What's the Kelihos rampage mentioned in the
October 2012?
It's a few IP addresses sending hundreds of thousands and even
millions of spam messages a day.
It seems to be associated with Kelihos botnet.
Those few addresses spewed so much spam they pushed entire countries,
The
Kelihos rampage pushed many countries, including
France,
Germany,
Hong Kong,
Thailand,
Canada,
Hungary,
Belarus,
Paraguay,
Singapore(!),
and
Mexico,
to the top of the
countries ranking.
Should we rank an ASN at the top of the world because of only a few addresses? We considered that at some length, but in the end it's no different from what's been going on with the medical rankings for a long time, except on larger scales (all ASNs, and many more messages from a few addresses).
These rankings don't mean the affected organizations aren't vigilant. They do seem to mean those organizations have an infestation they need to deal with.
-jsq