Overview of spam from Earthlink

15 Feb 2006

Note: Automated spam monitoring stopped several years ago. These web pages are maintained for historical reasons. Some may be updated from time to time as news about the individual sites becomes available.

Overview of last 14 reports

Overview of history

full history also available

General information about Earthlink

• Ownership & Contact Info
• Site history
• Netnews Feeds

Earthlink is the site that inspired the automated spam reports. During the summer of 1996, the amount of usenet spam from Earthlink became enormous, drowning out many newsgroups. The spam was mostly explicit ads for porn and phone sex, posted indiscriminately to all newsgroups with "sex" in the title, including alt.sexual-abuse.recovery, where it caused no small amount of stress among the participants.

In a sense, Earthlink pioneered the massive flood of spam on the internet. There had been spammers before, but Earthlink was the first major ISP to permit them to continue. There had been rogue sites before, but Earthlink was the first one that couldn't just be disconnected by its upstream site.

Earthlink steadfastly ignored complaints and denied there was a problem. To prove otherwise, I wrote a filter which examined netnews to detect and collate spammed articles. A daily report was generated showing the extent and the nature of the spams.

As a result of the large volume of spam coming from Earthlink, UDP was discussed and eventually implemented. This got Earthlink's attention, and steps were taken (after many promises and delays) to deal with the problem. Spam counts finally declined.

Earthlink admin Harris Schwartz began posting regular reports on actions that Earthlink had taken against spammers. However, the reports did not identify spammers in any meaningful way. It was speculated that the reports were just lists of randomly generated phony account names, used to lull usenet netizens into a false sense of security.

After a few months, Earthlink -- apparently convinced that people had forgotten about them -- stopped blocking outgoing spam, and the problem became worse than ever. In addition, large quantities of email spam were being generated by Earthlink customers. Harris Schwartz stopped issuing reports.

In early 1997, discussion of UDP for Earthlink began again. Partial UDP was implemented. This had the effect of getting Earthlink's attention again. Harris Schwartz and Nick Christenson issued several posts claiming that spam was being dealt with, although it still continued to arrive, apparently undiminished. In July 1997, spam levels finally came down, although as of 1999, Earthlink is still usually in the top 10.

Earthlink has implemented filtering software that works to regulate the volume of outgoing spam. Earthlink can adjust the parameters of the filter to "fine tune" the spam volume. The filters are not used to stop outgoing spam, but simply to reduce it enough to keep Earthlink off of the top of the spam list and presumably safe from another UDP. Earthlink rarely makes the top-5 list anymore, but rarely fails to make the top-10 list.

Dave Hayes has prepared a nice graph of spam over time.

Earthlink, like many major service providers, exerts the absolute minimum effort required to stay off the Realtime Black List and avoid the Usenet Death Penalty. Earthlink allows spam problems to get worse and worse until they are added to the RBL or are threatened with UDP. They then institute whatever measures are required to avoid the RBL or UDP. Sometimes this consists of simply promising to do something about the problem.

• 23 Oct 1999: Tom Saylor now spamming from Earthlink.
• 23 Sept 1999: Earthlink has merged with Mindspring Spam will continue to be tracked seperately for both sites.
• 13 Aug 1999: More allegations of an Earthlink-Scientology connection.
• 5 Oct 1998: Earthlink has morphed their headers, causing spam to be missed. This has been corrected.
• 14 Aug 1998: Earthlink has purchased Sprintlink. Reports will be combined from now on.
• 4 Aug 1998: Earthlink is being sued by a customer who was mistakenly identified by Earthlink as a spammer. See Wired news article "Mistaken Spammer Fights Back".
• 5 May 1998: I have learned that a spammer at Earthlink is forging paths. Filters have been adjusted accordingly and may cause an increase in Earthlink's spam counts.
• 14 Nov 1997: It is reported that Earthlink has instituted a $200 fine for spammers. See C|Net article ISPs crack down on spam
• 14 Oct 1997: It is reported that Earthlink has a toll-free number for tracking spam: 888-ELN-SPAM (888-356-7726).
• 3 Sept 1997: Earthlink dropped out of the top ten for the first time in their history (partly due to the addition of several new sites in the tracking list.)
• 29 July 1997: Netnews spam levels are beginning to rise again.
• 11 July 1997: Earthlink has started blocking outgoing netnews spam. Outgoing email spam continues unabated.
• 16 June 1997: Spam counts are down; either UDP has become more effective or Earthlink is now doing something about the problem. It is unknown how long this improved situation will last.

To report spam, contact abuse@earthlink.net

A complete history may also be available.

General notes:

• Only a small subset of usenet (261 groups) was sampled. Only articles that hadn't been cancelled yet were counted. Actual spam may have been much greater.
• Heuristics that detect single-posted articles are, by their very nature, somewhat shaky. Innocent articles may be tagged as spam because they share certain characteristics or keywords with actual spam. In particular, a posted spam complaint that includes the spam in its entirety will very often be identified as spam.
• Some posts may be forgeries intended to look like they came from Earthlink.
• The first entry in the history file is not used to compute peak or average spam counts, as this entry covers an unknown number of days. This may cause an apparent disreprency between spam totals and spam averages.

Return to top | Return to spam summaries | complete history

The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.

This page maintained by Ed Falk