November 13th, 2008

Host suspected of serving spam, child porn cut off from Net

Posted by Richard Koman @ November 13, 2008 @ 7:46 AM

Categories: Network security, Spam

Tags: Trend Micro Inc., Child Pornography, McColo, Internet Service Providers (ISPs), Cyberthreats, Spam, Internet, Security, Spam And Phishing, Richard Koman

The Internet has at least partially disconnected itself from McColo, an ISP suspected of providing hosting services to criminals serving kiddie porn and selling Viagra and fake security software. According to PC World, Hurricane Electric, which had been peering with McColo disconnected Tuesday night. Global Crossing also peered McColo and cut off access Wednesday, but refused comment.
A “community effort” called HostExploit released a report (PDF) that identified McColo as a highly suspect enterprise.
McColo hosted as many as 40 child porn websites, the report claimed. It also hosted command-and-control servers for such botnets as Rustock, Srizbi, Pushdo/Cutwail, Ozdok/Mega-D and Gheg, according to the report.

“We definitely don’t want something like that on our network,” said Benny Ng, director of infrastructure at Hurricane Electric. “I’d rather have my existing clients happy than have one who is dirtying the water.” (Mercury News)
There was an instant drop-off in spam, Trend Micro reported.

Following the shutdown, Trend Micro found a 40 percent drop in spam on its filters to corporate clients, said Paul Ferguson, an advanced threats researcher for the Cupertino company. Enlisting ISPs in the battle against cybercrime has been a goal of HostExploit.com, said Ferguson, who contributed to the HostExploit report. “It’s not a posse. It’s a community effort,” he said.