Tracking Spam Botnets

At M86 Security Labs we undertake research aimed at providing our customers with optimum anti-spam protection. Part of this research involves understanding the origins of spam, and particularly botnets which are the engines used to distribute most spam today. We have developed algorithms and processes which track spam according to the botnet it was sent from. It is an ongoing challenge, as the spamming botnets are constantly in flux. Botnets morph, become obsolete, replaced, taken down, and upgraded. One thing is clear, a mere handful of botnets are responsible for the bulk of all spam sent. This page pulls together some of the results of our latest research, highlighting details about some of the most notorious spamming botnets.

Statistics for Week ending January 29, 2012

Spam by Spambot Type

This chart is a percentage breakdown of spam received at our spam traps for each spambot type. Typically a small number of major botnets are responsible for the bulk of all spam.

Spambot Activity Over Time

This chart shows the history of spam received from each spambot type, as a percentage of total spam received.

Spambot Details

To learn more about the botnets we track, refer to the following list. Our references include aliases, features, command and control, and behavior on host. We hope this information will help researchers to better identify and target the malware behind these botnets.

		Festi
		Lethic
		Bagle
		Asprox
		Waledac
		Bobax
		Pushdo
		Srizbi
		Donbot
		Rustock
		Grum
		Gheg
		Mega-D
		Xarvester