The Canadian top 10 were half the same as last month and half due to Kelihos in the from CBL data for October 2012. Canadian #1 iWeb (CBL; #10 PSBL) made it into the world CBL top 10 because of Kelihos. The rankings from PSBL data were much closer to the CBL ones for Canada than was the case for the U.S. or for the world.

In this logarithmic chart you can see #3 AS 6327 SHAW, #7 AS 577 BACOM, #9 AS 855 CANET-ASN-4, and #10 AS 6407 PRIMUS-AS6407, the only Canadian ASNs that improved their CBL rank for October, going almost straight across the middle, decreasing towards the end of the month.

Three of those relatively static four also were infested with Kelihos. (The fourth, AS 6407 Primus, had a Lethic problem.)

While 25,000 spam messages a day, as seen by CBL for AS 6327 Shaw, is quite a sneeze, it’s not much compared to the four million a day seen for AS 32612 iWeb. All four of these ASNs also occur in the PSBL top 10 for Canada, in the same order, which is more corroboration that PSBL and CBL are seeing much the same general phenomena, except only CBL is seeing the Kelihos rampage, presumably due to a different heuristic. Also, CBL #1 AS 32613 IWEB and #2 AS 852 Telus are PSBL #10 and #3, so six ASNn were in the Canadian top 10 from both CBL and PSBL data.

Of the CBL bad 6, #1 AS 32613 IWEB, #2 AS 852 Telus, #4 AS 7788 MAGMA-COMM, #5 AS 14366 MTNCABLE, #6 AS 6539 GT-BELL, and #8 AS 10929 NETELLIGENT, all seemed to have had the Kelihos rampage about 7-15 October 2012, yet all but one seemed to have gotten a grip in the last week of the month and decreased their daily spam.

The one exception was #1 AS 32613 IWEB, which continued to spam even worse from Kelihos, exceeding 4 million spam messages a day, and making #10 for the entire world.

-jsq