Analyzing the Aftermath of the McColo Shutdown

Abstract

This paper examines how spam behavior was impacted by the shutdown of McColo, a service provider known for its lax security enforcement. Since the shutdown, a variety of sources have reported significant changes to global spam patterns. In an effort to clarify how spam has changed, we examine reputation data provided by a leading security vendor and present an analysis of spam before and after the McColo shutdown. We show that the actual number of spammers has decreased. We also examine the distribution of spammers both geographically and across the IP space. Our results show that 87% spam sending regions suffered some reductions. Despite this however, the number of sources identified as spammers is still monotonically increasing and the spam volume has recovered to its pre-shutdown levels.

Statistical methods for network surveillance

“…Most organizations run some version of spam filters at their local networks . These filters examine the content of each message as well as the IP address where the message came from, and if they match known spam signatures, the message is marked as spam.…”

Network-level characteristics of spamming: An empirical analysis

“…By analyzing a trace from DShield.org logs [5], they observed that 80% of the malicious traffic is originated from the same 20% of the IP space. Finally, recent works studied the implications that shutting down MacColo [13] had to spamming activity [3], [4]. Both studies show a drop in spam volumes right after the server shut down.…”

Modern techniques for the detection and prevention of web2.0 attacks

“…To this end, there are numerous micro-ISPs that purchase Internet in bulk from providers owning a backbone and offer it to subscribers at appealing prices. Cases where micro-ISPs were affiliated with illegal activities have been recorded in the past [DMPW09]. In the majority, these activities refer to SPAM and malware distribution.…”