Even while spamming a lot less,
AS 44565 VITAL still placed #1 again for spewing spam from Turkey
in the
November 2012
from CBL data.
Even as Vital got a handle on
its Kelihos problem,
AS 8386 KOCNET improved twice.
Maybe KOCNET is finally getting a grip on
its Festi problem.
KOCNET’s peak of 0.8 million messages in November is a lot less than
its peak of 1.3 million in September, although still far too many.
-jsq
Congratulations to Belgacom, Mobistar,
Uganda-Telecom
and BASE Belgium for improving in the
September 2012
for
Belgium from CBL data!
But what’s behind Brutele and Mobistar and Gateway getting worse at the end of the month?
And what about Teledis, which is worse over the whole month, but better at the end?
For AS 12392 ASBRUTELE, the problem the whole month is Lethic botnet with a little Festi:
Continue reading
Winner and new champion: Global Crossing’s AS 3549 GBLX!
GBLX won the
September 2012
with
almost half of all the spam from the top 10 seen in the CBL data
and
more than a third seen from PSBL.
What accounts for this surge of U.S. spammy ASNs?
Yep, it’s Festi for #1 GBLX,
#2 AS 17184 ATL-CBEYOND,
for #3 AS 7018 ATT-INTERNET4,
#8 AS 7385 INTEGRATELECOM
and
#10 AS 1239 SPRINTLINK.
Congratulations AT&T for making the list!
Well, not really congratulations, since it means you let a lot of
outbound spam out.
However, it’s Lethic for #4 AS 8047 GCI, #5 AS 22258 COMCAST-22258, and #6 AS 20115 CHARTER-NET-HKY-NC.
AS 3549 GBLX may have already peaked.
AS 19529 RAZOR-PHL went up like a rocket at the end of the month!
Will they swap ranks next month?
And what’s driving RAZOR-PHL to the top?
Hint: it’s the same as for #9 AS 25653 FORTRESSITX.
Stay tuned!
-jsq
There was a dip in volume from the top 20 Festi-infested ASNs starting about 15 July 2012, bottoming out 21 July 2012, except one region’s ASNs did not dip.
The three Latin American ASNs in the Festi botnet top 20 spammers did not dip:
Those are the only three LACNIC ASNs in the top 20 ASNs for Festi. Perhaps NIC policies matter? Or maybe it’s something in regional national infosec policies? It could still be national infosec policies, but why were all the other big Brazilian ASNs not Festi-infested?
But wait! Two others also did not dip:
Continue reading
We’ve already looked at
TTNET,
which
pushed 
Turkey to the top of the spamming world in July 2012,
and
KOCNET, ditto in August.
What about other Turkish ASNs?
The next five are
AS 12735 ASTURKNET,
AS 12978 DOGAN-ONLINE,
AS 16135 TURKCELL,
AS 29179 KIBRISONLINE-AS,
and
AS 8517 ULAKNET,
in the August 
from both
CBL
and
PSBL data.
You guessed it: they’re all infested with Festi botnet, too.
Festi Turkish top 7-2 June-August 2012 SpamRankings.net CBL data
Graph by John S. Quarterman for SpamRankings.net.
-jsq
Festi botnet spam made KOCNET beat TTNET to #1 in
Turkey for the first time
ever
in August 2012
SpamRankings.net, in rankings from both
CBL
and
PSBL data.
While
TTNET managed to stop most spam from Festi botnet,
Festi spam from KOCNET massively ramped up.
Graph by John S. Quarterman for SpamRankings.net.
Both ISPs hit a Festi low on 21 July, which raises the speculation that
that low had nothing to do with infosec efforts by the ISPs,
and more to do with something going on inside Festi.
After that low, TTNET briefly started back up with Festi,
but then dropped down.
KOCNET just kept going up.
Up so far that KOCNET made
#3 in the world in rankings from CBL data
and
#4 in the world in rankings from PSBL data,
pushing Turkey itself up to
#4 (CBL)
and
#5 (PSBL).
TTNET had already pushed Turkey last month to #4 (CBL) and #6 (PSBL). It was Festi then, and it’s Festi now, but the lead Turkish ISP has changed: last month it was TTNET, this month it’s KOCNET. It’s a problem when a botnet parasite can just move on to a new host like that. Do TTNET and KOCNET even know this is happening?
-jsq
Congratulations to Turkey's TTNET's AS 9121 for getting Festi botnet spam down from more than a million messages a day to less than 100,000!
However, Festi is still in there, and TTNET has other problems, as well, including Lethic, Cutwail, Waledac, Maazben, and even Grum(!) botnets, plus Sendsafe.
Continue reading
Joining the
festival of the Festi botnet,
eHealth Ontario’s
AS 21992 SSHA-ONE-ASN
made #1 in the
July 2012 worldwide medical spam SpamRankings.net from CBL data,
the first Canadian organization to do that.
The same ASN did make #2 back in
November 2011
and #5 in
June 2011.
| 2011 Mar |
Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | 2012 Jan |
Feb | Mar | Apr | May | Jun | Jul | |
| 9 | 7 | 41 | 5 | 6 | 41 | 6 | 5 | 2 | 7 | 41 | 43 | 42 | 41 | 41 | 6 | 1 |
The blue dotted line indicates spam from Festi, which, as you can see, tracks pretty closely with total spam seen from AS 21992.
Is it a Festi epidemic?
-jsq
The curve that took University of Pittsburgh Medical Center‘s AS 122 U-PGH-NET-AS
to number one
in the July 2012 U.S. SpamRankings.net from CBL data is almost completely explained by Festi botnet, except for one day, plus the small curve at the beginning of the month was apparently caused by Grum botnet.
AS 17311 ECMC-BGP was infested with Festi (blue curve on the right) at the same time as AS 122, and AS 17311 earlier had a Cutwail botnet
Autonomous Systems (ASes) infested with Festi botnet spammed more than any others worldwide, pushing whole new countries such as 
Saudi Arabia and Turkey into the top of the top 20 countries in the July SpamRankings.net, and pushing 
India to number 1 worldwide. . Here we look at the top 10 ASes infested by Festi.
Taking off like a rocket was SaidiNet's AS 25019 SAUDINETSTC-AS of Saudi Arabia. Rising almost as fast was National Internet Backbone's AS 9829 BSNL-NIB of India. Also on an upwards path was academic network AS 8386 KOCNET of Turkey.
Linear Top 10 ASNs with Festi botnet
Chart by John S. Quarterman for SpamRankings.net.
Maybe already peaked were AS 24560 AIRTELBROADBAND-AS-AP – Bharti Airtel Ltd. AS 9121 TTNET – TTnet AS AS 17813 MTNL-AP – Mahanagar Telephone Nigam Ltd. and AS 18101 RIL-IDC – Reliance Infocom Ltd Internet Data Centre
We will examine Festi more in later blog posts.
-jsq