According to Cisco, anyhow (read the CBC story). But how could this be true? Most Canadian ISPs have already blocked port 25 (read: Telus, Bell, Rogers, Shaw to name the largest). With port 25 blocked, the only way to spam through most Canadian broadband subscriber networks is to relay the email traffic through other mail services that permit authenticated outbound email traffic. And if a relay is being used, then the relay’s IP address should really be considered as the source of the spam.
I speculate that Cisco is analyzing not just the connecting IP address to identify spam sources, but is also looking at the Received: headers to identify the IP addresses of machines sending spam via other mail servers. Because almost every ISP provides an outbound relay for authenticated users, perhaps the spammers have simply found a cozy haven in the basements of millions of Canadians from which to exploit and abuse these outbound relays.
What are you seeing out there?