Continuing the question of Ogee snowshoe: black swan or new strategy? let's look at Ogee snowshoe spam in the first week of May 2012.
The two dotted lines trending down together in the middle are AS 29131 and AS 28178, and they both fit the traditional profile for snowshoe spam hosting sites, because they advertise hosting or colocation as their main services. AS 29131 is registered to RapidSwitch, which advertises dedicated servers, cloud solutions, and colocation. AS 28178, registered as Network Operations Center (NOC), which keeps on rolling waves of snowshoe spam, appears to be operating under the name BurstNet, which offers managed servers and co-location as its first two services.
However, the dotted line rising to the top right that pulled the solid overall snowshoe volume line back up is not a hosting center: it's an ISP. CDM's AS 6428 appears to be operating as Primary Network, whose first services are T-1 Internet access and metro Internet. And Primary Network is not alone. We've pulled out a list of all the ASNs affected by Ogee snowshoe so far, and quite a few of them are ISPs, some of them very well known ISPs.
Snowshoe: it's not just for hosting centers anymore.
-jsq