Tag Archives: Botnets

Canada and Belgium show tandem Kelihos infections in October 2013 SpamRankings.net

Twin Kelihos infections in twin countries! Canada in both CBL and PSBL rankings shows tandem spam volume curves for Bell Canada‘s AS577 BACOM and for Shaw Communications AS6327 SHAW. Meanwhile, Belgium in both CBL and PSBL rankings shows tandem curves for Brutele‘s AS12392 ASBRUTELE and for Belgacom‘s AS5432 BELGACOM-SKYNET-AS. This is not a coincidence, since all four networks show Kelihos infections in the CBL data.


Canada’s Hospital for Sick Kids stopped spamming

Canada Canada’s The Hospital for Sick Children The Hospital for Sick Children AS 46626 SICKKIDS-AS-01 dropped out of the May 2013 SpamRankings.net for world medical organizations from CBL data. In April they ranked #1 with 21,912 spam messages, April 2013 World Medical SpamRankings.net from CBL Volume and in May they dropped to #27 with only 28 messages. In April they really only spammed for one week, as you can see in the big spike in the graph. Of course, the hospital itself probably didn’t knowingly send the spam; usually they’ve been compromised by botnets or phishing or some other breach, but hospital patients and other customers won’t necessarily know that if they receive some of it. And if their security is lax enough to let in things that emit spam, what else has been compromised? This is why hospitals are quick to squelch outgoing spam and fix the underlying security problems.


Primus dropped out of January 2013 Canada SpamRankings.net

The big winner was AS 7788 MAGMA-COMM, which dropped from #3 to #147 by decreasing from millions to less than a thousand spam messages in the January 2013 SpamRankings.net for Canada Canada. Magma had a brief spate of Kelihos spam in the middle of the month, but it only lasted less than a week. Almost as good was AS 6407 PRIMUS-AS6407, dropping from millions the previous month to a few hundred thousand, and from #6 to #11. That one while beating its Kelihos problem, seems to have developed a Cutwail problem, which was sending increasingly more spam at the end of the month. Since Magma was bought by Primus in 2004, Primus gets double congratulations!


DorukNet outspammed Turkey again in January 2013 SpamRankings.net

DorukNet logo For two months in a row, DorukNet’s AS 8685 has spammed the most in the January 2013 SpamRankings.net for Turkey Turkey from CBL data. 2011 March-April, AS 8685 DORUKNET, Turkey, SpamRankings.net Before that, it was #6 in November 2012 and also #6 April 2011.

In April 2011 the problem was apparently Lethic with a max of 87,852 on 1 April 2011. DorukNet seemed to have a bit of maazben, cutwail, etc. at that time, but very little compared to Lethic.

2012 November, AS 8685 DORUKNET, Turkey, SpamRankings.net

In November 2012 the problem was apparently Kelihos with a max of 299,873 on 7 November 2012.

This recent DorukNet peak that looks like Mt. Ararat was up to 13,569,282 on 18 January 2013, apparently from darkmailer2. DorukNet is actually improving since that peak, but meanwhile it managed to increase its December spam total of 54,803,032 to 324,544,788 in January 2013.

Continue reading

Dark times in Turkey in the December 2012 SpamRankings.net

#1 AS 8685 DORUKNET, #3 AS 42910 SADECEHOSTING-COM, and #5 AS 34984 TELLCOM-AS all ran up in the last two weeks, and all three show darkmailer2. December 2012 Turkey SpamRankings.net from CBL data December 2012 SpamRankings.net for Turkey Turkey.

DORUKNET sent a third of all top 10 spam from Turkey to rank number 1, but SADECEHOSTING-COM wins most worsened, for jumping up 21 ranks from 24 to 3, by sending more than 300 times as much spam as the previous month. #8 AS 39582 GRID and #9 AS 43391 NETDIREKT-TR both jumped up 25 ranks, but each managed “only” less than 100 times as much spam as last month.

AS 44922 MEDYABIM-AS gets most improved for actually going to zero, even though it had already spammed enough to keep it at #4. #6 AS 34619 tried to zero, but got to spamming again. AS 8386 KOCNET looks like it’s finally getting a grip, improving from #2 to #7, sending about a third as many spam messages as the previous month.

Special congratulations to AS 44565 VITAL for a huge improvement! Congratulations to Niobe, Dogan, and Kibris for improving. And boo to TurkNet for actually spamming more even though it got pushed down out of the top 10.


Vital Turkey, November 2012 SpamRankings.net

November 2012 Turkey SpamRankings.net from CBL data Even while spamming a lot less, AS 44565 VITAL still placed #1 again for spewing spam from Turkey Turkey in the November 2012 SpamRankings.net from CBL data. Even as Vital got a handle on its Kelihos problem, AS 8386 KOCNET improved twice. Maybe KOCNET is finally getting a grip on its Festi problem. KOCNET’s peak of 0.8 million messages in November is a lot less than its peak of 1.3 million in September, although still far too many.


OVH: Kelihos or darkmailer? November 2012 SpamRankings.net

OVH won again, more than doubling its spam spew of last month! This is in the November 2012 November 2012 Belgium SpamRankings.net from CBL data SpamRankings.net from CBL data. Is that 407,726,779 spam messages in a single month a record? Last month it was Kelihos. This month it looks like darkmailer.


Turkey and Kelihos botnet rampage, October 2012 SpamRankings.net

Turkey Turkey, like Belgium, Canada, U.S., and the world, has a Kelihos rampage problem in October 2012 Turkey SpamRankings.net from CBL data SpamRankings.net from CBL data for October 2012.

New Turkish #1 spammer AS 44565 VITAL TEKNOLOJI shows all the signs: rapidly increasing spamming and both Maazben and Kelihos botnets.


The other new Turkish top 10 ASNs, AS 42868 NIOBE AS 44922 MEDYABIM-AS, AS 12599 ATLAS-AS AS 49632 DATATELEKOM and AS 12987 OMURGA, all show lesser but still distinctive signs of the Kelihos rampage, namely Maazben botnet plus other unknown botnets. They all also only surged for a week or two, while Vital continued upwards.


Belgium has a Kelihos problem in October 2012 SpamRankings.net

Belgium Belgium has a Kelihos problem in October 2012 Belgium SpamRankings.net from CBL data October 2012 Belgium SpamRankings.net from CBL data from CBL data for October 2012. #1 Mobistar’s AS 12493 and #2 Telenet’s AS 6848 were spewing spam from Kelihos, pushing all the other ASNs down the rankings. Kelihos rampage: it’s not just for north America!

Belgium top botnets October 2012 SpamRankings.net

A few other botnets have a bit of Kelihos, but only the top 2 for Belgium are part of the Kelihos rampage. (Newcomer AS 9031 EDPNET has a Cutwail problem.)


Canada and Kelihos in October 2012 SpamRankings.net

The Canada Canadian top 10 were half the same as last month and half due to Kelihos October 2012 Canada SpamRankings.net from CBL data in the SpamRankings.net from CBL data for October 2012. Canadian #1 iWeb (CBL; #10 PSBL) made it into the world CBL top 10 because of Kelihos. The rankings from PSBL data October 2012 Canada SpamRankings.net from PSBL data were much closer to the CBL ones for Canada than was the case for the U.S. or for the world.

In this logarithmic chart you can see #3 AS 6327 SHAW, #7 AS 577 BACOM, #9 AS 855 CANET-ASN-4, and #10 AS 6407 PRIMUS-AS6407, the only Canadian ASNs that improved their CBL rank for October, going almost straight across the middle, decreasing towards the end of the month.

top 10 logarithmic Canada October 2012 CBL SpamRankings.net

Three of those relatively static four also were infested with Kelihos. (The fourth, AS 6407 Primus, had a Lethic problem.)

Static 4 Canada October 2012 CBL SpamRankings.net

While 25,000 spam messages a day, as seen by CBL for AS 6327 Shaw, is quite a sneeze, it’s not much Continue reading