SANS ISC: Spam Cannons on Holiday

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

The data never lies and always tells a story.   Brian Krebs wrote on his blog last week about the decline in spam and his speculation of what has become of the dormant bot nets that get used for delivering spam to the world.  There was a clear reprieve in spam deliver over the 2010 year end holiday season for various reasons.  SpamCop.net shows a decisive break in spam delivery that resumed action late Sunday.  

Well, we wanted to share with you some corresponding DShield data.  The graph below shows unwanted connections, which should be a good sample representation of infected systems.  There is a slight dip which can be attributed to the holiday season or a "weekend drop" type of decline.  It does not indicate spam cannons have been replaced by more lucrative malicious channels, nor have the bot nets taken a break either.   

• Spam Cop Statistics Page
• Brian Krebs - Blog Entry on Spam