Spam ISP McColo Cut Off From the Internet

You might recall we reported a while ago about ‘spam friendly’ ISP Intercage coming back online after having their plug pulled by upstream provider UnitedLayer.

They pledged to clean up their act though and drop their biggest client who was an Eastern European malware and phishing host.

This time another ISP has been suspected of hosting sites that partake in online crime, child pornography and phishing scams.

A U.S. Internet service provider suspected of aiding cybercriminals in online scams and hosting child pornography was at least partially cut off from the Internet on Tuesday night.

The ISP (Internet service provider), McColo, had been under the watchful eye of computer security analysts for years. It is one of a handful of so-called “bulletproof” hosting providers that provide safe haven online for cybercriminals selling Viagra and fake security software.

ISPs can connect with each other to exchange Internet traffic, a practice known as “peering.” Hurricane Electric, an ISP that carried a portion of McColo’s traffic, disconnected with McColo on Tuesday night. Global Crossing, an IP (Internet Protocol) network services provider also connected to McColo would not comment.

Any hosting provider that offers ‘bulletproof’ services rings alarm bells for me as that usually means they are willing to hide spammers/scammers and malware propagation as long as you keep paying the bills.

2 of their Internet peers have already disconnected them, you can see an interesting freemind map of some of the sites and activity they were linked to here.

The whole article can be found here: A Closer Look at McColo

The shutdown coincides with a damming new report authored by several computer security researchers who detail how McColo and other questionable service providers are linked to spam and cybercrime.

McColo’s shutdown “demonstrates that when presented with appropriate evidence of criminal activity, the Internet community can bring about the positive forces necessary to purge it,” the analysts wrote.

McColo, whose servers were located within the U.S., at one time hosted up to 40 Web sites with child pornography, the report said.

McColo also played a big role in spam distribution, said Richard Cox, CIO of Spamhaus, which tracks spamming operations. It hosted Web sites that could infect people’s computers with malicious software used for sending spam, he said.

Apparently there has been a noticeable drop in spam after McColo has been partially cut off from the Internet. There have been reports that a 60-75% reduction in overall spam has been measured after 2 of the McColo peers dropped them meaning the majority of their sites are unreachable.

That’s a huge amount coming from 1 ISP! I hope the other culprits in hosting such sites can be found and disconnected dropping the spam percentage to something that is easy for everyone to deal with.

Source: Network World