Monthly Archives: June 2013

Canada’s Hospital for Sick Kids stopped spamming

Canada Canada’s The Hospital for Sick Children The Hospital for Sick Children AS 46626 SICKKIDS-AS-01 dropped out of the May 2013 SpamRankings.net for world medical organizations from CBL data. In April they ranked #1 with 21,912 spam messages, April 2013 World Medical SpamRankings.net from CBL Volume and in May they dropped to #27 with only 28 messages. In April they really only spammed for one week, as you can see in the big spike in the graph. Of course, the hospital itself probably didn’t knowingly send the spam; usually they’ve been compromised by botnets or phishing or some other breach, but hospital patients and other customers won’t necessarily know that if they receive some of it. And if their security is lax enough to let in things that emit spam, what else has been compromised? This is why hospitals are quick to squelch outgoing spam and fix the underlying security problems.

-jsq

Zerofail from nowhere to #2 in April and May 2013 SpamRankngs.net for Canada

Zerofail’s AS 40191 AS-PRE2POST-1 jumped from 5 per day April 1st to more than a million spam messages many days in April, and from 413 total in March to almost 22 million in April. That made it #2 in the April 2013 SpamRankings.net for Turkey Canada from CBL data, and Zerofail kept second place in May with more than 18 million spam messages. This AS actually sent proportionally more of top 10 spam from Canada in May than in April because #1 iWeb’s AS 32613 sent a lot less in May. Where does all this Zerofail spam come from?

AS 40191 has six netblocks currently assigned, of which the netblock 173.246.64.0/19 is producing almost all of the spam seen from AS 40191.

-jsq

Medyabim most worsened in Turkey in May SpamRankings.net

Medyabim Internet Services popped into the Turkey Turkish top 10 SpamRankings.net for May 2013, hopping up from #81 to #5. This happened starting about 23 May 2013, probably coincidentally about the same time as the disturbances around Taksim Square in Istanbul.

Previous chronic Turkish spam winner TTNET 9121 made it back to the top, and this time TTNET placed twice, with AS 47331 as #6. Together the two TTNET ASNs sent 49.26% of top 10 Turkish spam for May 2013.

AS 43391 NETDIREKT-TR and AS 42926 RADORETELEKOM battled through the whole month for spots #2 and #3.

In better news, Tamer Gigabitweb Turkey and DorukNet IstanbulTurkey dropped out of the Turkish top 10.

Also new this month are v2 rankings back to January 2013.

-jsq

Spam worming up rapidly –McAfee

Email and spam volume McAfee PR of today, McAfee Quarterly Threat Report Sees Social Media Worm Resurgence as Spam Rises Dramatically: Targeted Attacks Continue Rise; “Pump and Dump” Returns with Record Stock Market Highs

McAfee Labs today released the McAfee Threats Report: First Quarter 2013, which reported a significant spike in instances of the Koobface social networking worm and a dramatic increase in spam. McAfee Labs also saw continued increases in the number and complexity of targeted threats, including information-gathering Trojans and threats targeting systems’ master boot records (MBRs).

McAfee Labs found almost three times as many samples of Koobface as were seen in Continue reading

Comcast’s AS 7015 and AS 7922

Comcast shows some of the biggest differences between Version 2 and the old version 1 of SpamRankings.net for April 2013. Comcast is in the U.S. top 10 either way, but with different Autonomous Systems: AS 7922 is #3 in v2 while AS 7015 of Comcast Cable Communications Holdings Inc is #8 in v1 and doesn’t even appear in the v2 top 250.

AS 7015AS 7922netblocks assigned
#3v2 rank
#8#107v1 rank
177234current
106127previous
104107persistent
73127added
220removed

Interesting tidbit from Bloomberg Business Week about Comcast Cable Communications Holdings Inc: Continue reading