Overview of spam from Null.ru

15 Feb 2006

Note: Automated spam monitoring stopped several years ago. These web pages are maintained for historical reasons. Some may be updated from time to time as news about the individual sites becomes available.

No spam today

Overview of last 3 reports

date	posts	total	BI
23 Jul 2000	40	40	40.00	full headers
07 Jul 2000	88	88	88.00	full headers
23 Jun 2000	52	52	52.00	full headers

Overview of history

	posts	total	BI
Total spam since 23 Jun 2000	180	180	180.00
Peak spam on 7 Jul 2000	88	88	88.00
Peak daily spam on 7 Jul 2000	6	6	6.29	(14-day average)
Average daily spam	4.3	4.3	4.27

full history also available

General information about Null.ru

Added 19 June 2000. This web site advertises child pornography and incest in the rec.nude newsgroup and others. Advertisements are posted from Deja News for a web site in Russia.

Ownership & Contact Info
Site history
Sample Spam

Ownership & Contact Info

Whois identifies null.ru as

    netnum:     193.125.96.0 - 193.125.127.255
    netname:     ELECTRA
    descr:       RAO EES Russia
    country:     RU
    admin-c:     VPS1-RIPE
    tech-c:      APK1-RIPE
    tech-c:      SGK1-RIPE
    mnt-by:      ELEKTRA-NOC
    changed:     valoff@energy.msk.su 19940104
    changed:     andrew@skfgvc.pyatigorsk.su 19960722
    changed:     ripe-dbm@ripe.net 20000225
    source:      RIPE

    route:       193.125.96.0/19
    descr:       ELECTRA network
    descr:       RAO EES Russia
    origin:      AS3312
    mnt-by:      ELEKTRA-NOC
    changed:     andrew@skfgvc.pyatigorsk.su 19960722
    source:      RIPE

    person:      Vladimir P. Stegny
    address:     JSC "Main Computing Center of Energetics"
    address:     Kitaygorodskiy pr. 7
    address:     103074 Moscow
    address:     Russia
    phone:       +7 095 2204140
    phone:       +7 095 9273061
    fax-no:      +7 095 9273007
    fax-no:      +7 095 9273015
    e-mail:      svp@energy.msk.su
    nic-hdl:     VPS1-RIPE
    changed:     slawa@skfgvc.pyatigorsk.su 19950125
    source:      RIPE

    person:      Andrew P. Kokarev
    address:     North Caucasian Branch of MCC of Energetics
    address:     Energetik village ODU
    address:     SU-357500 Pyatigorsk
    address:     Russia
    phone:       +7 87900 99680
    e-mail:      andrew@skfgvc.pyatigorsk.su
    nic-hdl:     APK1-RIPE
    changed:     andrew@skfgvc.pyatigorsk.su 19960716
    source:      RIPE

    person:      Svyatoslav G. Kiselevsky
    address:     North Caucasus Branch of JSC
    address:     "Main Computing Center of Energetics"
    address:     Energetik village
    address:     357561 Pyatigorsk
    address:     Russia
    phone:       +7 87900 99680
    fax-no:      +7 87900 79351
    e-mail:      slawa@skfgvc.pyatigorsk.su
    nic-hdl:     SGK1-RIPE
    changed:     slawa@skfgvc.pyatigorsk.su 19950125
    changed:     mir@ripe.net 19950203
    source:      RIPE

Site history

19 June 2000: Added to tracking list.

Sample Spam

Path: logbridge.uoregon.edu!news.maxwell.syr.edu!nntp2.deja.com! nnrp1.deja.com!not-for-mail From: nakedaughters@my-deja.com Newsgroups: rec.nude Subject: CRAZY SEXY PRETEENS Date: Wed, 14 Jun 2000 17:42:28 GMT Organization: Deja.com - Before you buy. Lines: 5 Message-ID: <8i8g5v$6u2$1@nnrp1.deja.com> NNTP-Posting-Host: 212.50.13.157 X-Article-Creation-Date: Wed Jun 14 17:42:28 2000 GMT X-Http-User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) X-Http-Proxy: 1.1 x57.deja.com:80 (Squid/1.1.22) for client 212.50.13.157 X-MyDeja-Info: XMYDJUIDnakedaughters SEXY PRETEENS ON NEW PRETEENS SITE- HTTP://NAKEDAUGHTERS.NULL.RU Sent via Deja.com http://www.deja.com/ Before you buy.

To report spam, contact postmaster@null.ru

A complete history may also be available.

General notes:

Only a small subset of usenet (261 groups) was sampled. Only articles that hadn't been cancelled yet were counted. Actual spam may have been much greater.
Heuristics that detect single-posted articles are, by their very nature, somewhat shaky. Innocent articles may be tagged as spam because they share certain characteristics or keywords with actual spam. In particular, a posted spam complaint that includes the spam in its entirety will very often be identified as spam.
Some posts may be forgeries intended to look like they came from Null.ru.
The first entry in the history file is not used to compute peak or average spam counts, as this entry covers an unknown number of days. This may cause an apparent disreprency between spam totals and spam averages.

Return to top | Return to spam summaries | complete history

The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.