DDoS knocks anti-spam sites offline

Several anti-spam organisations have been targeted by an attempt to knock them offline, according to the SANS Institute.

SANS' Internet Storm Center (ISC) said a "pretty big" distributed denial of service (DDoS) offensive had targeted several high-profile organisations, including Spamhaus, SURBL (Spam URI Realtime Blocklists) and URIBL (Realtime URI Blacklist).

Rules Emporium, a site hosting rules for the open source SpamAssassin anti-spam program, was also offline, and may have been targeted as well, according to ISC handler Bojan Zdrnja.

As of Monday, Rules Emporium and URIBL were still not reachable, while Spamhaus and SURBL appeared to have recovered.

"It looks like some anti-spam groups managed to get the attack(s) under control, let's hope the things will stay that way," Zdrnja wrote.

Denial of service attacks are a routine risk for anti-spam groups, but the current attack is similar to those carried out against Blue Security just over a year ago using botnets controlled by the Storm malware, according to SANS. The attacks caused Blue Security to exit the anti-spam business.

The ISC's Zdrnja suggested that such attacks may be a good sign for the effectiveness of anti-spam tools.

"Spammers seem to be desperate when they launch DDoS attacks, otherwise they would just keep sending spam, instead of using their resources this way," he wrote.