Message-ID: <>
	Date: Tue, 04 Aug 1998 00:39:47 -0500
	From: Julie Haugh <>
Organization: Girls "R" Good
     Subject: Proof of Unauthorized Cancellations

I'm going to break with tradition and put xxxxxxxx's screel at the
end of my message.

I'm going to describe a method which any UNIX user can employ to
determine that Ms. xxxxx is our mad canceller.

1). Connect to the NNTP port of the public NNTP server that xxxxxxxx
    has been using.

    % telnet nntp

2). Locate an article in which is a "Supersede" of
    a legitimate article.  Verify that the "NNTP-Posting-Host" is
    set to

3). Copy the message ID down and enter it as the command to the NNTP

    article <hirhyfgrvd.mrgpgrngtl.6q5f4s$nh2$>

4). Save the output of the NNTP server to a file for future
    reference and then quit from the server


5). Observe that the "NNTP-Posting-Host" of the message on that
    server differs from the "NNTP-Posting-Host" of the message on
    your server.

6). Reverse map the IP address in the NNTP-Posting-Host to the name
    of the host which actually issued the "Supersede".

    % host

7). Observe that the host which actually posted the message is the
    UUNET POP in Redmond, WA.

Feel free to do this for yourself -- just make sure you don't cut
and paste anything so xxxxxxxx can't accuse you of forging or
falsifying information.

If you wish to verify that she is continuing to issue cancels
via her account at Northwest Nexus, search for articles with an
NNTP posting host on that Australian ISP with a NNTP-Posting-Host
which is a NWNexus POP.  I found over a hundred which were.

So that xxxxxxxx cannot accuse me of "cutting and pasting", I
encourage you to repeat this exercise yourself.  I've attached
the "script" session I used to write this article.

Because I have found examples of unauthorized article cancellation
involving Northwest Nexus, UUNET Communications and AT&T, I have
copied those three companies on this article.  I trust that their
abuse and fraud departments will look into this.

c.e.l.e.s.t.e.s.. wrote:
> I did not make this mess Diane.
> So go ahead and cut and paste IP addresses from articles I post to
> into that so called evidence.
> I am sorry whatever happened to you happened.
> I am sorry you have to get a new ISP.
> I just want to see get back to discussing srs topics, like
> most other people. I have been saying that for quite a while now. I am as
> sick of the trolling, the outing the canceling, the spewing, whatever.
> You can dump another copy my name into the archives if it makes you feel
> better. At this point its insignificant.
> I am sorry.
> Maybe one of the famous urban legends can help you.
> I am a victim too. You, a lot of other people and this anonymous monster
> have plastered MY NAME all over the news archives, NOT yours. That monster
> made infinite copies of those outing posts of me, you know. I was hurt by
> this too.
> I am a victim in this too!
> Where is Dave the Resurrector to get my name out of the usenet archive
> databases?
> So don't call me villain
>   - we are all victims.
> The news group is a victim too,
> I founded that news group.
> now what?
> Yuck ...

Julianne Frances Haugh             Life is either a daring adventure
Mail: jfh AT                   or nothing at all.
					    -- Helen Keller

Script started on Tue Aug  4 00:25:43 1998
rpp386-> set -o vi
rpp386-> telnet nntp
rpp386-> telnet nntp
Connected to
Escape character is '^]'.
200 DNEWS Version 4.5h, S0, posting OK 
100 Legal commands
  authinfo user Name|pass Password
  article [MessageID|Number]
  body [MessageID|Number]
  check MessageID
  group newsgroup
  head [MessageID|Number]
  list [active|active.times|newsgroups|subscriptions]
  listgroup newsgroup
  mode stream
  mode reader
  newgroups yymmdd hhmmss [GMT] [<distributions>]
  newnews newsgroups yymmdd hhmmss [GMT] [<distributions>]
  stat [MessageID|Number]
  takethis MessageID 
  xgtitle [group_pattern]
  xhdr header [range|MessageID]
  xover [range]
  xpat header range|MessageID pat [morepat...]

article <hirhyfgrvd.mrgpgrngtl.6q5f4s$nh2$>
220 5893 <hirhyfgrvd.mrgpgrngtl.6q5f4s$nh2$> article retrieved - head and body follows
Message-ID: <hirhyfgrvd.mrgpgrngtl.6q5f4s$nh2$>
Supersedes: <mrgpgrngtl.6q5f4s$nh2$>
Subject: Re: Rosalind its bizarre
From: Anonymous <>
Sender: Anonymous <>
Approved: Anonymous <>
Date: 3 Aug 1998 23:53:59 GMT
X-No-Archive: Yes
X-NNTP-Posting-Host: []
X-XS4ALL-Date: 3 Aug 1998 23:54:02 GMT
Remailed-By: Anonymous Remailer <>
X-Mailer: AnonPost. Post anonymously to Usenet.
Lines: 2


205 closing connection - goodbye!
Connection closed by foreign host.
rpp386-> host

rpp386-> exit
Script done on Tue Aug  4 00:36:46 1998