Overview of spam from Nni.com

15 Feb 2006

Note: Automated spam monitoring stopped several years ago. These web pages are maintained for historical reasons. Some may be updated from time to time as news about the individual sites becomes available.

No spam today

General information about Nni.com

Added 23 April 1999. Spam consists of uuencoded ads for kinkyphonetalk.com. NNI stands for NuNet Inc.

I received an immediate response from Nni. They have a responsive abuse team and an anti-abuse policy with real teeth. ($500 minimum fine for email spam plus $.50 per message sent.) I don't think we'll be seeing very many spams from this site. These guys play whack-a-mole with sledghammers.

NuNet seems to be one of the good guys.

Ownership & Contact Info
Site history
Netnews Feeds
Sample Spam

Ownership & Contact Info

Whois identifies Nni.com as

NuNet, Inc. (NNI2-DOM)
   26 Bethlehem Plaza
   Bethlehem, PA 18018

   Domain Name: NNI.COM

   Administrative Contact, Technical Contact, Zone Contact:
      Keown, John  (JK744) jdk@NNI.COM
      (610) 882 5600
   Billing Contact:
      Keown, John  (JK744)  jdk@NNI.COM
      (610) 882 5600

   Record last updated on 05-Nov-98.
   Record created on 13-Oct-95.
   Database last updated on 22-Apr-99 11:06:22 EDT.

Site history

23 April 1999: Added to tracking list.

NetNews Feeds

Nni.com receives netnews feeds from the following sites that I know of:

USWest

These sites have been added to the reporting list for Nni.com to keep them aware of the problem, and to suggest that they terminate their netnews feed with Nni.com until such time that Nni.com adopts an anti-spam policy and regains control of their servers.

Sample Spam

Article contained uuencoded javascript (which has been decoded here for example) and hash-busting code in the Subject line and message body. From: cn3g8@ngc83.com Newsgroups: alt.sex.stories Subject: Kinky Hot Talk 99060 Message-ID: <20049912.5358@ngc83.com> Date: Tuesday, 20 Apr 1999 12:53:58 -0600 Organization: 8w98c NNTP-Posting-Host: nas-27-2.la.navinet.net X-Trace: 20 Apr 1999 15:38:18 -0500, nas-27-2.la.navinet.net Lines: 10 Path: newsfeed2.uswest.net!cyclone1.uswest.net!newsfeed3.uswest.net! news.nni.com!ngc83.com <HTML> <HEAD> <TITLE></TITLE> </HEAD> <BODY> <SCRIPT LANGUAGE="LiveScript"> window.location.href="http://www.kinkyphonetalk.com"; </SCRIPT> </BODY> </HTML> #P;7,LGn:dnh#(Afhy1(Zum6WM;q()&/nbnI_^z',vHbU:txBs ":Lp.qY/US*c(ipCp+y@

To report spam, contact abuse@nni.com

A complete history may also be available.

General notes:

Only a small subset of usenet (261 groups) was sampled. Only articles that hadn't been cancelled yet were counted. Actual spam may have been much greater.
Heuristics that detect single-posted articles are, by their very nature, somewhat shaky. Innocent articles may be tagged as spam because they share certain characteristics or keywords with actual spam. In particular, a posted spam complaint that includes the spam in its entirety will very often be identified as spam.
Some posts may be forgeries intended to look like they came from Nni.com.
The first entry in the history file is not used to compute peak or average spam counts, as this entry covers an unknown number of days. This may cause an apparent disreprency between spam totals and spam averages.

Return to top | Return to spam summaries | complete history

The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.