Overview of spam from Ctimail.com

15 Feb 2006

Note: Automated spam monitoring stopped several years ago. These web pages are maintained for historical reasons. Some may be updated from time to time as news about the individual sites becomes available.

No spam today

Overview of last 14 reports

date	posts	total	BI
11 Sep 2000	32	72	39.17	full headers
23 Jul 2000	38	173	66.51	full headers
07 Jul 2000	43	160	71.11	full headers
23 Jun 2000	35	142	57.29	full headers
09 Jun 2000	63	186	91.96
19 May 2000	29	94	45.56
28 Apr 2000	17	168	51.25
07 Apr 2000	46	310	111.07
14 Mar 2000	29	119	51.94
25 Feb 2000	138	346	188.18
26 Jan 2000	17	109	39.52
19 Jan 2000	46	136	69.33
12 Jan 2000	16	82	33.46
03 Jan 2000	68	645	189.12

Overview of history

	posts	total	BI
Total spam since 20 Oct 1999	1001	4052	1717.43
Peak spam on 3 Jan 2000	68	645	189.12
Peak daily spam on 23 Nov 1999	29	51	34.66
Average daily spam	3.0	12.1	5.09

full history also available

General information about Ctimail.com

Added 22 Mar 1999. Current (May 1999) spammer seems to be a spammer-for-hire, posting ads for various porn and scam sites. Some of these ads contain javascript which pops up windows to the advertised site.

(Remember: Always disable Javascript when using a web browser to read email or netnews.)

There has been no response from Cti as of May 27, 1999. Cti may be rogue.

Ownership & Contact Info
Site history
Netnews Feeds
Sample Spam

Ownership & Contact Info

Whois identifies ctimail.com as

City Telecom (HK) Ltd (CTIMAIL-DOM)
   9/F Tower 1, Grand Century Place
   Kowloon, NIL NIL
   HK

   Domain Name: CTIMAIL.COM

   Administrative Contact, Technical Contact, Zone Contact:
      Stephen Hui  (SH283-ORG) hwhui@CTIHK.COM
      +852 21998530, Fax- +852 21998972
   Billing Contact:
      Jeffrey Vong  (JV-ORG)  info@IA.COM.HK
      +852 24213121, Fax- +852 24010055

Site history

22 Mar 1999: Added to tracking list.

NetNews Feeds

ctimail.com receives netnews feeds from the following sites that I know of:

Hkt.net

These sites have been added to the reporting list for ctimail.com to keep them aware of the problem, and to suggest that they terminate their netnews feed with ctimail.com until such time that ctimail.com adopts an anti-spam policy and regains control of their servers.

Sample Spam

From: xlpnpc@hotmail.com Newsgroups: sci.engr.color Subject: I want your support 8355 Date: 3 May 1999 12:40:36 GMT Organization: City Telecom (HK) LTD Lines: 13 Message-ID: <7gk5g4$m5a$11747@news.ctimail.com> NNTP-Posting-Host: 123user209.ctinets.com X-Trace: news.ctimail.com 925735236 22698 203.80.123.209 (3 May 1999 12:40:36 GMT) X-Complaints-To: usenet@news.ctimail.com NNTP-Posting-Date: 3 May 1999 12:40:36 GMT Path: denver-news-feed1.bbnplanet.com!su-news-hub1.bbnplanet.com! cpk-news-hub1.bbnplanet.com!news.gtei.net!newsfeed.cwix.com! 202.84.255.3!news.hkt.net!news2.hkt.net!news.ctimail.com! not-for-mail Hello Everybody! I saw somebody posted a message few days ago. It said that is a newsgroup service which has a lot of uncensored pictures, softwares and mpeg files. So, I joined that newsgroup. But, I discovered that there is also a referral program. If you joined under my userid, you and I have half month service free. So, please join it under my user name called SMART. The newsgroup service provider web site is as follows: http://www.cit-news.com Thank you very much gdkjzuqzbwy

The following is an example of spam for multiple customers, containing uuencoded javascript which automatically pops up windows to the advertised sites. From: wfyyyz@olpe.org Newsgroups: rec.nude Subject: L O O K !! Her TITS is BIGGER than your HEAD..... Date: 5 May 1999 02:26:35 GMT Organization: City Telecom (HK) LTD Lines: 30 Message-ID: <7goa8r$pit$804@news.ctimail.com> NNTP-Posting-Host: 76user88.ctinets.com X-Trace: news.ctimail.com 925871195 26205 203.80.76.88 (5 May 1999 02:26:35 GMT) X-Complaints-To: usenet@news.ctimail.com NNTP-Posting-Date: 5 May 1999 02:26:35 GMT Path: denver-news-feed1.bbnplanet.com!su-news-hub1.bbnplanet.com! news.gtei.net!newsfeed.wli.net!howland.erols.net!newsfeed.cwix.com! 202.84.255.3!news.hkt.net!news2.hkt.net!news.ctimail.com! not-for-mail zepnqktbmusnbopwfkhkdnowdmcizkwsqiyeocedefkbvzwgnexxojsknipyrv [UU-encoded sections have been decoded] <!doctype html public "-//w3c//dtd html 4.0 transitional//en"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <meta name="Author" content="cyber"> <meta name="GENERATOR" content="Mozilla/4.5 [en] (Win95; I) [Netscape]"> <title>teencore2</title> </head> <body> <body onload="window.open('http://www.teencore.com/rat.link/imhere')"></body> </body> </html>&y> </html>& <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <META NAME="Author" CONTENT="Gregory Au"> <META NAME="GENERATOR" CONTENT="Mozilla/4.08 [en] (Win95; I) [Netscape]"> <TITLE>turbo cash ( fantasy pit )</TITLE> </HEAD> <BODY> <body onload="window.open('http://www.turbocash.com/partners/jws-track.cgi?ID=tc1352&Site=fpit')"></body> </BODY> </HTML> </BODY> </HTML>

To report spam, contact one or more of

A complete history may also be available.

General notes:

Only a small subset of usenet (261 groups) was sampled. Only articles that hadn't been cancelled yet were counted. Actual spam may have been much greater.
Heuristics that detect single-posted articles are, by their very nature, somewhat shaky. Innocent articles may be tagged as spam because they share certain characteristics or keywords with actual spam. In particular, a posted spam complaint that includes the spam in its entirety will very often be identified as spam.
Some posts may be forgeries intended to look like they came from Ctimail.com.
The first entry in the history file is not used to compute peak or average spam counts, as this entry covers an unknown number of days. This may cause an apparent disreprency between spam totals and spam averages.

Return to top | Return to spam summaries | complete history

The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.