Festi botnet spam made KOCNET beat TTNET to #1 in
Turkey for the first time
in August 2012
SpamRankings.net, in rankings from both
TTNET managed to stop most spam from Festi botnet,
Festi spam from KOCNET massively ramped up.
Graph by John S. Quarterman for SpamRankings.net.
Both ISPs hit a Festi low on 21 July, which raises the speculation that
that low had nothing to do with infosec efforts by the ISPs,
and more to do with something going on inside Festi.
After that low, TTNET briefly started back up with Festi,
but then dropped down.
KOCNET just kept going up.
Up so far that KOCNET made
#3 in the world in rankings from CBL data
#4 in the world in rankings from PSBL data,
pushing Turkey itself up to
TTNET had already pushed Turkey last month to
It was Festi then, and it’s Festi now, but the lead Turkish ISP has
last month it was TTNET, this month it’s KOCNET.
It’s a problem when a botnet parasite can just move on to a new host
Do TTNET and KOCNET even know this is happening?