SpamRankings.net

Outbound spam rankings as a proxy for organizational security
Spam as a sneeze for infosec disease

See NSF Grants
1228990, 0831338
Home | Rankings Method | Glossary | About the Project | New and News | RSS | FAQ | Contact
News 24 July 2014: Anti-Spamming Website Helps Companies Cut Outbound Spam

Method of this Research Project

 

September 2014 Rankings: PT. TIME EXCELINDO and Master Web Network much improved but still #1 and #2 in Indonesia

   

Glossary

Mouse over the headers in the rankings for a brief explanation of terms.

The same terms, sometimes expanded, are defined here.

Autonomous System (AS)
A collection of netblocks owned by an organization. Here's a more detailed explanation from APNIC.

Autonomous System Number (ASN)
Numeric identifier used to identify an AS.

Blocklist
A collection of IP addresses known to send spam; blocklists are used to block spam. SpamRankings.net currently displays rankings derived from the CBL and PSBL blocklists.

Bot
A computer which has been broken into for use in a botnet.

Bot herder
A human who organizes a botnet.

Botnet
A collection of compromised computers (bots) which are controled by a bot herder who rents access to them for sending spam or other miscreant purposes.

CBL blocklist
The Composite Blocking List (CBL) is a major source of spam volume and host data for SpamRankings.net. CBL describes itself as:
“The CBL takes its source data from very large spamtraps/mail infrastructures, and only lists IPs exhibiting characteristics which are specific to open proxies of various sorts (HTTP, socks, AnalogX, wingate etc) and dedicated Spam BOTs (such as Cutwail, Rustock, Lethic etc) which have been abused to send spam, worms/viruses that do their own direct mail transmission, or some types of trojan-horse or "stealth" spamware, dictionary mail harvesters etc.”
See CBL for more information.

cbl
In the rankings menu, cbl indicates a volume ranking derived from CBL spam data.

cbl_h
In the rankings menu, cbl_h indicates a host ranking table derived from CBL spam data.

Host
ranking is the number of unique IP addresses observed for an Autonomous System observed sending spam for the indicated time period.

Incentive
Good reputation translates into retaining and acquiring customers, while bad reputation translates into losing customers. See also Spam and Reputation.

Organization
Any entity that owns an Autonomous System and sends email on the Internet. These rankings are actually by Autonomous System; an organization can own more than one AS.

Netblock
A chunk of contiguous numeric Internet addresses associated with an ASN and owned by an organization.

Population
Number of people.

PSBL blocklist
The Passive Spam Block List (PSBL) is a major source of spam volume data for SpamRankings.net. PSBL describes itself as:
“An easy-on, easy-off blacklist that doesn't rely on testing and should reduce false positives because any user can remove their ISP's mail server from the list.”
See PSBL for more information.

psbl
In the rankings menu, psbl indicates a volume ranking derived from PSBL spam data.

psbl_h
In the rankings menu, psbl_h indicates a host ranking derived from PSBL spam data.

Rankings
SpamRankings.net uses outbound spam data to derive rankings of Autonomous Systems of similar organizations, to produce peer reputation. A menu of rankings may be found on the left of the home page. Since April 2013 rankings version 2 (rankv2) have been the default. The older rankings version 1 (rankv1) are no longer published after April 2013.

Rankv1: Rankings version 1
Version 1 of these rankings (retired after April 2013) used a static snapshot of mappings from netblocks to ASNs derived from Team Cymru data. See Rankv2.

Rankv2: Rankings version 2
Version 2 of these rankings (the only version after April 2013) uses daily mappings from netblocks to ASNs derived from CBL and Team Cymru data.

Reputation
Organizations that rank well will want to brag; those that don't will want to change. See also Spam and Reputation.

Spam
Unsolicited bulk email, mostly sent by botnets.

Team Cymru
Team Cymru Research NFP is “a specialized Internet security research firm and 501(c)3 non-profit dedicated to making the Internet more secure.”

Volume
is the total number of spam messages observed coming from all the IP addresses for an Autonomous System for the indicated time period.

Volume/ 1000pop.
Volume divided by population in thousands.

Vol%
Volume as a percentage of the total volume in this ranking.