Slashdot Mirror


Most Spam Comes From Just Six Botnets

Ezhenito noted some research pointing out the (maybe) surprising bit of research that 6 botnets are responsible for 85 percent of the world's spam. That seems a bit high to me, but the only aspect of spam I am an expert in is *getting* it.

2 of 268 comments (clear)

  1. Most Spam Comes from just Six Bots, not Botnets by Aaron+Isotton · · Score: 5, Informative

    What TFA says is that most Spam comes from the following six types of Bot:

    Srizbi: 39%
    Rustock: 20%
    Mega-D: 11%
    Hacktool.Spammer: 7%
    Pushdo: 6%
    Storm: 2%
    Other: 15%

    This doesn't necessarily mean that most spam comes from six botnets. Some of the bots could be used by multiple bot masters; OTOH some botmasters could control multiple botnets using different bots.

    Something else I just thought of:

    The botmasters are going to use the best bot available, i.e. the one enabling them to send most spam at the least cost. On the other hand, the "good guys" are fighting spam (and the bots). So whenever a certain bot starts taking over (currently Srizbi) all the good guys will focus on that one and try to shut it down. So the bot decreases in value and another, better bot will take over. Evolution at its best.

    The Antivirus companies which are trying to fight the malware are also trying their best. The big difference is that while the success of a spambot can be easily measured by the customer (i.e. the botmaster), the success of an AV product is much harder to estimate. Also, the typical AV customer doesn't have the ability/time to find out which AV product is best for him. Moreover, AV products are some sort of subscription service (you buy the package and get 1 year of updates) which makes it hard to switch products. Often AV products are bundled with computers, selected by business principles and not by technical superiority.

    In other words, the evolution process of malware is far superior to the one of AV products.

  2. Re:How much spam do you actually get? by Tacticus.v1 · · Score: 5, Informative

    I just checked this and i think you got the address round the wrong way.

    you need to put it john38+temp@gmail.com for it to work as the other way round just goes to the wrong address