Hosting provider takedown slashes spam volumes

Stephen Withers
Thursday, 13 November 2008 11:02

Business IT - Security

Could isolating just one hosting company significantly affect spam volumes? Apparently it can - and has!

When California-based McColo.com was taken down by two upstream providers on November 11, security software company Sophos noted a 75 percent decline in spam arriving at its network of spamtrap mail servers. A similar drop was seen at SpamCop.net.

The two companies that previously provided connectivity to McColo.com were Global Crossing and Hurricane Electric.

Multiple security researchers had determined that McColo.net was hosting servers used by major botnets including Srizbi and Warezov, which are responsible for the majority of the world's spam.

Over 24 hours later, McColo is still isolated and there is no sign of spam volumes picking up again.

It is surely only a matter of time before the anonymous people behind the botnets find another hosting provider that's prepared to turn a blind eye to suspicious traffic patterns or - and this is less likely given the publicity the affair is receiving - McColo.com finds new partners to provide it with connectivity to the rest of the Internet.

"It would be naive to think that this is any sort of long-term victory. Spam volumes will surely ramp back up," said Paul Ducklin, Sophos's head of technology, Asia Pacific.

And as a research note from SecureWorks observes, "Even if every 'bad' colocation/hosting service is removed from the net, criminals will simply host everything on fast-flux networks made up of compromised desktop machines, and everything will be more spread out and harder to mitigate."

So let's enjoy the drop in spam while it lasts.