Home » Data Protection » Network Security

News

Accused of Tolerating Scammers, an ISP Goes Dark

Internet service provider Intercage has been knocked offline after being linked with malicious Web sites

By Robert McMillan, IDG News Service, San Francisco Bureau

September 23, 2008 — CSO —

The lifeline linking notorious service provider Intercage to the rest of the Internet has been severed.

Intercage, which has also done business under the name Atrivo, was knocked offline late Saturday night when the last upstream provider connecting it to the Internet's backbone, Pacific Internet Exchange, terminated Intercage's service.

Intercage president Emil Kacperski said Pacific did not tell him why his company had been knocked offline, but he believes it was in response to pressure from Spamhaus, a volunteer-run antispam group, which has been highly critical of Intercage's business practices. A spokesman for Pacific could not immediately comment on why the company terminated Intercage's service.

Spamhaus placed Pacific on its Spamhaus Block List on Sept. 12, after it began peering with Intercage, said Spamhaus CIO Richard Cox.

The Spamhaus list of untrusted Internet addresses is used to filter unsolicited e-mail from about 1.5 billion e-mail boxes, so being added to the list would almost certainly have caught Pacific's attention. "Obviously they were feeling the displeasure of the rest of the Internet," Cox said.

According to security researchers, there was a lot to be unhappy about.

Last month, a team of cybercrime experts published a white paper on Intercage, slamming the San Francisco company as a "major hub of cyber crime." The researchers found that 78 percent of the domains and mail servers on Intercage's network were hostile.

Intercage's Kacperski had ignored complaints about illegal activity on its network for the past five years and only recently began to respond to problems, said Matt Jonkman, an independent researcher who contributed to the white paper. "His network was used for very clearly hostile criminal activity," he said. "I'm not aware of any legitimate customers."

In recent weeks other upstream providers terminated Intercage's service, but Pacific had stepped in at the last minute to keep the company online.

Kacperski said his company had been making efforts to remove bad operators from its network and be more responsive to complaints, but that it was not enough to keep Pacific from ultimately dropping Intercage.

Spamhaus reports more than 350 cybercrime hosting incidents on the Intercage network over the past three years.

After years of complaints, the Internet community did something that law enforcement had been unable to do: knock Intercage offline, according to Paul Ferguson, an advanced threats researcher with security vendor Trend Micro.

"This was just a situation ... that apparently went on for too long without being properly addressed," Ferguson said via e-mail. "The community seems to take upon itself the necessary actions to purge these sorts of issues when all other efforts fail."