Tag Archives: Festi

Vital Turkey, November 2012 SpamRankings.net

November 2012 Turkey SpamRankings.net from CBL data Even while spamming a lot less, AS 44565 VITAL still placed #1 again for spewing spam from Turkey Turkey in the November 2012 SpamRankings.net from CBL data. Even as Vital got a handle on its Kelihos problem, AS 8386 KOCNET improved twice. Maybe KOCNET is finally getting a grip on its Festi problem. KOCNET’s peak of 0.8 million messages in November is a lot less than its peak of 1.3 million in September, although still far too many.


Botnets behind the late-month upswings in Belgium in the September 2012 SpamRankings.net?

Congratulations to Belgacom, Mobistar, Uganda Uganda-Telecom and BASE Belgium for improving in the September 2012 SpamRankings.net for Belgium Belgium from CBL data! But what’s behind Brutele and Mobistar and Gateway getting worse at the end of the month? And what about Teledis, which is worse over the whole month, but better at the end?

For AS 12392 ASBRUTELE, the problem the whole month is Lethic botnet with a little Festi:

Continue reading

Global Crossing spammed the most from the U.S. in September 2012 SpamRankings.net!

Bar chart: September 2012 U.S. spamRankings.net from CBL Volume Winner and new champion: Global Crossing’s AS 3549 GBLX! GBLX won the September 2012 SpamRankings.net with almost half of all the spam from the top 10 seen in the CBL data and more than a third seen from PSBL. What accounts for this surge of U.S. spammy ASNs?

Top 10 botnets for top 10 ASNs, U.S., Sep 2012, SpamRankings.net

Pie chart: September 2012 U.S. spamRankings.net from CBL Volume Yep, it’s Festi for #1 GBLX, #2 AS 17184 ATL-CBEYOND, for #3 AS 7018 ATT-INTERNET4, #8 AS 7385 INTEGRATELECOM and #10 AS 1239 SPRINTLINK. Congratulations AT&T for making the list! Well, not really congratulations, since it means you let a lot of outbound spam out.

However, it’s Lethic for #4 AS 8047 GCI, #5 AS 22258 COMCAST-22258, and #6 AS 20115 CHARTER-NET-HKY-NC.

Line chart: September 2012 U.S. spamRankings.net from CBL Volume AS 3549 GBLX may have already peaked. AS 19529 RAZOR-PHL went up like a rocket at the end of the month! Will they swap ranks next month? And what’s driving RAZOR-PHL to the top? Hint: it’s the same as for #9 AS 25653 FORTRESSITX. Stay tuned!


No Festi dip in LACNIC, July 2012 SpamRankings.net

There was a dip in volume from the top 20 Festi-infested ASNs starting about 15 July 2012, bottoming out 21 July 2012, except one region’s ASNs did not dip.

Festi top 20

The three Latin American ASNs in the Festi botnet top 20 spammers did not dip:

Those are the only three LACNIC ASNs in the top 20 ASNs for Festi. Perhaps NIC policies matter? Or maybe it’s something in regional national infosec policies? It could still be national infosec policies, but why were all the other big Brazilian ASNs not Festi-infested?

But wait! Two others also did not dip:

Continue reading

Festi in the rest of the top Turkish 7 SpamRankings.net 2012-08 CBL data

We’ve already looked at TTNET, which pushed Turkey Turkey to the top of the spamming world in July 2012, and KOCNET, ditto in August. What about other Turkish ASNs? The next five are AS 12735 ASTURKNET, AS 12978 DOGAN-ONLINE, AS 16135 TURKCELL, AS 29179 KIBRISONLINE-AS, and AS 8517 ULAKNET, in the August SpamRankings.net from both CBL and PSBL data. You guessed it: they’re all infested with Festi botnet, too.

Festi Turkish top 7-2 June-August 2012 SpamRankings.net CBL data

Festi Turkish top 7-2 June-August 2012 SpamRankings.net CBL data
Graph by John S. Quarterman for SpamRankings.net.


Festi pushes KOCNET to #1 in Turkey and #3 in the world

Festi botnet spam made KOCNET beat TTNET to #1 in Turkey for the first time ever in August 2012 SpamRankings.net, in rankings from both CBL and PSBL data. While TTNET managed to stop most spam from Festi botnet, Festi spam from KOCNET massively ramped up.

KOCNET July-August 2012

Graph by John S. Quarterman for SpamRankings.net.

Both ISPs hit a Festi low on 21 July, which raises the speculation that that low had nothing to do with infosec efforts by the ISPs, and more to do with something going on inside Festi. After that low, TTNET briefly started back up with Festi, but then dropped down. KOCNET just kept going up. Up so far that KOCNET made #3 in the world in rankings from CBL data and #4 in the world in rankings from PSBL data, pushing Turkey itself up to #4 (CBL) and #5 (PSBL).

TTNET had already pushed Turkey last month to #4 (CBL) and #6 (PSBL). It was Festi then, and it’s Festi now, but the lead Turkish ISP has changed: last month it was TTNET, this month it’s KOCNET. It’s a problem when a botnet parasite can just move on to a new host like that. Do TTNET and KOCNET even know this is happening?


TTNET ejected Festi but still infested with Lethic and other botnets 2012-07,2012-08

Congratulations to Turkey's TTNET's AS 9121 for getting Festi botnet spam down from more than a million messages a day to less than 100,000!


However, Festi is still in there, and TTNET has other problems, as well, including Lethic, Cutwail, Waledac, Maazben, and even Grum(!) botnets, plus Sendsafe.

Continue reading

eHealth Ontario tops worldwide medical spammers SpamRankings.net

Joining the festival of the Festi botnet, eHealth Ontario’s AS 21992 SSHA-ONE-ASN made #1 in the July 2012 worldwide medical spam SpamRankings.net from CBL data, the first Canadian organization to do that. The same ASN did make #2 back in November 2011 and #5 in June 2011.

Apr May Jun Jul Aug Sep Oct Nov Dec 2012
Feb Mar Apr May Jun Jul
9 7 41 5 6 41 6 5 2 7 41 43 42 41 41 6 1

The blue dotted line indicates spam from Festi, which, as you can see, tracks pretty closely with total spam seen from AS 21992.

eHealth Ontario infested by Festi botnet

Is it a Festi epidemic?


Festi botnet in July 2012 U.S. Medical SpamRankings.net from CBL

AS 122 U-PGH-NET-AS The curve that took University of Pittsburgh Medical Center‘s AS 122 U-PGH-NET-AS to number one in the July 2012 U.S. SpamRankings.net from CBL data is almost completely explained by Festi botnet, except for one day, plus the small curve at the beginning of the month was apparently caused by Grum botnet.

AS 17311 ECMC-BGP was infested with Festi (blue curve on the right) at the same time as AS 122, and AS 17311 earlier had a Cutwail botnet

Continue reading

Festi botnet infesting the world, July 2012

Autonomous Systems (ASes) infested with Festi botnet spammed more than any others worldwide, pushing whole new countries such as Saudi Arabia and Turkey into the top of the top 20 countries in the July SpamRankings.net, and pushing India to number 1 worldwide. . Here we look at the top 10 ASes infested by Festi.

Taking off like a rocket was SaidiNet's AS 25019 SAUDINETSTC-AS of Saudi Arabia. Rising almost as fast was National Internet Backbone's AS 9829 BSNL-NIB of India. Also on an upwards path was academic network AS 8386 KOCNET of Turkey.

Linear Top 10 ASNs with Festi botnet

Linear Top 10 ASNs with Festi botnet
Chart by John S. Quarterman for SpamRankings.net.

Maybe already peaked were AS 24560 AIRTELBROADBAND-AS-AP – Bharti Airtel Ltd. AS 9121 TTNET – TTnet AS AS 17813 MTNL-AP – Mahanagar Telephone Nigam Ltd. and AS 18101 RIL-IDC – Reliance Infocom Ltd Internet Data Centre

We will examine Festi more in later blog posts.