Perilocity

Dark times in Turkey in the December 2012 SpamRankings.net

#1 AS 8685 DORUKNET, #3 AS 42910 SADECEHOSTING-COM, and #5 AS 34984 TELLCOM-AS all ran up in the last two weeks, and all three show darkmailer2. December 2012 for Turkey.

DORUKNET sent a third of all top 10 spam from Turkey to rank number 1, but SADECEHOSTING-COM wins most worsened, for jumping up 21 ranks from 24 to 3, by sending more than 300 times as much spam as the previous month. #8 AS 39582 GRID and #9 AS 43391 NETDIREKT-TR both jumped up 25 ranks, but each managed "only" less than 100 times as much spam as last month.

AS 44922 MEDYABIM-AS gets most improved for actually going to zero, even though it had already spammed enough to keep it at #4. #6 AS 34619 tried to zero, but got to spamming again. AS 8386 KOCNET looks like it's finally getting a grip, improving from #2 to #7, sending about a third as many spam messages as the previous month.

Special congratulations to AS 44565 VITAL for a huge improvement! Congratulations to Niobe, Dogan, and Kibris for improving. And boo to TurkNet for actually spamming more even though it got pushed down out of the top 10.

-jsq

Medical churn in December 2012 SpamRankings.net

Good (Konkuk), improving (Cornell), and bad (eHealth) in the December 2012 country medical .

First the good news: Konkuk University Hospital went from 297 spam messages last month to zero in December 2012, removing Korea from the country medical rankings. Children's Hospital & Health System and THE GOOD SAMARITAN HOSPITAL OF LEBANON PENNSYLVANIA also went to zero, and Yale-New Haven Health Services Corporation and Sutter Health dropped enough to fall out of the world top 10 medical ASNs emitting spam in .

Now the apparently bad news that turned good.

A Field Quasi-Experiment @ ICIS 2012

Project participant Qian Tang presented at ICIS 2012 in Orlando, FL, 14 December 2012, a paper about comparisons of eight countries, in pairs, one of each pair ranked on and the other not. Statistical results indicate the rankings changed organizational spamming behavior.

Qian Tang, Leigh Linden, John S. Quarterman, and Andrew Whinston, Reputation as Public Policy for Internet Security: A Field Quasi-Experiment,

Abstract: Cybersecurity is a national priority in this big data era. Because of the lack of incentives and the existence of negative externality, companies often underinvest in addressing security risks and accidents, despite government and industry recommendations. In the present article, we propose a method that utilizes reputation through information disclosure to motivate companies to behave pro-socially, improving their Internet security. Using outbound spam as a proxy for Internet security, we conducted a quasi-experimental field study for eight countries through SpamRankings.net. This outgoing-spam-based study shows that information disclosure on outgoing spam can help reduce outgoing spam, approximately by 16 percent. This finding suggests that information disclosure can be leveraged to encourage companies to reduce security threats. It also provides support for public policies that require mandatory reporting from organizations and offers implications for evaluating and executing such policies.

What is ICIS 2012?

Vital Turkey, November 2012 SpamRankings.net

Even while spamming a lot less, AS 44565 VITAL still placed #1 again for spewing spam from Turkey in the November 2012 from CBL data. Even as Vital got a handle on its Kelihos problem, AS 8386 KOCNET improved twice. Maybe KOCNET is finally getting a grip on its Festi problem. KOCNET's peak of 0.8 million messages in November is a lot less than its peak of 1.3 million in September, although still far too many.

-jsq

OVH: Kelihos or darkmailer? November 2012 SpamRankings.net

OVH won again, more than doubling its spam spew of last month! This is in the November 2012 from CBL data. Is that 407,726,779 spam messages in a single month a record? Last month it was Kelihos. This month it looks like darkmailer.

-jsq

Turkey and Kelihos botnet rampage, October 2012 SpamRankings.net

Turkey, like Belgium, Canada, U.S., and the world, has a Kelihos rampage problem in from CBL data for October 2012.

New Turkish #1 spammer AS 44565 VITAL TEKNOLOJI shows all the signs: rapidly increasing spamming and both Maazben and Kelihos botnets.

The other new Turkish top 10 ASNs, AS 42868 NIOBE AS 44922 MEDYABIM-AS, AS 12599 ATLAS-AS AS 49632 DATATELEKOM and AS 12987 OMURGA, all show lesser but still distinctive signs of the Kelihos rampage, namely Maazben botnet plus other unknown botnets. They all also only surged for a week or two, while Vital continued upwards.

-jsq

Belgium has a Kelihos problem in October 2012 SpamRankings.net

Belgium has a Kelihos problem in from CBL data for October 2012. #1 Mobistar's AS 12493 and #2 Telenet's AS 6848 were spewing spam from Kelihos, pushing all the other ASNs down the rankings. Kelihos rampage: it's not just for north America!

A few other botnets have a bit of Kelihos, but only the top 2 for Belgium are part of the Kelihos rampage. (Newcomer AS 9031 EDPNET has a Cutwail problem.)

-jsq

Syria and Yemen: 29 November 2012

At 10:30 AM GMT yesterday, 29 November 2012, routing to Yemen suddenly changed from London to Dubai through FLAG to New York to Dubai through ETISALAT, as shown in the animation here and detailed in the PerilWatch from InternetPerils. That timing closely matched the 10:26 AM GMT Syrian disconnect time reported by Renesys. This is very reminiscent of Mubarak disconnecting Egypt 22:30 GMT 20 January 2011. This tactic didn't help Mubarak's regime in Egypt, and it probably won't help Assad's regime in Syria; rather the opposite: people don't like their Internet being turned off. And it tends to cause the international community to rally around the rebels.

-jsq

Canada and Kelihos in October 2012 SpamRankings.net

The Canadian top 10 were half the same as last month and half due to Kelihos in the from CBL data for October 2012. Canadian #1 iWeb (CBL; #10 PSBL) made it into the world CBL top 10 because of Kelihos. The rankings from PSBL data were much closer to the CBL ones for Canada than was the case for the U.S. or for the world.

In this logarithmic chart you can see #3 AS 6327 SHAW, #7 AS 577 BACOM, #9 AS 855 CANET-ASN-4, and #10 AS 6407 PRIMUS-AS6407, the only Canadian ASNs that improved their CBL rank for October, going almost straight across the middle, decreasing towards the end of the month.

Three of those relatively static four also were infested with Kelihos. (The fourth, AS 6407 Primus, had a Lethic problem.)

While 25,000 spam messages a day, as seen by CBL for AS 6327 Shaw, is quite a sneeze, it's not much

Kelihos and Maazben botnets in U.S. October 2012 SpamRankings.net

We've seen that botnets Kelihos and Maazben account for most of the spam seen from the entirely-new worldwide top 10 in the October 2012 Kelihos rampage. What about a specific country? The U.S. top 10 are also entirely new (since last month): are all those U.S. ASNs ranked like that because of the Kelihos rampage? Two clues indicate yes: the shapes of the U.S. curves are very similar to those of the worldwide rankings, and the U.S. top 3 are in the worldwide top 10. But what about the rest of the U.S. top 10? Let's drill down to botnets in U.S. October 2012 SpamRankings.net from CBL data:

We can see 9 out of the U.S. top 10 are there mostly because of Maazben or Kelihos, often alternating for the same ASN, in the same pattern as for the worldwide top 10. So yes, 9 are in the U.S. top 10 because of the Kelihos rampage.

The one exception is