Wednesday, September 10, 2008

I love getting spam, redux

Back in May I blogged about a site named Knujon, run by Garth Bruen, which was attempting to fight the good fight against spam not by attempting to shut down the spammers themselves, but by attempting to shut down the domains for the sites spam is advertising. His theory is sound, but how effective was it? I signed up for the Knujon service, downloaded a Thunderbird extension to send the spam I received to Knujon and have been watching the reports.

Before I go on, let me just say that with the email accounts that I use Thunderbird to check I probably receive close to 500-1000 spam a day. Thunderbird does a fairly good job of recognizing them as junk and putting them in my Junk folder. When I run my Knujon extension it attaches them to an email and sends it to Knujon to process.

By logging into the site you receive status reports on the emails you have sent them. From the statistics available, you can see how many domains they have received, how many are pending suspension and how many have been suspended.

As of 9/9/08, Knujon has received 7,115 sites from me that were being advertised in spam. So far, 291 domains are pending suspension and 270 domains have been completely removed. Not bad for only 5 months of sending emails.

For the amount of effort that I have had to put in to Knujon (almost none), I am very impressed with the results. Garth Bruen is making alot of progress in his work - according to the site they have shut down 79,500 domains with another 33,671 pending.

I highly encourage everyone to sign up on Knujon.


MartyCohn said...

Knujon is my backup plan for spam. If some junk is fresh, it goes to both Spamcop and Kunjon. Anything over a couple of hours old, to Knujon alone.

Blacklisting gives more of a feeling of accomplishment, but for the ton of spam that I don't get to in a timely manner, Knujon is a great resource.

AlphaCentauri said...

It's great to see not only that sites are being shut down, but that the entire mindset of registrars is changing. Until very recently, almost none would suspend domains for spam/abuse. They washed their hands of any responsibility, telling us that we had to take it up with the hosting services. (Good luck with that for a botnet hosted domain!) But now, some bad publicity from Knujon really hits home.

If you go to the Castlecops bulk spam reporting pages at you can see that of the 55,000 domains that have been suspended through the small group of us using that venue, some registrars have suspended nearly 100% of their reported domains -- and in some cases, they no longer even need anyone to report to them, as they go directly to the Castlecops list and to URIBL and suspend the domains they find there. And some are using that information to develop filters to block new fraudulent registrations.

But others don't suspend anything, even when we know for a fact that the credit card charges on the stolen cards used to pay for them have been reversed by the credit card companies. (Not all of those companies have been added to the page yet.) We still need to establish a cooperative relationship with them. But each time one of them changes its attitude, spammers lose another haven forever.

Some of the most cooperative registrars were considered the worst of the worst just last year. And what you don't see is other registrars whose reputations have previously turned around 180 degrees, since most spammers no longer even bother to register any domains with them in the first place.

There's still plenty of spam, but the spammers are being boxed into a smaller and smaller group of clueless/complicit registrars, making them far more vulnerable to shutdowns.

sailmonsoon said...

Knujon goes after the the targets advertised in SPAM which is better than trying to find who is sending the SPAM. If those sites get no business or get in trouble then maybe they will stop. Knujon have reported some promising success. I wish ICANN and other regulating authorities would do their job and suspend offending registrars and domains and charge the owners with crimes.

Tim said...

My graph is better than your graph! ;-)

I'm impressed with KnujOn's progress. One third of the idiots that spam me have had their site shut down.

Another third is about to have their site shut down.

If you were a business, would you spam me knowing there is a 66% chance your web site would be shut down?

That just isn't good business sense.

Tim said...
This comment has been removed by the author.