Overview of spam from Vol.it

15 Feb 2006

Note: Automated spam monitoring stopped several years ago. These web pages are maintained for historical reasons. Some may be updated from time to time as news about the individual sites becomes available.

No spam today

Overview of last 15 reports

date	posts	total	BI
21 Apr 2000	69	424	170.74	full headers
14 Mar 2000	19	156	53.51	full headers
03 Jan 2000	389	2407	931.11	full headers
21 Dec 1999	540	2139	1058.87	full headers
17 Dec 1999	59	265	118.60	full headers
16 Dec 1999	45	192	87.71
14 Dec 1999	50	199	89.81
09 Dec 1999	18	123	44.53
06 Dec 1999	15	74	30.74
30 Nov 1999	14	96	36.05
29 Nov 1999	32	184	75.92
23 Nov 1999	64	252	116.50
22 Nov 1999	665	2284	1201.38
16 Nov 1999	146	675	291.51
12 Nov 1999	14	101	35.93

Overview of history

	posts	total	BI
Total spam since 30 Apr 1997	6470	46420	15047.97
Peak spam on 5 May 1997	765	14613	3318.08
Peak daily spam on 5 May 1997	255	4871	1106.03	(3-day average)
Average daily spam	5.5	33.6	11.77

full history also available

General information about Vol.it

Also known as news.tin.it. The full name of this site is Telecom Italia Net.

News.tin.it has an open news server and has taken no steps to close it. There is continual massive spam to Alt.sexual.abuse.recovery from this server.

Mail to postmaster bounces, in violation of RFCs.

Ownership & Contact Info
Site history
Netnews Feeds
Sample Spam

Ownership & Contact Info

Whois identifies Vol.it as

	org:         Videolina SpA
	descr:       La prima televisione in Sardegna
	nserver:     195.31.190.31  dnsca.tin.it
	nserver:     195.31.191.20  transit.ca.tin.it
	nserver:     193.205.245.8  dns2.nic.it
	remarks:     Fully Managed
	mnt-by:      INTERBUSINESS-MNT
	created:     before 960129
	changed:     cgiadmin@cgi.interbusiness.it 980804
	source:      IT-NIC

	person:      Paolo Campana
	address:     L' Unione Sarda S.p.A.
	address:     Viale Regina Elena, 20
	address:     I-09100 Cagliari
	address:     Italy
	phone:       +39 70 60131
	fax-no:      +39 70 60131
	e-mail:      Paolo.Campana@unionesarda.it
	nic-hdl:     PC1237-RIPE
	notify:      domain@cgi.interbusiness.it
	changed:     hostmaster@nic.it 980804
	source:      IT-NIC

	person:      Reinier van Kleij
	address:     Viale Regina Elena 14
	address:     091245 Cagliari
	phone:       +39 070 6013321
	fax-no:      +39 070 6013237
	e-mail:      rein@exol.it
	nic-hdl:     RK2066-RIPE
	notify:      rein@exol.it
	changed:     hostmaster@nic.it 981105

Vol.it receives its internet connection from InterBusiness Telecom Italia:

	InterBusiness - Telecom Italia (NET-INTERBUSINESS)
	   Via Paolo Di Dono, 44
	   Roma, I-00143
	   Italy

	   Netname: INTERBUSINESS
	   Netnumber: 151.99.0.0

	   Coordinator:
	      Porri, Federico  (FP44-ARIN)  cgiadmin@CGI.INTERBUSINESS.IT
	      +39 6 36874589 +39 6 36889191 (FAX) +39 6 33659922

Site history

22 Oct 1999: Now sending porn spams to Alt.sexual.abuse.recovery
19 Oct 1999: "Ia.n.i." spammer now on board. vol.it admins claim to know nothing about it.
17 Mar 1999: "Sexylolitas.net" now spamming from vol.it
16 June 1997: Porn4porn has joined vol.it

NetNews Feeds

news.tin.it receives netnews feeds from the following sites that I know of:

UUNet.

These sites have been added to the reporting list for news.tin.it to keep them aware of the problem, and to suggest that they terminate their netnews feed with news.tin.it until such time that news.tin.it adopts an anti-spam policy and regains control of their servers.

Sample Spam

Path: denver-news-feed1.bbnplanet.com!su-news-hub1.bbnplanet.com! news.gtei.net!logbridge.uoregon.edu!newsfeed.icl.net!colt.net! Pollux.Teleglobe.net!server-b.cs.interbusiness.it!news.tin.it! not-for-mail From: madQ <madq968@djeksta.comNOSPAM> Newsgroups: alt.folklore.science Subject: Download Ia.n.i.!!! It's free! Date: 14 Oct 1999 20:16:49 GMT Organization: madQ Lines: 4 Message-ID: <7u5dnh$qpa$420@nslave1.tin.it> NNTP-Posting-Host: a-ge17-85.tin.it X-Newsreader: madQ Download Ia.n.i. RemoteControlSystem 1.2 beta. It's free!!! New site: http://jump.to/IaniProject

To report spam, contact one or more of

A complete history may also be available.

General notes:

Only a small subset of usenet (261 groups) was sampled. Only articles that hadn't been cancelled yet were counted. Actual spam may have been much greater.
Heuristics that detect single-posted articles are, by their very nature, somewhat shaky. Innocent articles may be tagged as spam because they share certain characteristics or keywords with actual spam. In particular, a posted spam complaint that includes the spam in its entirety will very often be identified as spam.
Some posts may be forgeries intended to look like they came from Vol.it.
The first entry in the history file is not used to compute peak or average spam counts, as this entry covers an unknown number of days. This may cause an apparent disreprency between spam totals and spam averages.

Return to top | Return to spam summaries | complete history

The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.