German companies took 3 of the 5 top spots in the
June 2013 World
from CBL volume.
Online AG RZ‘s AS 24940 rose from #35,
and
AG‘s
AS 6724 actually got better; it was #2 last month.
-jsq
Relizon Canada Inc.’s
AS 40034 RELIZON-CDN
jumped from #134 to #3 in the
May 2013
for Canada All from CBL data.
On May Day CBL saw 1 spam message from AS 40034 and more than 3 million
on May 31.
Relizon was not visible in the
May Canada rankings from PSBL data,
although internally we do see AS 40034 going from #208 to #109
by going from 11 spam messages in April to 26 in May.
CBL’s heuristics or spam traps or both were apparently much better
at detecting this particular spam source.
Relizon’s own website doesn’t seem to be responding at the moment, but Bloomberg Businessweek says they do business process outsourcing solutions, and were formerly known as Crain-Drummond Inc., with the name change coming on acquisition by the Carlyle Group.
-jsq
Canada’s
The Hospital for Sick Children
AS 46626 SICKKIDS-AS-01
dropped out of the
May 2013
for world medical organizations from CBL data.
In
April they ranked #1 with 21,912 spam messages,
and in May they dropped to #27 with only 28 messages.
In April they really only spammed for one week, as you can see
in the big spike in the graph.
Of course, the hospital itself probably didn’t knowingly send the spam;
usually they’ve been compromised by botnets or phishing or some other breach,
but hospital patients and other customers won’t necessarily know that
if they receive some of it.
And if their security is lax enough to let in things that emit spam,
what else has been compromised?
This is why hospitals are quick to squelch outgoing spam and fix
the underlying security problems.
-jsq
Zerofail’s AS 40191 AS-PRE2POST-1
jumped from 5 per day April 1st to
more than a million spam messages many days in April, and from
413 total in March to almost 22 million in April.
That made it
#2 in the April 2013
for
Canada from CBL data,
and Zerofail kept
second place in May with
more than 18 million spam messages.
This AS actually sent proportionally more of top 10 spam from Canada
in May than in April because #1 iWeb’s AS 32613 sent a lot less in May.
Where does all this Zerofail spam come from?
AS 40191 has six netblocks currently assigned, of which
the netblock 173.246.64.0/19 is producing almost all of the
spam seen from AS 40191.
-jsq
Medyabim Internet Services popped into the
Turkish top 10
for May 2013,
hopping up from #81 to #5.
This happened starting about 23 May 2013, probably coincidentally about the same time as
the disturbances around Taksim Square in Istanbul.
Previous chronic Turkish spam winner
TTNET 9121 made it back to the top,
and this time
TTNET
placed twice, with AS 47331 as #6.
Together the two TTNET ASNs sent 49.26% of top 10 Turkish spam for May 2013.
AS 43391 NETDIREKT-TR and AS 42926 RADORETELEKOM battled through the whole month for spots #2 and #3.
In better news, Tamer Gigabitweb Turkey and DorukNet IstanbulTurkey dropped out of the Turkish top 10.
Also new this month are v2 rankings back to January 2013.
-jsq
McAfee PR of today,
McAfee Quarterly Threat Report Sees Social Media Worm Resurgence as Spam Rises Dramatically:
Targeted Attacks Continue Rise; “Pump and Dump” Returns
with Record Stock Market Highs
McAfee Labs today released the McAfee Threats Report: First Quarter 2013, which reported a significant spike in instances of the Koobface social networking worm and a dramatic increase in spam. McAfee Labs also saw continued increases in the number and complexity of targeted threats, including information-gathering Trojans and threats targeting systems’ master boot records (MBRs).
McAfee Labs found almost three times as many samples of Koobface as were seen in Continue reading
Comcast shows some of the biggest differences between
Version 2
and the old version 1 of
for April 2013.
Comcast is in the U.S. top 10 either way, but with different Autonomous Systems:
AS 7922 is #3 in v2 while
AS 7015 of Comcast Cable Communications Holdings Inc is #8 in v1
and doesn’t even appear in the v2 top 250.
| AS 7015 | AS 7922 | netblocks assigned |
|---|---|---|
| – | #3 | v2 rank |
| #8 | #107 | v1 rank |
| 177 | 234 | current |
| 106 | 127 | previous |
| 104 | 107 | persistent |
| 73 | 127 | added |
| 2 | 20 | removed |
Interesting tidbit from Bloomberg Business Week about Comcast Cable Communications Holdings Inc: Continue reading
OVH Systems’ AS 16276 is #1 in
the April 2013
worldwide from CBL data
with
631,539,742 spam message seen according to
the new Version 2 of SpamRankings.net,
while
the same ASN is #3 in
the old version 1 rankings with 363,884,989 spam messages seen.
Why the difference?
The difference is because Version 2 finds more netblocks assigned to AS 16276. Specifically:
| 72 | netblocks currently assigned |
| 27 | netblocks previously assigned |
| 14 | netblocks are persistant |
| 58 | netblocks have been added |
| 13 | netblocks have been removed |
Many more netblocks were found for AS 16276 only by Version 2 than were found only by Version. So the difference in the amount of spam presumably comes from those added netblocks. Yes, we can drill down and see, and we may do that later.
-jsq
At least three anti-spam blocklists were taken down this week by Distributed Denial of Service (DDoS) attacks: Spamhaus, CBL, and APEWS. The first two are back up; the third is not.
The Composite Blocking List (CBL) currently has this
at the top of its home page:
Important Information on Spamhaus/CBL DDOS
Commencing March 19 the CBL was hit by a very large-scale distributed denial of service attack. At the time of writing (March 21, 00:15 UTC) this attack is still ongoing.
Throughout this period the CBL DNSBL has continued to remain available through the CBL mirrors and via Spamhaus XBL (and Zen), and we’ve been doing our utmost to restore the rest.
Access to the lookup/removal page has just been restored.
The CBL rsync facility has been restored.
Email to the CBL is not working yet.
We ask for your patience while we finish restoring the rest of the CBL to service.
SpamRankings.net is receiving CBL data normally again, although yesterday’s is lost.
We never saw any interruption in data from the Passive Spam Block List (PSBL).
Spamhaus says it got a 75Gbps DDoS attack,
according to
Liam Tung with CSO Online (Australia) today:
Bruce Schneier asserted yesterday that Our Security Models Will Never Work — No Matter What We Do. After detailing why he thinks that (the bad guys can get new techonology faster and have fewer restrictions on using it), he summarized:
Continue reading
As it gets easier for one member of a group to destroy the entire group, and the group size gets larger, the odds of someone in the group doing it approaches certainty. Our global interconnectedness means that our group size encompasses everyone on the planet, and since government hasn’t kept up, we have to worry about the weakest-controlled member of the weakest-controlled country. Is this a fundamental limitation of technological advancement, one that could end civilization? First our fears grip us so strongly that, thinking about the short term, we willingly embrace a police state in a desperate attempt to keep us safe; then, someone goes off and destroys us anyway?
If security won’t work in the end, what is the solution?