Overview of spam from Runnet.ru

15 Feb 2006

Note: Automated spam monitoring stopped several years ago. These web pages are maintained for historical reasons. Some may be updated from time to time as news about the individual sites becomes available.

No spam today

Overview of last 4 reports

date	posts	total	BI
23 Jun 2000	308	560	402.80	full headers
14 Mar 2000	75	339	156.58	full headers
22 Nov 1999	27	444	106.60	full headers
29 Oct 1999	41	283	105.14	full headers

Overview of history

	posts	total	BI
Total spam since 29 Oct 1999	451	1626	771.12
Peak spam on 23 Jun 2000	308	560	402.80
Peak daily spam on 22 Nov 1999	1	18	4.44	(24-day average)
Average daily spam	1.7	5.7	2.81

full history also available

General information about Runnet.ru

Added 22 June 1999 due to excessive porn spam in Alt.sexual.abuse.recovery

Mail to abuse@runnet.ru bounces with an MX configuration error.

Ownership & Contact Info
Site history
Sample Spam

Ownership & Contact Info

Whois identifies runnet.ru as

  inetnum:     194.85.35.0 - 194.85.37.0
  netname:     RUNNET
  descr:       Federal Node of RUNNet in Moscow State University
  descr:       Moscow
  country:     RU
  admin-c:     Valery A Vasenin
  tech-c:      Aleksandr E Scherbakov
  changed:     aes@phys.msu.su 950226
  source:      RIPE

  route:       194.85.35.0/24
  descr:       RUNNET p2p
  descr:       Russian Federal University Network
  origin:      AS3267
  notify:      noc@runnet.ru
  mnt-by:      AS3267-MNT
  changed:     aes@phys.msu.su 950607
  source:      RIPE

  person:      Valery A. Vasenin
  address:     Main building, Room 1012
  address:     Moscow State University
  address:     Lenin's Hills
  address:     11989traceroute to 194.85.35.67 (194.85.35.67) from 206.117.161.81, 30 hops max, 40 byte packets
  9 Moscow
  address:     Russia
  phone:       +7 095 939 2078
  e-mail:      vasenin@rector.msu.su
  nic-hdl:     VAV1-RIPE
  changed:     aes@rector.msu.su 940705
  source:      RIPE

  person:      Aleksandr E. Scherbakov
  address:     Moscow State University
  address:     Garant-Park LTD, Science Park R-611
  address:     Lenin's Hills
  address:     119899 Moscow
  address:     Russia
  phone:       +7 095 932 9119
  fax-no:      +7 095 932 9150
  e-mail:      aes@park.ru
  nic-hdl:     AES1-RIPE
  mnt-by:      AS5537-MNT
  changed:     aes@park.ru 19980915
  changed:     aes@park.ru 19990601
  source:      RIPE

Site history

21 June 1999: Added to tracking list.

Sample Spam

Path: news-out.uswest.net!newsfeed.berkeley.edu!dispose.news.demon.net! demon!newsfeed.tli.de!newsfeed.gamma.ru!Gamma.RU!any.msu.ru! news.RUNNet.ru!not-for-mail From: xyz <xyz@pipi.com> Newsgroups: alt.sexual.abuse.recovery,alt.sexual.abuse.recovery.d, alt.sexy.bald.captains,alt.support.disabled.sexuality, alt.support.sexreassign,alt.tv.tiny-toon.sex Subject: Selected girls Date: Wed, 23 Jun 1999 13:29:39 +0400 Organization: RUNNet Message-ID: <3770A903.A5A168E5@pipi.com> NNTP-Posting-Host: ns.comset.com Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="------------EE1CB389E76377624B3DAEEB" X-Trace: epos.runnet.ru 930130401 23144 194.226.196.17 (23 Jun 1999 09:33:21 GMT) X-Complaints-To: usenet@epos.runnet.ru NNTP-Posting-Date: 23 Jun 1999 09:33:21 GMT X-Mailer: Mozilla 4.5 [en] (Win98; I) X-Accept-Language: ru,en Lines: 30 alt.sexual.abuse.recovery.d:2964 alt.sexy.bald.captains:26942 This is a multi-part message in MIME format. --------------EE1CB389E76377624B3DAEEB Content-Type: text/plain; charset=koi8-r Content-Transfer-Encoding: 7bit --------------EE1CB389E76377624B3DAEEB Content-Type: text/html; charset=koi8-r; name="goto.htm" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="goto.htm" <html> <head> <title>Free Sexual Club</title> <meta HTTP-EQUIV="REFRESH" CONTENT="5; URL=http://adv.stars.ru/cgi-bin/3in1.pl?click346&megmtasdopiu&tech"> </head> <body> <p><a href="http://adv.stars.ru/cgi-bin/3in1.pl?click346&megmtasdopiu&tech" target="_top"><img src="http://adv.stars.ru/cgi-bin/3in1.pl?346&megmtasdopiu&tech" border="0" width="468" height="60"> </a></p> </body> </html> --------------EE1CB389E76377624B3DAEEB--

To report spam, contact one or more of

A complete history may also be available.

General notes:

Only a small subset of usenet (261 groups) was sampled. Only articles that hadn't been cancelled yet were counted. Actual spam may have been much greater.
Heuristics that detect single-posted articles are, by their very nature, somewhat shaky. Innocent articles may be tagged as spam because they share certain characteristics or keywords with actual spam. In particular, a posted spam complaint that includes the spam in its entirety will very often be identified as spam.
Some posts may be forgeries intended to look like they came from Runnet.ru.
The first entry in the history file is not used to compute peak or average spam counts, as this entry covers an unknown number of days. This may cause an apparent disreprency between spam totals and spam averages.

Return to top | Return to spam summaries | complete history

The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.