {snipped usual crap}
>
> Here's free post and read text servers.
> www.motzarella.org
> nntp.aioe.org
> news.albasani.net
>
> See, you're all set, My Little Trick Pony. Bet you don't do it, bet
> you don't. Bet you lied, again, Dan.
> --------------------------------------------------------------------------
>
> Pretty clear who's bile we're seeing.

Yours. You have been outed, Dan.
--
Bear "Cocaine 4 Kids" Bottoms; Google Me!
Freeware Website http://bewareofbearware.info