Information about the UUNet UDP

This page contains various information about the UDP enacted against UUNet in August 1997.

See also:

Due to its size, there has always been a fair amount of spam coming from UUNet. Lately however, the spam volume has become huge. UUNet has produced more spam than any other site on the internet -- over 147,000 posts since May in the small portion of Usenet which my filters monitor.

Item: 99% of posts from UUNet are spam. [1]

Item: 30-40% of all posts on netnews are spam, another 30-40% are cancels of that spam, and 20-30% are legitimate posts. This means that if the spam problem was eliminated, Netnews traffic would drop to as low as 1/5 of its present amount. [2]

Item: Before the UDP, there were 1.25 million spams per week, about half from UUNet.

Item: Before the UDP, UUNet alone accounted for roughly half of all netnews spam on the internet. This does not count spam originating from UUNet-hosted customers such as the Psychic Spammer or LibidoX

Item: Casual browsing will show that more than half the posts to the newsgroup Alt.sexual.abuse.recovery are spam, mostly porn spam including child pornograhy ads. You can imagine the effect this has on the regulars of this newsgroup. Many have abandoned the newsgroup because of this problem. At least one has gone back into therapy. UUNet is responsible for a good portion of this spam and steadfastly refused to respond to complaints.

Item: Most sexual discussion groups have been abandoned because of the level of porn spam in those groups.

Item: Before the UDP, UUNet rarely, if ever responded to complaints, except to issue an automated form letter.

Item: UUNet is the host for LibidoX, Online18, Netzilla, and Escort Guide, the four largest spammers on the internet.

UDP history:

Legal Info

For information on the legality of udp-style cancels, see this New York Times article. The article describes a massive cancel that came from UUNet last year, disrupting NetNews everywhere. (New York Times may ask you to register first, this is benign.)

Statistics

According to Dennis McClain-Furmanski, there were 442,082 cancels issued against UUNet since the start of the UDP. 432,730, or 97.9%, were against spam that would have been cancellable anyway under the BI>20 rule.

In the last 24 hours (as of 5 Aug 1997, 14:26):

87,632 cancels issued for UUNet sources
85,869 of those issued for normal BI > 20 spam from UUNet

Therefore 97.9% of the traffic from UUNet during the last 24 hours was
cancelable as spam even without UDP considerations.

Again, some of the remainder may be spam. The remaining 1,763 messages would have to be examined by hand to determine whether they were spam or collateral damage.

[Update: the remaining messages have since been examined, with slightly more than half being spam. This brings the total up to 99%]

Here is a count of cancelled spam, top 20 sites, courtesy of Andrew Gierth: 

  417347  news1-alterdial.uu.net
   95785  earth.superlink.net
   58884  world1.bawave.com
   55118  baker.se.highway1.com
   49402  news0-alterdial.uu.net
   27282  news.netdor.com
   26118  news.eclipse.net
   23973  news.online18.com
   17731  mail.slutcom.ca
   16332  news.worldnetla.net
   15383  nylaw-07.nyls.edu
   13633  roo.fosta.au
   13092  max.imsis.com
   11801  news.acadiacom.net
   11378  207.17.227.6
   11259  rig.ni.it
    9864  vs04.vc-net.or.jp
    9483  mtts01.Teleglobe.net
    9385  storm.lightning.net
    8263  buck.innerx.net

Here is a short summary of spam cancels against UUNet courtesy of "Uncle Roadkill"

Day UUNet (apparent) Total ------------------------ ---------------- ------- July 23: <no data> 146,965 July 24: <no data> 186,812 July 25: 239,815 230,659 July 26: 144,037 263,123 July 27: 124,191 250,854 July 28: 116,161 194,675 July 29: 122,959 240,368 July 30: 96,603 230,693 July 31: 91,553 293,697 August 1: <= UDP begins 69,752 218,315 August 2: 82,552 203,187 August 3: <= UUNet agrees to 941 145,508 August 4: act against spam 2,751 140,736 August 5: 2,848 164,620 August 6: 1,010 151,899 August 7: <= UDP ends 3,143 149,454 August 8: 1,536 167,570 August 9: 398 170,883 August 10: 113 162,294 August 11: 284 163,357 August 12 (partial): 266 177,746

Here is a longer-term history of weekly spam cancels previous to the UDP, courtesy of Andrew Gierth. These numbers reflect spams detected and cancelled. Usually some spam escapes detection and is not counted here.
Week endingcancels issued
5/21214,365
6/02262,281
6/09313,182
6/16424,785
6/23521,938
7/07507,175
7/1482,951(cancel moratorium in effect)
7/211,034,261
7/281,242,091

Notes

[1]Statistics provided by Ken Lucke, postmaster@stopspam.org. Spam-detecting software identified 97.9% of UUNet traffic as spam. Manual inspection of the remainder showed another 1.1% was also spam, leaving only 1% legitimate traffic.

[2]According to Mat Dillon, sysadmin at Best.com, Netnews traffic is 1/3 spam, 1/3 spam cancels and 1/3 legitimate traffic. According to John Milborn, the numbers are 40% spam, 40% cancels and 20% legitimate traffic.

Samples

Here is an example of the hate mail that has been coming from UUNet. Most header information is forged: 
  From a@a.com  Wed Aug  6 21:59:25 1997
  Return-Path: 
  From: a@a.com
  Received: from server3.dont.telnet_here.com (1Cust48.max14.newark.nj.ms.uu.net [153.34.67.176])
  Received: from localhost (root@localhost)
	  by server3.dont.telnet_here.com (8.8.5/8.8.5) with SMTP id AAA01146;
	  Thu, 7 Aug 1997 00:52:54 -0400 (EDT)
  Date: Thu, 7 Aug 1997 00:52:54 -0400 (EDT)
  Message-Id: <199708070452.AAA01146@server3.dont.telnet_here.com>
  Received: by server3.dont.telnet_here.com (bulk_mailer v1.6); Thu, 7 Aug 1997 00:28:06 -0400
  Content-Length: 739
  X-Lines: 20
  Status: RO

  Authenticated sender is:  root@digmeup.com
  X-mailer:  Wouldn't you like to know
  X-complaint-response:  Go to hell
  To: undisclosed-recipients:;
  Message-ID: 

  You are being spammed and if you don't like it you can go suck an egg.  If
  you remove call babbling2@answerme.com.  Don't compalin cause we will use
  you to return address spamm.

  How would you like to earn tons more money?  500 to  10000000000 dollars a
  week or more?  We can show you the money!!!!  Call us free at 1800-
  (remember to call Rob and get number fore here).  and find ouT!!!!!!! I am
  making  10000000000000000000 dollars a day!!!!! and yoou can too!!!!!!!!!1


  CoNgRaDuLaTiOnS,

  Malvin Sweeney
  hampton@answerme.com
Here is an example of the forged threat that came from UUNet. 
  From webmaster@sailahead.com  Fri Aug  8 13:16:17 1997
  Return-Path: 
  Received: from Eng.Sun.COM by peregrine.eng.sun.com (SMI-8.6/SMI-SVR4)
	  id NAA12682; Fri, 8 Aug 1997 13:16:17 -0700
  From: webmaster@sailahead.com
  Received: from saturn.Sun.COM by Eng.Sun.COM (SMI-8.6/SMI-5.3)
	  id NAA27167; Fri, 8 Aug 1997 13:16:14 -0700
  Received: from www.kia.co.kr (www.kia.co.kr [203.248.232.2]) by saturn.Sun.COM (SMI-8.6/mail.byaddr) with SMTP id NAA25235 for ; Fri, 8 Aug 1997 13:16:15 -0700
  Received: from www.kia.co.kr (1Cust59.max43.los-angeles.ca.ms.uu.net [153.34.91.187]) by www.kia.co.kr (8.6.12h2/8.6.9) with SMTP id FAA07645; Sat, 9 Aug 1997 05:02:48 +0900
  Received: from mips-1.sailahead.com (mips-1.sailahead.com [199.107.95.10]) by sailahead.com (8.8.5/8.6.5) with SMTP id GAA05398 for ; Fri, 08 Aug 1997 12:11:32 -0600 (EST)
  Date: Fri, 08 Aug 97 12:11:32 EST
  To: suspected_flamer@somewhereincyberspace.com
  Subject: Cease And Desist Flaming
  Message-ID: <5.0.52.19970526663666.666a6e97@sailahead.com>
  Reply-To: khskllp@aol.com
  X-PMFLAGS: 34666848 0
  X-UIDL: 3273376668a65eb1890m0762123a
  Comments: Authenticated sender is 
  Content-Length: 1607
  X-Lines: 44
  Status: RO

  On behalf of our client, Samsung America Inc., ("Samsung") 
  we hereby request that you cease and desist all 
  inflammatory internet hacking, telephone hacking, flaming,
  jamming, and other illegal activities.

  If you have responded aversely to a recent bulk email 
  message from our client, Samsung America, Inc., or from any
  of its subsidiary companies, then you may be one of the 
  people who has performed fraudulent and actionable 
  transgressions, thereby causing severe harm to our client.  

  Your email name was provided as being suspected of 
  connection to various acts of internet terrorism.  Your acts
  are illegal.

  Several messages have suggested that Samsung and/or its 
  subsidiaries, including but not limited to Sailahead Global
  Emporium, www.sailahead.com, and Samsung Electronics, 
  www.sosimple.com, violated US Federal Laws through 
  activities commonly called "spamming."  This allegation is
  unfounded in the law, as spamming is a protected activity 
  under the laws of free speech.

  Our client has asked us to inform you that all of your 
  future correspondences should be directed to their counsel:

  Russell L. Allyn, Attorney at Law
  California Sate Bar Number (SBN) 143531
  Katz, Hoyt, Seigel & Kapor LLP
  Los Angeles, CA
  khskllp@aol.com
  310-473-1300
  310-473-7138 (fax)

  All incidents of internet terrorism will be prosecuted 
  where possible, and reported to appropriate law enforcement 
  authorities as warranted.

  Please consider this as your notice to cease all attempts 
  to harm multi-national corporations who conduct legitimate 
  commerce on the internet.

  Russell L. Allyn, Attorney at Law