Tag Archives: Turkey

Medyabim most worsened in Turkey in May SpamRankings.net

Medyabim Internet Services popped into the Turkey Turkish top 10 SpamRankings.net for May 2013, hopping up from #81 to #5. This happened starting about 23 May 2013, probably coincidentally about the same time as the disturbances around Taksim Square in Istanbul.

Previous chronic Turkish spam winner TTNET 9121 made it back to the top, and this time TTNET placed twice, with AS 47331 as #6. Together the two TTNET ASNs sent 49.26% of top 10 Turkish spam for May 2013.

AS 43391 NETDIREKT-TR and AS 42926 RADORETELEKOM battled through the whole month for spots #2 and #3.

In better news, Tamer Gigabitweb Turkey and DorukNet IstanbulTurkey dropped out of the Turkish top 10.

Also new this month are v2 rankings back to January 2013.

-jsq

Adeox or Tamer

Here’s why we didn’t list a website for AS 42055 TAMER the March SpamRankings.net for TR Turkey from CBL data. Various Autonomous System analysis sites, such as TCPIPUtils.com list numerous domains for this AS: which domain is the main one? Hurricane Electric provides a graphical representation of which other ASNs route to AS 42055, and RobTex provides a graph with AS names as well as numbers. And RobTex provides a couple of clues:

WARNING! 1% (1/100) of the sites on ADEOX Dummy description for (as42055) is pornographic or otherwise sensitive content!

The first clue is that the main organizational name may be Adeox. The second clue is the content warning.

Google warns everyone away:

Continue reading →

Odd goings-on in Turkey: March 2013 SpamRankings.net

AS 49879 HOSTHANE ISIK spammed enough in three days starting 26 March 2013 to make #4 in the March SpamRankings.net for TR Turkey from CBL data. TTnet’s AS 9121 spammed about 30% less, yet went from #2 to #1. The new #2, hosting company Adeox’s AS 42055 TAMER, went from zero to more than 15 million messages.

-jsq

DorukNet outspammed Turkey again in January 2013 SpamRankings.net

DorukNet logo For two months in a row, DorukNet’s AS 8685 has spammed the most in the January 2013 SpamRankings.net for Turkey Turkey from CBL data. 2011 March-April, AS 8685 DORUKNET, Turkey, SpamRankings.net Before that, it was #6 in November 2012 and also #6 April 2011.

In April 2011 the problem was apparently Lethic with a max of 87,852 on 1 April 2011. DorukNet seemed to have a bit of maazben, cutwail, etc. at that time, but very little compared to Lethic.

2012 November, AS 8685 DORUKNET, Turkey, SpamRankings.net

In November 2012 the problem was apparently Kelihos with a max of 299,873 on 7 November 2012.

This recent DorukNet peak that looks like Mt. Ararat was up to 13,569,282 on 18 January 2013, apparently from darkmailer2. DorukNet is actually improving since that peak, but meanwhile it managed to increase its December spam total of 54,803,032 to 324,544,788 in January 2013.

Continue reading →

Dark times in Turkey in the December 2012 SpamRankings.net

#1 AS 8685 DORUKNET, #3 AS 42910 SADECEHOSTING-COM, and #5 AS 34984 TELLCOM-AS all ran up in the last two weeks, and all three show darkmailer2. December 2012 Turkey SpamRankings.net from CBL data December 2012 SpamRankings.net for Turkey Turkey.

DORUKNET sent a third of all top 10 spam from Turkey to rank number 1, but SADECEHOSTING-COM wins most worsened, for jumping up 21 ranks from 24 to 3, by sending more than 300 times as much spam as the previous month. #8 AS 39582 GRID and #9 AS 43391 NETDIREKT-TR both jumped up 25 ranks, but each managed “only” less than 100 times as much spam as last month.

AS 44922 MEDYABIM-AS gets most improved for actually going to zero, even though it had already spammed enough to keep it at #4. #6 AS 34619 tried to zero, but got to spamming again. AS 8386 KOCNET looks like it’s finally getting a grip, improving from #2 to #7, sending about a third as many spam messages as the previous month.

Special congratulations to AS 44565 VITAL for a huge improvement! Congratulations to Niobe, Dogan, and Kibris for improving. And boo to TurkNet for actually spamming more even though it got pushed down out of the top 10.

-jsq

Vital Turkey, November 2012 SpamRankings.net

November 2012 Turkey SpamRankings.net from CBL data Even while spamming a lot less, AS 44565 VITAL still placed #1 again for spewing spam from Turkey Turkey in the November 2012 SpamRankings.net from CBL data. Even as Vital got a handle on its Kelihos problem, AS 8386 KOCNET improved twice. Maybe KOCNET is finally getting a grip on its Festi problem. KOCNET’s peak of 0.8 million messages in November is a lot less than its peak of 1.3 million in September, although still far too many.

-jsq

Turkey and Kelihos botnet rampage, October 2012 SpamRankings.net

Turkey Turkey, like Belgium, Canada, U.S., and the world, has a Kelihos rampage problem in October 2012 Turkey SpamRankings.net from CBL data SpamRankings.net from CBL data for October 2012.

New Turkish #1 spammer AS 44565 VITAL TEKNOLOJI shows all the signs: rapidly increasing spamming and both Maazben and Kelihos botnets.

AS 44565 VITAL TEKNOLOJI

The other new Turkish top 10 ASNs, AS 42868 NIOBE AS 44922 MEDYABIM-AS, AS 12599 ATLAS-AS AS 49632 DATATELEKOM and AS 12987 OMURGA, all show lesser but still distinctive signs of the Kelihos rampage, namely Maazben botnet plus other unknown botnets. They all also only surged for a week or two, while Vital continued upwards.

-jsq

KOCNET outspams Turkey, gaining on TTNET’s record in September 2012 SpamRankings.net

More than two-thirds top-10 Turkish spam came from KOCNET in September 2012 SpamRankings.net from CBL data More than two-thirds top-10 Turkish spam came from KOCNET in September 2012 SpamRankings.net for Turkey Turkey from CBL data. KOCNET’s 68.5% is about the same as its 68.7% for August and more than TTNET’s 65.2% for July but still not quite up to TTNET’s record of 78.3% in June. However, in June TTNET only spammed 6,362,167 messages (as seen in the CBL data), while KOCNET spammed 28,937,997 in September, which beats TTNET’s maximum messages a month in July 2011.

-jsq

Data storage issues in SpamRankings.net

Data storage issues led to loss of some incoming data for the September 2012 SpamRankings.net. Interestingly, the results seem almost normal anyway. Here is a speculation on why that can be.

Look just under any rankings chart for September 2012 and you’ll see this notice:

CBL dropouts 8,11 September 2012 were on our end.
PSBL data is unusable 4-15 Sep 2012 due to problems on our end.
September 2012 World All SpamRankings.net from CBL Volume
1 (2) AS 9829 BSNL-NIB India IN
2 (1) AS 25019 SAUDINETSTC-AS Saudi Arabia SA
3 (5) AS 6147 SAA Peru PE
4 (3) AS 8386 KOCNET Turkey TR
5 (4) AS 7643 VNPT-AS-VN Vietnam VN
6 (-) AS 9050 ROMTELECOM Romania RO

The source of the problem was embarassingly simple and easily fixed: not enough inodes. The CBL and PSBL data were affected differently because they arrive differently. We pick up from CBL daily a text summary table with a line per IP address. We get from PSBL an NNTP feed of spam messages, each in its own file, that we boil down to a summary. So for CBL, we either got the whole file (most days of the month), or we didn’t store it at all (8 and 11 September). For PSBL, for each incoming message, we either stored it or we didn’t. Which is why there are some days with PSBL data between 4 and 15 Sep, but the volume is lower than usual. The notice below the chart is dire because we prefer to be conservative about these things.

Yet the PSBL rankings show AS 9829 BSNL-NIB #1 worldwide just like Continue reading →

Festi in the rest of the top Turkish 7 SpamRankings.net 2012-08 CBL data

We’ve already looked at TTNET, which pushed Turkey Turkey to the top of the spamming world in July 2012, and KOCNET, ditto in August. What about other Turkish ASNs? The next five are AS 12735 ASTURKNET, AS 12978 DOGAN-ONLINE, AS 16135 TURKCELL, AS 29179 KIBRISONLINE-AS, and AS 8517 ULAKNET, in the August SpamRankings.net from both CBL and PSBL data. You guessed it: they’re all infested with Festi botnet, too.

Festi Turkish top 7-2 June-August 2012 SpamRankings.net CBL data

Festi Turkish top 7-2 June-August 2012 SpamRankings.net CBL data
Graph by John S. Quarterman for SpamRankings.net.

-jsq