LACNIC downtrend, yet four new to the top 10

New to the Latin American top 10: #6 Administracion Nacional de Telecomunicaciones‘s AS6057 ANT-AS of Uruguay, #8 Telecomunicacoes de Santa Catarina SA‘s AS8167 TELESC of Brazil, #9 Ag para el Desarrollo de la Sociedad de la Inf en Bolivia’s AS6568 ADSIB, and #10 Axtel S.A.B. de C. V.‘s AS6503 Axtel of Mexico. All four seem to have been infested with cutwail, and most seem to have gotten a grip before the end of the month.

There was a general Continue reading LACNIC downtrend, yet four new to the top 10

Internap in Cloud rankings all 2015 so far

Internap so far in 2015:

Jan Feb Mar Apr May Jun
NAICS 518210827154714144

300x343 Internap-cbl-volume-2015-06, in InterNAP #2 for spam volume June 2015, by John S. Quarterman, for, 25 July 2015

Internap does hosting, colocation, and cloud services, and like another such services, New Jersey International Internet Exchange LLC (NJIIX), appears to be having a bit of a problem with spammer infestations.

NAICS 518210 is Data Processing, Hosting, and Related Services. While Internap ranks #44 in composite Borda, that’s apparently because a relatively small number of nodes on one ASN at Internap are sending a lot of spam, since Internap actually ranks #2 using CBL volume data for both NAICS and U.S.

Global Broadband Kinshasha in Belgian June 2015 top 10

Belgian CBL top 10 July 2015 SpamRankings.netGlobal Broadband Kinshasha of the Congo Kinshasha Congo got cutwail real bad and joined the Belgium Belgian CBL top 10. T2 Belgium NV‘s AS47377 KPNBE got cutwail right at the end of the month. Perpetual winner AS12392 ASBRUTELE actually clipped its worst cutwail urge in the middle of the month.

AS29587 SCHEDOM-AS joined the PSBL top 10, Continue reading Global Broadband Kinshasha in Belgian June 2015 top 10

Verizon MCI UUNET #4 U.S. May 2015,

300x115 Rankings Classes, in Verizon MCI UUNET #4 U.S. May 2015, by, for, 15 June 2015 #3 among 2,200 wired telecommunications carriers and #4 among 9,698 U.S. organizations ranked for May 2015 by Verizon Business Services did improve towards the end of the month, falling to #9 after briefly Continue reading Verizon MCI UUNET #4 U.S. May 2015,

Algeria’s DJAWEB-MNT both #1 and most improved in May AFRINIC SpamRankings

South Africa placed five ASNs in the May top 10 from both CBL and PSBL data, two of them the same: AS16637 MTNNS-AS and AS3741 IS of Internet Solutions. Morocco placed twice in rankings from both sources, with AS36903 MPLs de Maroc Telecom and AS6713 IAM-AS. However, Algeria’s AS36947 DJAWEB-MNT was #1 from the CBL data and Mozambique’s AS37342 Movitel was #1 from the PSBL data.

DJAWEB-MNT did show a lot of improvement, with Continue reading Algeria’s DJAWEB-MNT both #1 and most improved in May AFRINIC SpamRankings

Ideal Hosting most improved in Turkey April

From #2 and 5,308 spam messages in March to below #250 and zero seen in April, Ideal Hosting was most improved in Turkey in from PSBL data. From CBL data, DorukNet was most improved, dropping 41 ranks from #3 to #44, and from more than 11 million to less than 33 thousand spam messages seen. Four other ASNs dropped out of the CBL top 10: Netdirekt, DGN, NetInternet Bilgisayar, and Sadecehosting. Two of those, DGN and Sadecehosting, also Continue reading Ideal Hosting most improved in Turkey April

Rostelecom won the rest of the world in April

AS12389 ROSTELECOM-AS came from nowhere to #1 on the PSBL April 2015 RoW rankings, and seven other Russian ASNs that weren’t even in the top 250 in March made the top 10 in April. Perennial winner AS4134 CHINANET-BACKBONE got pushed down to #1, spewing less than half the spam of AS12389 alone, and nowhere near the 80% of RoW top 10 spam from the eight Russian ASNs.

The CBL April RoW ranking does not have any Russian ASNs in its top 10, so whatever the cause, this time PSBL was more sensitive in detecting it.

Sprint #16 in U.S.

300x380 Most spam from AS3651, in Sprint in April 2015, by John S. Quarterman, for, 12 May 2015 Sprint ranked number 16 for April 2015 among U.S. organizations ranked by, by Composite Borda count. On one of the four rankings that go into that composite, CBL Volume, Sprint ranked #1. This illustrates the purpose of the Composite Borda ranking: it balances several different sources so pertubations on any one source (even if perhaps from Continue reading Sprint #16 in U.S.

Spam Snowshoeing across Experts

Why so much spam lately? Partly new(ish) techniques.

After noting that the Cisco 2015 Annual Security Report says spam volume went up 250 percent between January and November 2014, CP Morey wrote for 27 April 2015, Spam continues to thrive thanks to ‘snowshoe’ strategy,

Detecting and blocking massive floods of spam from a single source is simple. Most organizations have some technology in place capable of identifying a high volume of email originating from a single IP address and rejecting those messages as spam. Spammers know this as well, which is why they’ve come up with a new strategy to circumvent that detection: the “snowshoe” strategy.

A snowshoe enables Continue reading Spam Snowshoeing across Experts

Internap scored worse in March 2015 Cloud rankings

Sending more spam from more hosts placed Internap #63 in the March 2015, compared to #85 in February (#1 is worst). This is for all ranked organizations in the U.S. To see this, select the month, and then under Choose Rankings Classification pick U.S.

300x342 Daily score, CBL March 2015, in Internap Daily Score CBL Volume, by John S. Quarterman, for, 23 April 2015 Internap’s composite Borda score was held down by slightly less spam seen from slightly less hosts by one blocklist (PSBL), but the increase in both spam and hosts by the other (CBL) pushed it closer to #1.

However, InterNAP did greatly reduce its spam volume during the month, as seen in the volume graph here, which you can get by selecting Source: CBL Volume.