Tag Archives: TTNET

Medyabim most worsened in Turkey in May SpamRankings.net

Medyabim Internet Services popped into the Turkey Turkish top 10 SpamRankings.net for May 2013, hopping up from #81 to #5. This happened starting about 23 May 2013, probably coincidentally about the same time as the disturbances around Taksim Square in Istanbul.

Previous chronic Turkish spam winner TTNET 9121 made it back to the top, and this time TTNET placed twice, with AS 47331 as #6. Together the two TTNET ASNs sent 49.26% of top 10 Turkish spam for May 2013.

AS 43391 NETDIREKT-TR and AS 42926 RADORETELEKOM battled through the whole month for spots #2 and #3.

In better news, Tamer Gigabitweb Turkey and DorukNet IstanbulTurkey dropped out of the Turkish top 10.

Also new this month are v2 rankings back to January 2013.

-jsq

Odd goings-on in Turkey: March 2013 SpamRankings.net

AS 49879 HOSTHANE ISIK spammed enough in three days starting 26 March 2013 to make #4 in the March SpamRankings.net for TR Turkey from CBL data. TTnet’s AS 9121 spammed about 30% less, yet went from #2 to #1. The new #2, hosting company Adeox’s AS 42055 TAMER, went from zero to more than 15 million messages.

-jsq

Turkey and Kelihos botnet rampage, October 2012 SpamRankings.net

Turkey Turkey, like Belgium, Canada, U.S., and the world, has a Kelihos rampage problem in October 2012 Turkey SpamRankings.net from CBL data SpamRankings.net from CBL data for October 2012.

New Turkish #1 spammer AS 44565 VITAL TEKNOLOJI shows all the signs: rapidly increasing spamming and both Maazben and Kelihos botnets.

AS 44565 VITAL TEKNOLOJI

The other new Turkish top 10 ASNs, AS 42868 NIOBE AS 44922 MEDYABIM-AS, AS 12599 ATLAS-AS AS 49632 DATATELEKOM and AS 12987 OMURGA, all show lesser but still distinctive signs of the Kelihos rampage, namely Maazben botnet plus other unknown botnets. They all also only surged for a week or two, while Vital continued upwards.

-jsq

KOCNET outspams Turkey, gaining on TTNET’s record in September 2012 SpamRankings.net

More than two-thirds top-10 Turkish spam came from KOCNET in September 2012 SpamRankings.net from CBL data More than two-thirds top-10 Turkish spam came from KOCNET in September 2012 SpamRankings.net for Turkey Turkey from CBL data. KOCNET’s 68.5% is about the same as its 68.7% for August and more than TTNET’s 65.2% for July but still not quite up to TTNET’s record of 78.3% in June. However, in June TTNET only spammed 6,362,167 messages (as seen in the CBL data), while KOCNET spammed 28,937,997 in September, which beats TTNET’s maximum messages a month in July 2011.

-jsq

Festi pushes KOCNET to #1 in Turkey and #3 in the world

Festi botnet spam made KOCNET beat TTNET to #1 in Turkey for the first time ever in August 2012 SpamRankings.net, in rankings from both CBL and PSBL data. While TTNET managed to stop most spam from Festi botnet, Festi spam from KOCNET massively ramped up.

KOCNET July-August 2012

Graph by John S. Quarterman for SpamRankings.net.

Both ISPs hit a Festi low on 21 July, which raises the speculation that that low had nothing to do with infosec efforts by the ISPs, and more to do with something going on inside Festi. After that low, TTNET briefly started back up with Festi, but then dropped down. KOCNET just kept going up. Up so far that KOCNET made #3 in the world in rankings from CBL data and #4 in the world in rankings from PSBL data, pushing Turkey itself up to #4 (CBL) and #5 (PSBL).

TTNET had already pushed Turkey last month to #4 (CBL) and #6 (PSBL). It was Festi then, and it’s Festi now, but the lead Turkish ISP has changed: last month it was TTNET, this month it’s KOCNET. It’s a problem when a botnet parasite can just move on to a new host like that. Do TTNET and KOCNET even know this is happening?

-jsq

TTNET ejected Festi but still infested with Lethic and other botnets 2012-07,2012-08

Congratulations to Turkey's TTNET's AS 9121 for getting Festi botnet spam down from more than a million messages a day to less than 100,000!

Linear

However, Festi is still in there, and TTNET has other problems, as well, including Lethic, Cutwail, Waledac, Maazben, and even Grum(!) botnets, plus Sendsafe.

Continue reading →

SuperOnline dropped off May 2012 Turkey top 10 SpamRankings.net

Congratulations to Turkcell SuperOnline‘s AS 34104 GLOBAL 64,658 for dropping off of the top 10 spamming ASN’s for Turkey in the May 2012 SpamRankings.net!

It was replaced in the Turkish top 10 by academic network ULAKNET‘s AS 8517, which had previously dropped off the April rankings.

Perpetual winner and still champion for spewing spam from Turkey is TTNET‘s AS 9121, accounting for almost 3/4 of all spam seen from Turkey seen by CBL. SpamRankings.net saw about the same proportion of Turkish spam coming from TTNET in data from PSBL.

-jsq