Club Troppo

The Washington Post hosts a blog called Security Fix. Not long ago they identified a data centre operator called McColo, apparently up to its eyeballs in bad behaviour:

For the past four months, Security Fix has been gathering data from the security industry about McColo Corp., a San Jose, Calif., based Web hosting service whose client list experts say includes some of the most disreputable cyber-criminal gangs in business today.

The Security Fix staff investigated the matter and found evidence that this firm was, in fact, involved in spamming, child pornography and other shady endeavours. They alerted McColo’s connection providers, who investigated the matter themselves and then cut McColo’s internet access off.

Global spam volumes have dramatically and immediately dropped:

What’s remarkable about this is that nobody in law enforcement had any hand in taking this action. It also undermines the general belief that spam volumes are dominated by bot nets rather than large single sources. If single sources are in fact the major sources of spam, then significant headway can be made against it by shutting down these sorts of providers.

Edit: a commenter on Slashdot says that McColo didn’t host actual spamming servers; instead it hosted command-and-control servers for bot networks. If that’s the case then the victory will probably last about a week while spammers relocate and regain control of their systems. It also means that it’s a mostly ephemeral victory.