McColo

McColo was formed by a 19-year-old Russian hacker and student named Nikolai. Nikolai's nickname was "Kolya McColo"; hence the name of the provider.Carr, Jeffrey. Inside Cyber Warfare: Mapping the Cyber Underworld. O'Reilly Media, Inc., 2009, {{ISBN|0596802153}}, pg. 127.

At the time of termination of its upstream service on November 11, 2008, it was estimated that McColo customers were responsible for a substantial proportion of all email spam then flowing[https://www.theregister.co.uk/2008/11/12/mccolo_goes_silent/ McColo goes silent], The Register, November 12, 2008 and subsequent reports claim a two-thirds or greater reduction in global spam volume.[https://web.archive.org/web/20090708234916/http://voices.washingtonpost.com/securityfix/2008/11/spam_volumes_drop_by_23_after.html Spam Volumes Drop by Two-Thirds After Firm Goes Offline], Washington Post "Security Fix" blog, November 12, 2008 This reduction had been sustained for some period after the takedown.[http://bits.blogs.nytimes.com/2009/03/31/spam-back-to-94-of-all-e-mail/ Spam Back to 94% of All E-Mail], The New York Times "Bits" Blog, March 31, 2009 McColo was one of the leading players in the so-called "bulletproof hosting" market — ISPs that will allow servers to remain online regardless of complaints.

According to Ars Technica and other sources, upstream ISPs Global Crossing and Hurricane Electric terminated service when contacted by Brian Krebs and The Washington Post’s Security Fix blog,[https://archive.today/20120527042912/http://voices.washingtonpost.com/securityfix/2008/11/the_badness_that_was_mccolo.html A Closer Look at McColo], Washington Post Security Fix blog[https://arstechnica.com/news.ars/post/20081112-spam-sees-big-nosedive-as-rogue-isp-mccolo-knocked-offline.html Spam sees big nosedive as rogue ISP McColo knocked offline], Ars Technica, November 12, 2008 but multiple reports had been published by organizations including SecureWorks, FireEye and ThreatExpert, all naming McColo as the host for much of the world's botnet traffic.{{cite web|last1=Stewart|first1=Joe|title=The Return of Warezov|url=https://www.secureworks.com/research/warezov|website=SecureWorks|accessdate=25 February 2016}} [http://blog.fireeye.com/research/2008/10/mccolo-hosting-srizbi-cc.html#more FireEye] threat analysis[http://www.threatexpert.com/report.aspx?uid=745bcad4-9f9d-4a32-ba95-7cb7d5fc14f8 ThreatExpert] threat analysis[https://www.secureworks.com/research/warezov] threat analysis According to Joe Stewart, director of malware research for SecureWorks, the Mega-D, Srizbi, Pushdo, Rustock and Warezov botnets all hosted their master servers at McColo; numerous complaints had been made but McColo simply moved offending servers and sites to different subnets. Spamhaus.org reportedly finds roughly 1.5 million computers infected with either Srizbi or Rustock sending spam in an average week.

Following the shut down, details began to emerge of the ISP's other clients, which included distributors and vendors of child pornography and other criminal enterprises, including the Russian Business Network.[https://www.washingtonpost.com/wp-dyn/content/article/2008/11/12/AR2008111200658.html Washington Post], November 12, 2008

McColo gained reconnection briefly on November 19, 2008 via a backup connection agreement common in the industry, but was rapidly shut down again.[https://arstechnica.com/news.ars/post/20081119-mccolo-reconnect-highlights-network-security-gap.html McColo reconnect highlights network security gap], Ars Technica, November 20, 2008

The McColo takedown especially affected Srizbi, one of the world's largest botnets, controlling 500,000 infected nodes as of November 2008.[https://www.theregister.co.uk/2008/11/26/srizbi_returns_from_dead/ Srizbi returns from the dead], The Register, November 26, 2008

Symantec's monthly state of spam report for April 2009 stated that spamming was now back to what it was before McColo was taken offline. Due to botnets being created and old ones being brought back online, it estimated that about 85 percent of all email traffic is spam.[http://www.techradar.com/news/internet/spammers-recovering-from-mccolo-shutdown-591118 Spammers recovering from McColo shutdown][https://web.archive.org/web/20090424100315/http://eval.symantec.com/mktginfo/enterprise/other_resources/b-state_of_spam_report_04-2009.en-us.pdf State Of Spam for April 2009] By November 2009 the IP space used by McColo was still largely unused, as much of it was unattractive to buyers due to being widely blacklisted.

• Botnet
• Oleg Nikolaenko, whose arrest also reduced worldwide spam
• Rustock botnet, one of the largest spambots ever built
• Zombie (computer science)

• [https://web.archive.org/web/20080903220331/http://voices.washingtonpost.com/securityfix/ Washington Post "Security Fix" blog]

{{reflist|2}}

{{DEFAULTSORT:Mccolo}}

Category:Cybercrime

Category:Internet service providers of the United States

Category:Companies based in San Jose, California

Category:Companies disestablished in 2008