When researchers deliberately infected computers with spam-generating malware in order to study malware activity, they have observed that some of these bot spammers can launch 25,000 spam messages in an hour. During the test conducted in TRACElabs, personal computers were infected with malware that created nine of the biggest spamming botnets in the world. The behaviors of these machines were closely monitored, and among the statistics recorded was each bot's maximum spam output
Phil Hay, a senior threat analyst working for TRACElabs, is trying to emphasize through this research that a few key botnets play a very huge role in the transmission of spam throughout the Internet. The findings of this research show that Rustock, and Xarvester – likely related to the Srizbi botnet, are the most prolific spammers among the nine bots tested. Both of them can send 25,000 spam messages per hour – which when sent continuously amounts to 4.2 million messages a week.
A botnet called Mega-D follows the previous two in terms of effectiveness and was one of the bots who took advantage when McColo Corp., a hosting company tied with crucial Srizbi and Rustock botne hosting, was taken down back in November. When McColo was shut down as a result of investigation into botnets, spam messages were greatly reduced as essential control hosting was essential for those controlling the botnets to instruct the infected machines in the botnet. The botnet levels had since returned to earlier levels from before McColo’s creation and bot controllers have tried to regain former infected machines, while some unaffected machines have since been integrated to other botnets.
More well-known malware such as Waledace placed surprisingly low on TRACElabs' research. While Waledac, a successor of the infamous Storm bot from 2007, has hit the news when it was discovered to be installed by Conficker-infected machines. But according to figures from TRACElab, Waledac can only churn out around 7,000 messages per hour – a far cry from the top scores.
Rustock was still responsible for 26% of all spam created during 2009's first quarter. Mega-D and Pushdo were at 22% and 18% following Rustock. Xarvester placed fourth, making up only 8% of all spam. However, during the height of Srizbi prior to the closing of McColo it has been known to be capable of delivering 60 billion spam messages a day. |