Late last week Spamhaus published a blog post detailing their investigation into Verizon routing millions of IP addresses hijacked by spammers.
The Spamhaus blog post goes into some detail about what hijacked routing is.
For cybercriminals to make use of their stolen blocks however, a crucial step is to find an Internet Service Provider(ISP) or network with the ability to route these IP addresses to the rest of the Internet by using an autonomous system number(ASN). Also crucial is finding an ISP who won’t look too closely at the highly suspicious routing request. To get the routes to their stolen IP addresses announced, criminals will present forged authorization documents…
Actions like this are why an unknown IP is considered hostile until proven otherwise. I regularly tell clients than 99 times out of 100 when there’s mail from an IP never seen before it’s spam. I’ve often wondered if I’m understating the problem. That is way more than 99 IPs in 100 are sending spam. But I thought that would be an exaggeration and overly aggressive. Seeing the hijacked IPs just being routed through one US provider, though, tells me I am understating the problem.
Nevertheless, this is extremely bad behavior by Verizon and it’s disappointing that they seem unable or unwilling to take action about the spam and abuse coming from their network.
RSS - Posts
As usual, if these cybercriminals, virus writers and spammers would apply themselves to good instead of evil they could achieve *anything*.