Outbound spam rankings as a proxy for organizational security
Spam as a sneeze for infosec disease

See NSF Grants
1228990, 0831338
Home | Rankings Method | Glossary | About the Project | New and News | RSS | FAQ | Contact
News 24 July 2014: Anti-Spamming Website Helps Companies Cut Outbound Spam

About this Research Project


July 2015 Rankings: New to LACNIC top 10: #6 ANT-AS , #8 TELESC , #9 ADSIB , #10 Axtel .


New and News (RSS)


New on the site

31 August 2015: July 2015 Rankings
New to the Latin American top 10: #6 Administracion Nacional de Telecomunicaciones's AS6057 ANT-AS of Uruguay, #8 Telecomunicacoes de Santa Catarina SA's AS8167 TELESC of Brazil, #9 Ag para el Desarrollo de la Sociedad de la Inf en Bolivia's AS6568 ADSIB, and #10 Axtel S.A.B. de C. V.'s AS6503 Axtel of Mexico. All four seem to have been infested with cutwail, and most seem to have gotten a grip before the end of the month.

There was a general downtrend in spam at the end of July, after surges by by #2 Mexico's AS8151 UNINET and #4 Argentina's AS10481 PRIMA.

Only Brazil, Mexico, and Argentina placed twice, with no country placing three times. Telefonica del Peru's AS6147 SAA won #1 as usual.

21 July 2015: June 2015 Rankings
Global Broadband Kinshasha of the Congo got cutwail real bad and joined the Belgian CBL top 10. T2 Belgium NV's AS47377 KPNBE got cutwail right at the end of the month. Perpetual winner AS12392 ASBRUTELE actually clipped its worst cutwail urge in the middle of the month..

AS29587 SCHEDOM-AS joined the PSBL top 10, perpetual winner Belgacom's Skynet was still #1 even though it spammed less, ASBRUTELE got worse in both spam count and rank to #2, and KPNBE got worse but remained #5.

11 June 2015: May 2015 Rankings
South Africa placed five ASNs in the May top 10 from both CBL and PSBL data, two of them the same: AS16637 MTNNS-AS and AS3741 IS of Internet Solutions. Morocco placed twice in rankings from both sources, with AS36903 MPLs de Maroc Telecom and AS6713 IAM-AS. However, Algeria's AS36947 DJAWEB-MNT was #1 from the CBL data and Mozambique's AS37342 Movitel was #1 from the PSBL data.

DJAWEB-MNT did show a lot of improvement, with less than a third as much spam seen in the CBL data as the previous month, yet it still spewed a third of top 10 African spam in May. In the rankings from PSBL data, DJAWEB-MNT actually dropped completely out of the top 10, placing #17, making it most improved of AFRINIC ASNs.

12 May 2015: April 2015 Rankings
AS12389 ROSTELECOM-AS came from nowhere to #1 on the PSBL April 2015 RoW rankings, and seven other Russian ASNs that weren't even in the top 250 in March made the top 10 in April. Perennial winner AS4134 CHINANET-BACKBONE got pushed down to #1, spewing less than half the spam of AS12389 alone, and nowhere near the 80% of RoW top 10 spam from the eight Russian ASNs.

The CBL April RoW ranking does not have any Russian ASNs in its top 10, so whatever the cause, this time PSBL was more sensitive in detecting it.

22 April 2015: March 2015 Rankings
AS43391 NETDIREKT-TR surged mid-month and AS8685 DORUKNET sent more than a thousand times as much spam as last month in Turkey in March 2015, but couldn't approach the 2/3 of spam that AS9121 TTNET spewed. AS42910 SADECEHOSTING-COM and AS43260 DGN had smaller surges, both visible in the log graph.
9 March 2015: February 2015 Rankings
In Indonesia, Departemen Kesehatan's AS46034 had a bad couple of weeks then started to fix its spamming problem, still ending up #3. Two other ASNs followed a suspiciously similar pattern: #4 AS38783 SIMAYA-AS-ID and AS38165 ADSNET-AS-ID. Indonesian #1 spam sender TELKOMNET-AS2-AP's and #2 BM-AS-ID's volumes kept going up through the month. Indonesia moved up from #31 to #16 in the Countries ranking for February 2015.

In RoW, two ASNs from Germany, AS8560 ONEANDONE-AS and AS24940 HETZNER-AS, exploded spamming for the same week or so as Indonesia's Departemen Kesehatan. Germany moved up from #9 to #6 in the Countries ranking, ending up #1 in the last week.

15 February 2015: January 2015 Rankings
Ukraine made the top six twice, with AS25229 VOLIA-AS leaping from #52 to #1 and AS13188 BANKINFORM-AS from #58 to #4, pushing Vietnam down to #5 with AS45899 VNPT-AS-VN. Meanwhile, Russia came from below #250 to #9 AS41440 SIBIRTELECOM-AS, in the RoW rankings for January 2015.

In the Countries ranking Ukraine and Russia came in #1 and #2. Ukraine actually decreased spamming somewhat during the month, but Russia ramped up. This pair seems very interesting considering the war going on between those two countries. Is this some kind of online warfare? Or just spammers taking advantage of unrest?

31 January 2015: December 2014 Rankings
Ukraine surged in one week from below one million to more than 18 million spam messages a day, while Vietnam kept first place among countries, with three Vietnamese ASNs (VNPT, FPT, Vietel) in the RoW rankings for December 2014.

22 December 2014: November 2014 Rankings
Fascinating mid-month drops by Telefonica del Peru's AS6147 SAA and JSC Kazakhtelecom's AS9198 KAZTELECOM-AS, while the other eight went up. Apparently those two did something right about cutwail, while all the others did not.

25 November 2014: October 2014 Rankings
Colombia jumped to first place last week and third overall in the October 2014 Countries rankings, driven by AS13489 EPMTEL, AS10620 TVCABLE-AS, and AS3816 COLOMBIATEL, each rising at least a rank in the Latin America and Caribbean rankings, apparently infected by cutwail.

24 October 2014: September 2014 Rankings
PT. TIME EXCELINDO and Master Web Network improved drastically yet remained #1 and #2 in the Indonesian September 2014 top 10 rankings from CBL data, joined by four newcomers

12 September 2014: August 2014 Rankings
South Africa placed two of the top 6 and three of the top 10 in the AfriNIC August 2014 rankings from CBL data, plus Ghanatel and Ethonet joined the top 10. South Africa also placed three of the top 6 and four of the top 10 in the rankings from PSBL data.

13 August 2014: July 2014 Rankings
PT Time Excelindo's TELNET-AS-ID doubled down as #1 in the Indonesia top 10 for July 2014, towering above everything else in a mountain peak in the middle of the month on the graph. Master Web Network's MWN-AS-ID jumped up from #55 to #2. PT DES Teknologi Informasi's AS45302 DESNET-AS-ID fell out of the top 10, dropping 57 places by spamming more than 100 times less.

7 July 2014: June 2014 Rankings
Argentina's Prima led the new Latin American & Caribbean top 10 for June 2014, challenged by Peru's SAA and Mexico's Alestra.

Morocco's IAM led the new African rankings, but South Africa placed three times.


10 June 2014: May 2014 Rankings
Relizon spammed 600 times less, dropping from #1 to #62 in the Canadian top 10 spam for May 2014, while Bell Canada took back #1 and Shaw took back #2.


14 May 2014: April 2014 Rankings
TTNET's AS9121 spewed more than 2/3 of Turkish top 10 spam for April 2014, taking back #1 from Sadecehosting's AS42910, which still managed 1/5th. AS51559 NETINTERNET from #7 and AS34984 TELLCOM-AS from #11 joined the top 6. AS12840 TICARETNET improved, dropping from #5 to #6.


28 April 2014: March 2014 Rankings
Uganda Telecom is back, and GBXS-AS jumped from #18 to #3 in the Belgian top 10 for March 2014.


24 March 2014: February 2014 Rankings
Relizon won the Canadian top 10 for February 2014, with the same non-botnet that afflicts the world.


24 February 2014: January 2014 Rankings
9 new in the world top 10 for January 2014, all afflicted with the same non-botnet. Also, new pulldown selector rankings menu.


19 February 2014: Recompute Fall 2013
A format change in an ancillary data source detected through consistency checks caused recomputations in selected rankings for September, October, and November 2013. The old versions are preserved as v1 rankings, and the differences are visible for these overall rankings: *Sep BE CBL, *Sep BE PSBL, Sep CA CBL, Sep CA PSBL, Sep Countries CBL, Sep Countries PSBL, Sep TR CBL, Sep TR PSBL, Sep US CBL, Sep US PSBL, Sep World CBL, Sep World PSBL, Oct BE PSBL, Oct CA PSBL, Oct Countries CBL, Oct Countries PSBL, Oct TR CBL, Oct TR PSBL, Oct US PSBL, Oct World PSBL, Nov BE PSBL, Nov CA PSBL, Nov Countries CBL, Nov Countries PSBL, Nov TR PSBL, Nov US PSBL, Nov World PSBL, and these Medical rankings: Sep Countries CBL, Sep Countries PSBL, Sep US PSBL, Sep World CBL, Sep World PSBL. The specific cause was a change in the format of the daily Team Cymru data we use to map netblocks to ASNs.
9 December 2013: November 2013 Rankings
Telefonica del Peru Peru made number 1 worldwide while BELPAK of Belarus Belarus improved. Exponential-e of the U.K. U.K. had one really bad week yet improved the most over last month.
14 November 2013: October 2013 Rankings
Bell Canada Canada #1 and Shaw #2 moved in tandem, and yes, both show infection by Kelihos.
7 October 2013: September 2013 Rankings
Amazon jumped up from #25 to #3, but Rackspace climbed from #3 to #1, pushing Softlayer down to #2 for U.S. U.S. Rackspace spewed 20% of spam from this U.S. top 10, even though it dropped from 10 million to 300 a day by the end.

AS7296 ALCHEMYNET went the other way, from hundreds to almost a million spam messages a day by the end of the month, and from nowhere to #8. AS15085 IMMED-3 was almost as bad, from thousands to millions a day, and from #104 to #9.

Yet five dropouts all radically decreased their spam (Peer1 twice, Lunar Pages, The Planet, and Server Central Network). Congratulations!

6 September 2013: August 2013 Rankings
HostIT Hasselt spewed so much spam at the beginning of August it made #1 for Belgium Belgium even though it dropped to zero by the end. AS9166 HostIT Hasselt accounted for almost 2/3 of top 10 spam from Belgium, with EDPNET spewing another third. AS9031 EDPNET spewed the most in the middle, and got a bit of a grip by the end.

AS39318 NUCLEUS went to zero for much of the month, but started creeping back up at the end. AS9009 GlobalAXS got down below 100 for most of the month. Five dropouts that spammed from half a million to 8 million last month got down to less than 500 spam messages this month. Congratulations!

12 August 2013: July 2013 Rankings
July 2013 World World Medical Medical rankings from CBL Volume show how medical organizations these days pop up for a week and mostly pop back down. This is very different from before we started publishing medical rankings.

Back in April 2011 many medical organizations just kept spamming for weeks.

In the July 2013 rankings there are still several chronic spammers, including old-timer Korea Korean Konkuk University Hospital's AS38668, but even for that one the volume numbers are down by an order of magnitude. Medical organizations continue to be an example of reputational rankings having positive effect on underlying Internet security and outbound spam reduction.

3 July 2013: June 2013 Rankings
Belgium Belgium has a new top 4, spamming 96% of the top 10. #1 Netline SPRL jumped from 46 messages to 17 million. Also v2 rankings now go back to May 2012.
13 June 2013: May 2013 Rankings
Medyabim popped into the Turkey Turkish top 10 plus v2 rankings back to January 2013.
16 May 2013: April 2013 Rankings
OVH, Hanaro, and Strato at the top of world spamming. Rankings v2: more precise counts; slightly different order. Initially, we are only pubishing v2 for March and April 2013. In a few weeks we will publish the rest of the historical v2 rankings back to match the same months as the v1 rankings. Old v1 rankings will be kept online indefinitely for comparison, but all new rankings will be v2.
4 April 2013: March 2013 Rankings
AS 49879 HOSTHANE ISIK spammed enough in three days starting 26 March 2013 to make #4 spot for TR Turkey from CBL data. TTnet AS 9121 spammed about 30% less, yet went from #2 to #1. Our new #2, hosting company Adeox's AS 42055 TAMER, went from zero to more than 15 million messages.
5 March 2013: February 2013 Rankings
New ASNs churning worldwide; WIN BE keeps popping up in medical , plus new Catholic Health Initiatives US.
5 February 2013: January 2013 Rankings
Most worsened: AS 10297 COLUMBUSNAP US, from #91 to #6 worldwide in January 2013. Most improved: AS 48347 MTW-AS RU, from #8 to less than 250. Surprise entrant: AS 8685 DORUKNET TR. Still #1 for fourth month: AS 16276 OVH FR.
7 January 2013: December 2012 Rankings
Most worsened was AS 35908 VPLSNET, which didn't even make the top 250 last month but made #5 worldwide in December 2012. And it's a nostalgic return by old-time winner AS 7643 VN VNPT-AS-VN, already up to #4.
26 December 2012: Webserver outage 23-25 December 2012
The webserver outage for 23-25 December 2012 due to disk failure is fixed now, with a more robust solution. None of the internal processing computers were affected, and no data was lost.
10 December 2012: November 2012 Rankings
One ASN new in the top 10 wasn't even in the top 250 before, AS 26592 Dominio BR Consultoria em Informatica Ltda.
9 November 2012: October 2012 Rankings
The Kelihos rampage pushed many countries U.S. France Germany Hong Kong Italy Russia to the top of the world rankings.
10 October 2012: September 2012 Rankings

Four medical countries this month: Belgium Belgium was first at the beginning of the month, because WIN is back. Korea Korea shot up at the end of the month, because of Konkuk University Hospital's AS 38668 KONKUKHOSPITAL-AS-KR. Canada Canada came up from zero for a couple of weeks in the middle, due to eHealth Ontario's AS 21992 SSHA-ONE-ASN. Korea got really worse at the end of the month, but Canada also got worse.

Same four in PSBL rankings, and U.S. U.S. led both by a mile, as LSU Health Sciences Center - Shreveport lept to #1 with a two-week spam binge by its AS 18818 LSUHSCS-NET2, sending almost half of top 10 spam from medical organizations worldwide. Cleveland Clinic dropped to #2 in the CBL rankings, and JSIWMC also improved one rank.

5 September 2012: August 2012 Rankings
SAUDINet briefly sent less spam from Festi botnet but ended up #1 again, while India's National Internet Backbone steadily got worse. TTNET and KOCNET swapped places for the first time ever in Turkey and kept that country in the world top 3. Microsoft seventh time #1 in U.S. PSBL rankings! And Grum botnet is staging a comeback.
6 August 2012: July 2012 Rankings
/rankings/2012/07/01/monthly/world/volume/cbl/all/regular/Festi botnet pushed numerous ASNs to the top of their national rankings and the world, pushing India, Saudi Arabia, and Turkey to the top of the world. Also Microsoft #1 again in U.S. PSBL rankings.
10 July 2012: Rankings for June 2012
2(1)AS 36692 OPENDNS
3(-)AS 26769 BANDCON
4(-)AS 22414 CRAIGS-NET-1
5(-)AS 22822 LLNW
Beating even OPENDNS, Microsoft took #1 in U.S. PSBL June 2012 rankings.
7 June 2012: Rankings for May 2012
Seven snowshoers in the U.S. top 10 and only three ISPs. Plus Cleveland Clinic took #1 in worlwide medical rankings.
3 May 2012: Rankings for April 2012
Microsoft, world leader in Internet security, will doubtless clean up its spamming act when it sees its AS 8075 is #1 for outbound spam in the U.S. in rankings from PSBL data, pushing the U.S. to #1 worldwide.
5 April 2012: Rankings for March 2012
Snowshoe spamming pushed the U.S. to #1 worldwide in March 2012.
6 March 2012: Rankings for February 2012
Back again, AS 21788 NOC took the top in U.S. rankings, joined by seven newcomers. Something is amiss in the U.S.!
8 February 2012: Rankings for January 2012
PSBL data reveals three three-digit U.S. medical spamming organizations, plus CSHS, and CBL data confirms a big spam spike from CSHS.
11 January 2012: PSBL October 2011 data
Several known problems with PSBL October 2011 data collection, delivery, and processing caused PSBL volume for that month to be very low and spotty. We managed to process more data since then, and have marked every October ranking as:
No PSBL data 1-5 October or 25-31 24-26 and 30-31 October.
Corresponding changes for October and November rankings from PSBL data are marked with strike-through for deletions and underline for additions. Cleveland Clinic now turns up in October for world medical and U.S. medical, also now noted in the November world medical and U.S. medical rankings.
5 January 2012: Rankings for December 2011
India spammed most worldwide, while Bank of America topped one U.S. ranking, and CyberSURF peaked in Canada, but Cleveland Clinic cleaned up its act.
5 December 2011: Rankings for November 2011
Korea led the world in spam, Comcast got pushed to third in the U.S., yet spammed the most, and Cleveland Clinic and Sutter Health fell off the wagon.
21 November 2011: Country rankings
BRICs spam the world! China is only #13, but Brazil, Russia, and India (the other three BRICs) are in the top five countries by total spam messages for October 2011.
4 November 2011: Big Churn in the U.S.
Big churn in the U.S. this month included last month's winner vanishing, Comcast retaking the topspot but with only 2 out of the top 10, and colo AS 30058 joined in at number ten.
4 November 2011: Rankings for October 2011
Worldwide rankings were pretty stable, while there was big churn in the U.S. this month.
6 October 2011: Canada Stirred Up
Surprise winner Canaca-com's AS 33139 took first place in the September 2011 Canada CBL Volume rankings, while long-time winner Bell Canada's AS 577 dropped to fifth place.
6 August 2011: Medical Still Clean, But One
After the Big Drop of 14 July, all medical rankings stayed near zero, except for one; see World  World rankings.
4 August 2011: The Big Drop
14 July was the Big Drop for medical rankings. United States  US medical rankings all went to zero, and between 17 and 24 July, World  World medical rankings went from hundreds and thousands to near zero. There was no such effect in any other rankings than medical.
4 August 2011: July 2011 rankings
Comcast took five out of the top ten United States US rankings.
1 August 2011: Little tables
2AS 9208 WIN Belgium BE
Small tables at the top of each ranking for a quick overview, with just six lines of just AS numbers and names (no organization names or URLs). The More link next to each little table leads to the big table.
1 August 2011: Labels inside bars
More legible bar graphs by putting the labels inside the bars.
26 July 2011: Belgium BE & Turkey TR
Astonishing rankings similarities from CBL and PSBL data, even though CBL sends us 400 times as much volume. Not just Skynet's overwhelming and growing spam dominance in Belgium Belgium, but the next four or five ranks are the same. For and Turkey Turkey, the orders drop off so rapidly after TTNet that rankings from PSBL data don't match CBL in the lower orders, yet many of the same organizations appear in rankings from both blocklists.
6 July 2011: PSBL volume and June
Added PSBL blocklist volume rankings to the CBL blocklist volume rankings, and updated both for June data. The PSBL rankings are similar to yet different from the CBL volume rankings. That makes eight rankings per month, with more coming.
29 June 2011: Canada Canadian rankings
Added May, April, and March rankings for Canada Canada. Shaw was ahead in March, but Bell Canada has led since then, beating challengers such as iWeb.
21 June 2011: FAQ
Added Frequently Asked Questions (FAQ).
16 June 2011: Logarithmic scale
Look below any big line chart and you'll find a link to click to change to logarithmic charts, and back to linear. Log charts make it easier to see ASNs when they have low volumes.
9 June 2011: Added In the News
Getting some nice news coverage!
7 June 2011: Rankings for May
WIN in Belgium Belgium pulled ahead for May in the World global medical rankings, but Cedars-Sinai Health Systems in the United States U.S. shot up like a rocket at the end of the month, running away with first place for the final week. Cedars-Sinai looks set to recover the all-month leads it held in April and March.

In the all-United States U.S. rankings, 30217 DESYNC dropped to zero from 20 May on: most impressive! Even more impressive, 20228 PACNET-MX dropped from first place to zero from 12 May onwards.

May 2011: First rankings released
As goes public, the first rankings are for the World world and for the United States U.S.: all Autonomous Systems and medical ones.

Worldwide medical rankings for April 2011 show the top spamming Autonomous Systems (groups of IP addresses) as belonging to Cedars-Sinai Health Systems in the United States U.S., WIN in Belgium Belgium, and Konkuk University Hospital in Korea, South Korea. is all ears for feedback from ranked organizations.


Press Releases

In the News