Subject: [ADMIN] Welcome to!
From: (Tim Skirvin)
Message-ID: <nanas-faq.20090415070302$>
X-Version: 1.0 (Sun Jan 11 16:24:22 CST 2004) - Initial Version
Date: Wed, 15 Apr 2009 00:03:02 -0700
Expires: Wed, 27 May 2009 07:03:02 GMT

Archive-name: usenet/news-admin-net-abuse-sightings/welcome
Posting-Frequency: twice monthly
Last-modified: 2004/11/18
Version: 1.1
URL: (NANAS) is a newsgroup for reporting
net-abuse in a semi-formalized manner.  It is a robo-moderated forum,
controlled by a moderation 'bot that automatically approves anything that
it thinks is an on-topic post.


Q: Can you delete this post for me?
A: While I can legitimately issue a cancel message for anything that went
   through the bot (,
   this won't do much good since the message will already be archived on
   thousands of servers by the time I issue it, and most sites don't honor
   cancels in nana.* anyway.

Q: Some site has decided that my messages are spam because I was mentioned 
   in your group.  Help! 
A: If this site is just looking for IP blocks or email addresses in NANAS 
   and proclaiming them all 'spam sites'... well, this site is just plain 
   foolish.  All information in NANAS is unconfirmed.  Some addresses have 
   all incoming email forwarded to NANAS, spam or not.  And spammers tend 
   to forge that kind of information anyway.  
   I am willing to contact the admins of any site that are using NANAS
   reports to block sites or addresses.  Contact me personally
   ( if you need help.

Q: Do you spamblock addresses that go through your bot?
A: No, and I don't have any plans to do so.  Take it up with submitters of 
   the abuse reports.  I won't comment on my opinions on spamblocking...

Q: I can forward all... 
A: Stop right there.  I'd rather you didn't send me every email that comes 
   to a certain address; this tends to lead fairly rapidly to an effective 
   mailbomb, with hundreds of megabytes of forwarded traffic blocking both
   the network pipe and the local resources of the moderation box.  As
   such, I have taken a fairly hard-line approach to the problem: if any 
   problems with the volume of your posts come to my notice, I will
   immediately stop accepting your submissions, probably without notice.  
   You have been warned.


(This section assumes that you already know how to post to Usenet
newsgroups in general.)

As NANAS is a robomoderated forum, all messages must pass through the
moderation bot before they hit the network.  Unlike most such moderated
groups, though, NANAS is only meant for reports; discussion of the reports
should take place in the appropriate* group.

The robot moderator's posting criteria are simple: followups must be set
to an appropriate newsgroup, and a subject tag must be set accordingly.  
Methods of determination:

   o A 'Followup-to' header pointing at '' 
     will add an [email] subject tag; '' will 
     add a [usenet] tag.

   o An existing subject tag.  If the following tags are set, then
     followups will be set appropriately:
       [(e?[- ]?mail)]

     Additional tags have been added recently (late 2004):

       [(virus|relay|proxy|ssh|aim|scam)]	 ....misc

The body of the message should contain a full copy of the reported abuse,
both headers and body.  

If the message passes the posting criteria, then the message is approved
and an approval notice is sent back to the poster.  If the post is not
approved, then a rejection notice is sent back to the poster.  Note that
these notices will not arrive if the return address is faked; as such, use
of spamblocked addresses is discouraged.


Abuse reports regarding actual abuse of a shared public network such as
the Internet, Usenet, IRC, AIM, or other similar networks is on-topic in
NANAS.  This includes spam of all sorts, mailbombings, breakin reports,
lawsuit announcements, and anything related to topics that would be
on-topic anywhere in the* hierarchy,  

What is not on-topic is reports of abuse *on* the net, except in as
much as it relates to abuse *of* the net, such as flamewars and off-topic
posts.  Specifically, ongoing personal fights and flamewars from other
groups are not allowed in NANAS, and email flamewars should be kept away
from the group.

Note that even on-topic posts may be blocked if the volume from a specific
person or site is too large.  


The following charter was set down in 1996, when the group was created.
It is not particularly accurate, but is presented here for historical
reasons. is a forum for reports of sightings of  
  net abuse. It is a robomoderated forum, allowing only properly 
  formatted posts. Followups are required to be set strictly out of the 
  group and into the appropriate group in the* 
  hierachy. is moderated by a robot moderator, run 
  by a team of operators. The robot will automatically approve and post 
  messages according to the following criteria:

     1. The message is formatted for 78 or fewer characters per line, and 
        is easily human readable.
     2. The message follows a publicized template specified by the operator
        of the robot moderator. For example, the following format -may- be 
        the standard for a Usenet abuse sighting:

        Subject: [usenet] (Standard Subject)
        From: (valid address) -or- Reply-to: (valid address)
        (other standard headers)

        Abuse-spotted-in: (first group spotted)
        Abuse-Subject: (subject from abuse)
        Type-of-abuse: (EMP, ECP, binary, forgery, etc.  No set rules here)
        Description: (description and/or comments)
        (Full headers of the abuse)
        (Full body of the abuse)

        Messages may be automatically reformatted by the robot moderator 
        for archival and standardization purposes, using procedures 
        established by the operator of the robot moderator. For example, 
        the following changes may be made, if deemed appropriate:

        1. Only the first fifteen lines of the body of the abuse may be 
           posted; the rest would be archived, but not posted.
        2. The abuse may be reformatted to fit into 78 columns.
        3. If the text of the abuse would cause technical problems with 
           some newsreaders, the problem text may be replaced with X's; 
           if the abuse would cause problems with most newsreaders, the 
           article may not be posted at all.
        4. Several headers may be added at the discretion of the operator 
           of the robot moderator, such as the following:
          * X-Apparently-Complain-To: <>
          * X-Archive-Number: (a unique number)
          * X-Archives: (URL of site containing group archives) 

   Messages that do not meet these criteria will be sent back to the 
   sender with a copy of this charter and a listing of the published 
   templates, though at most one copy of this information will be sent 
   out per week.  Forged approvals will be automatically cancelled. 
   Changes to the robot moderator can only be enacted by a majority vote 
   of the then-current operators; similarly, operators can be added or 
   removed by a majority vote of the then-current operators. 

   The* hierarchy is for discussion of abuse of
   Usenet and/or the Internet; it is not for discussion of abuse of groups 
   or individuals on such networks, such as flames, personal attacks, or 
   off-topic messages. 

   Binaries are specifically prohibited from all groups in the
   news.admin.* hierarchy, except as examples of other abuse.  All 
   messages removed by unauthorized cancels in the hierarchy will be 
   automatically reposted by Dave the Resurrector or a similar program, 
   at the discretion of the group moderator or, for the unmoderated 
   groups, the operator of the resurrector program.  Spams, gateway 
   spews, and other attacks on the system itself will be removed as 
   appropriate, following standard Usenet guidelines.

While most of the limitations and requirements were never implemented, 
nobody complained.  The group has served its purpose without getting more
complicated than requiring Followup-to: headers.

NANAS is run by 'Bob', a Verimod moderation bot written by Tim Skirvin
back in 1996-97 and operated on  While venerable, the bot
still works years later. 

All posts that go through the moderation 'bot are signed with pgpmoose.
If a post does not have a cryptographically sound X-Auth header, then the
post was not approved by Elemental, and will be shortly cancelled by
another bot.

Tim Skirvin is currently the moderator of NANAS.  

  Moderator: (Tim Skirvin)
  Admin Contact Address:
  Article Submission Address:

Archives are available through  Tim has also written a
public web interface to the group, available at: