Huge drop in spam as McColo closes

November 14, 2008 // 1:23 p.m.

Tags: #brian-krebs #hurricane-electric #mccolo #spam

If you've noticed that your spam load has been a little lighter of late, you've got one company to thank for it: McColo, a spam-friendly hosting company that shut down early this week.

While you might not think that a single company could be responsible for too much of the Internet's sewage, you'd be surprised: according to figures from security vendor MXLogic quoted by CNet world spam volume is down by approximately 50 percent – all from that one host.

Benny Ng, marketing director of McColo's main upstream provider Hurricane Electric, is credited with pulling the plug on the company's main source of bandwidth – although why it took him quite so long is another matter entirely.

Much of the investigative work that resulted in the spam sewer being plugged was performed, perhaps surprisngly, by Brian Krebs of the Washington Post. Krebs claims that the company, which was hosting command and control servers for hordes of virus-infected Windows machines worldwide, could be responsible for the co-ordination of up to 75 percent of all spam.

While that figure might be a little on the high side, anti-spam outfit IronPort claims that the McColo shutdown resulted in “a drop of almost 2/3 of overall spam volume, correlating with a drop in IronPort's SenderBase queries” - a dip the company initially thought was due to a technical problem.

Sadly, the reprieve is likely to be temporary: IronPort's Nilesh Bhandari says his company is seeing a “slow recovery” by the spammers as they relocate the botnet servers to new hosts, and his company “fully [expects] this to recover completely, and to go into the highest spam period ever during the holiday season.” The message is clear: enjoy the quiet while it lasts.

Have you noticed a drop in your own personal spam feed, or have the pill pushers and porn merchants been as busy as ever making sure you don't miss a single shill? Share your thoughts over in the forums.

QUICK COMMENT

View this in the forums

SUBSCRIBE TO OUR NEWSLETTER

WEEK IN REVIEW

TOP STORIES

SUGGESTED FOR YOU