Spammers get the upper hand: spam levels at all time high

Stuart Corner
Wednesday, 22 July 2009 08:23

IT Industry - Strategy

According to Marshal8e6's TRACElabs weekly spam volumes have broken the record set in July 2008, and have risen 60 percent since the start of 2008 with spammers having learnt how to minimise disruptions to their operations caused by the shutting down of one of their major botnets.

TRACElabs lead security researcher, Phil Hay, said that following the July 2008 the world had enjoyed a brief respite with the shut-down on 11 November 2008 of the rogue ISP network, McColo , which had been providing hosting services to some of the largest known spam botnets.

"The spammers are sending a clear message with this renewed spam activity," Hay said. After the shutdown of another rogue spam ISP, 3FN, in early June this year, spam volumes were temporarily affected with approximately a 15 percent dip. However, the spammers recovered almost immediately and have been pumping out the spam ever since. The clear message spammers are giving us is that they are unimpeded by the efforts of law enforcement and the security community.

"In fact, you could argue that attempts to disrupt the command and control servers of these spam botnets by closing down their host network providers has merely encouraged the spammers to develop more resilient systems. The spammers have learned much from the shutdown of McColo and have proven this with their almost immediate bounce back after 3FN was disconnected."

According to TRACElabs data, spam output is up across the board from the major spamming botnets. "The Rustock and Pushdo botnets continue to be very strong, and second-tier botnets like Grum have also increased their output helping to push spam volumes to the new high."

Phishing activity was also up significantly to 1.4 percent of all spam by volume representing a seven-fold increase in phishing activity during the month to July 19. Marshal8e6 says that, oddly, 99.5 percent of all phishing activity in the week to July 19 was aimed at just three organisations: eBay, Comerica and Bank of America.

More than 30 percent of all spam in the week came from Asian countries after Vietnam overtook traditional spam heavyweights China, Turkey and Russia for the first time. However, Brazil continues to dominate the TRACElabs spam statistics with over 15 percent of all spam, followed by the USA on 10 percent.