Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC: Spam Cannons on Holiday - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Spam Cannons on Holiday

The data never lies and always tells a story.   Brian Krebs wrote on his blog last week about the decline in spam and his speculation of what has become of the dormant bot nets that get used for delivering spam to the world.  There was a clear reprieve in spam deliver over the 2010 year end holiday season for various reasons. shows a decisive break in spam delivery that resumed action late Sunday.  

Well, we wanted to share with you some corresponding DShield data.  The graph below shows unwanted connections, which should be a good sample representation of infected systems.  There is a slight dip which can be attributed to the holiday season or a "weekend drop" type of decline.  It does not indicate spam cannons have been replaced by more lucrative malicious channels, nor have the bot nets taken a break either.   




Kevin Shortt 
ISC Handler on Duty


Kevin Shortt

85 Posts
ISC Handler
Jan 12th 2011
I have to wonder how much of the drop is simply from millions of people turning their (infected) computers off over a week of Christmas vacation. Surely the daily flutter is due to spambots being turned off at night?

5 Posts
I would think that more people would be home during the holidays and therefor more likely to be sitting on the computer, which should make spambots more prevalent.

I was thinking maybe students not being at school. Because we all know how clean school networks are.

69 Posts
I have to say that I have been getting huge amounts of spam for the past few days.

43 Posts

Sign Up for Free or Log In to start participating in the conversation!