Overview of spam from Ctimail.com

15 Feb 2006

Note: Automated spam monitoring stopped several years ago. These web pages are maintained for historical reasons. Some may be updated from time to time as news about the individual sites becomes available.

No spam today

Overview of last 14 reports

datepoststotalBI
11 Sep 2000 327239.17full headers
23 Jul 2000 3817366.51full headers
07 Jul 2000 4316071.11full headers
23 Jun 2000 3514257.29full headers
09 Jun 2000 6318691.96
19 May 2000 299445.56
28 Apr 2000 1716851.25
07 Apr 2000 46310111.07
14 Mar 2000 2911951.94
25 Feb 2000 138346188.18
26 Jan 2000 1710939.52
19 Jan 2000 4613669.33
12 Jan 2000 168233.46
03 Jan 2000 68645189.12

Overview of history

poststotalBI
Total spam since 20 Oct 199910014052 1717.43
Peak spam on 3 Jan 200068645 189.12
Peak daily spam on 23 Nov 19992951 34.66
Average daily spam3.012.1 5.09

full history also available

General information about Ctimail.com

Added 22 Mar 1999. Current (May 1999) spammer seems to be a spammer-for-hire, posting ads for various porn and scam sites. Some of these ads contain javascript which pops up windows to the advertised site.

(Remember: Always disable Javascript when using a web browser to read email or netnews.)

There has been no response from Cti as of May 27, 1999. Cti may be rogue.

Ownership & Contact Info

Whois identifies ctimail.com as
City Telecom (HK) Ltd (CTIMAIL-DOM)
   9/F Tower 1, Grand Century Place
   Kowloon, NIL NIL
   HK

   Domain Name: CTIMAIL.COM

   Administrative Contact, Technical Contact, Zone Contact:
      Stephen Hui  (SH283-ORG) hwhui@CTIHK.COM
      +852 21998530, Fax- +852 21998972
   Billing Contact:
      Jeffrey Vong  (JV-ORG)  info@IA.COM.HK
      +852 24213121, Fax- +852 24010055

Site history


NetNews Feeds

ctimail.com receives netnews feeds from the following sites that I know of:

These sites have been added to the reporting list for ctimail.com to keep them aware of the problem, and to suggest that they terminate their netnews feed with ctimail.com until such time that ctimail.com adopts an anti-spam policy and regains control of their servers.


Sample Spam

From: xlpnpc@hotmail.com Newsgroups: sci.engr.color Subject: I want your support 8355 Date: 3 May 1999 12:40:36 GMT Organization: City Telecom (HK) LTD Lines: 13 Message-ID: <7gk5g4$m5a$11747@news.ctimail.com> NNTP-Posting-Host: 123user209.ctinets.com X-Trace: news.ctimail.com 925735236 22698 203.80.123.209 (3 May 1999 12:40:36 GMT) X-Complaints-To: usenet@news.ctimail.com NNTP-Posting-Date: 3 May 1999 12:40:36 GMT Path: denver-news-feed1.bbnplanet.com!su-news-hub1.bbnplanet.com! cpk-news-hub1.bbnplanet.com!news.gtei.net!newsfeed.cwix.com! 202.84.255.3!news.hkt.net!news2.hkt.net!news.ctimail.com! not-for-mail Hello Everybody! I saw somebody posted a message few days ago. It said that is a newsgroup service which has a lot of uncensored pictures, softwares and mpeg files. So, I joined that newsgroup. But, I discovered that there is also a referral program. If you joined under my userid, you and I have half month service free. So, please join it under my user name called SMART. The newsgroup service provider web site is as follows: http://www.cit-news.com Thank you very much gdkjzuqzbwy
The following is an example of spam for multiple customers, containing uuencoded javascript which automatically pops up windows to the advertised sites. From: wfyyyz@olpe.org Newsgroups: rec.nude Subject: L O O K !! Her TITS is BIGGER than your HEAD..... Date: 5 May 1999 02:26:35 GMT Organization: City Telecom (HK) LTD Lines: 30 Message-ID: <7goa8r$pit$804@news.ctimail.com> NNTP-Posting-Host: 76user88.ctinets.com X-Trace: news.ctimail.com 925871195 26205 203.80.76.88 (5 May 1999 02:26:35 GMT) X-Complaints-To: usenet@news.ctimail.com NNTP-Posting-Date: 5 May 1999 02:26:35 GMT Path: denver-news-feed1.bbnplanet.com!su-news-hub1.bbnplanet.com! news.gtei.net!newsfeed.wli.net!howland.erols.net!newsfeed.cwix.com! 202.84.255.3!news.hkt.net!news2.hkt.net!news.ctimail.com! not-for-mail zepnqktbmusnbopwfkhkdnowdmcizkwsqiyeocedefkbvzwgnexxojsknipyrv [UU-encoded sections have been decoded] <!doctype html public "-//w3c//dtd html 4.0 transitional//en"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <meta name="Author" content="cyber"> <meta name="GENERATOR" content="Mozilla/4.5 [en] (Win95; I) [Netscape]"> <title>teencore2</title> </head> <body> <body onload="window.open('http://www.teencore.com/rat.link/imhere')"></body> </body> </html>&y> </html>& <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <META NAME="Author" CONTENT="Gregory Au"> <META NAME="GENERATOR" CONTENT="Mozilla/4.08 [en] (Win95; I) [Netscape]"> <TITLE>turbo cash ( fantasy pit )</TITLE> </HEAD> <BODY> <body onload="window.open('http://www.turbocash.com/partners/jws-track.cgi?ID=tc1352&Site=fpit')"></body> </BODY> </HTML> </BODY> </HTML>

To report spam, contact one or more of

A complete history may also be available.

General notes:

Return to top | Return to spam summaries | complete history

The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.

This page maintained by Ed Falk