Rogue cancels are apparently still emitted from newsfeed.t-com.hr, two
months after the first notice sent to the abuse desk (ack'ed by a ticket
saying that the issue was "solved")

Newsmasters still accepting cancels should filter "newsfeed.t-com.hr" as
a potentially hostile source of rogue cancels, or can switch to a more
secure system (NoCeM)

[ Note: the cancels are a bit odd, with forged NNTP-Posting-Host and
Control: cancel targetting themselves -- maybe trick to attempt to
disrupt cleaning of real spams ? ]

Rogue cancel sample:
--------------------

Path: ...!t-online.de!newsfeed.t-com.hr!Iskon!not-for-mail
From: bleachbot <bleach...@httrack.com>
Newsgroups: misc.health.diabetes
Subject: cmsg cancel
<c617a371-b25d-3a09-3f78-8c1c63a77...@m7g2000prd.googlegroups.com>
Control: cancel
<c617a371-b25d-3a09-3f78-8c1c63a77...@m7g2000prd.googlegroups.com>
Date: Tue, 3 Nov 2009 20:54:06 +0000 (UTC)
Organization: Nowhere Corp.
Lines: 1
Sender: fjrjtrade <fjrjtrad...@sina.com>
Message-ID:
<cancel.c617a371-b25d-3a09-3f78-8c1c63a77...@m7g2000prd.googlegroups.com>
References:
<c617a371-b25d-3a09-3f78-8c1c63a77...@m7g2000prd.googlegroups.com>
NNTP-Posting-Host: 66.230.230.230
X-Trace: sunce.iskon.hr 1257281646 2024 66.230.230.230 (3 Nov 2009
20:54:06 GMT)
X-Complaints-To: abuse@iskon.hr
NNTP-Posting-Date: Tue, 3 Nov 2009 20:54:06 +0000 (UTC)

Sample message-id's:
--------------------