ISP shutdown sends spammers scrambling

By Robert Westervelt | Jun 9, 2009

1 comments

Facebook

LinkedIn

Digg

Some spammers are scrambling to find a new ISP to host their botnet command-and-control servers and resume spam campaigns as a result of the Federal Trade Commission's action to take 3FN.net offline.

The court action disrupted some spam bots and caused a dip in global spam levels, according to security vendors that track global spam volume. But security experts warn that any disruption will be temporary as cybercriminals find new ISPs to do business.

Investigators have linked 3FN.net to at least 17 botnet command-and-control servers that are used by spammers to send out millions of spam messages in bulk. The Cutwail botnet was linked to at least one command-and-control server hosted by 3FN.net. Cutwail picked up a lot of Srizbi botnet customers when it was disrupted by the shuttering of San Jose-based Web hosting service provider McColo late last year. At its peak in May, Cutwail represented 35% of all spam globally. Shortly after the shutdown last week it was reduced to 8% of all spam globally, according to Symantec's MessageLabs.

Other vendors are reporting the same dip. Marshal8e6's TRACElabs reported today that it observed a 15% drop in their spam volume index. But security experts say the shutdown will only be a temporary setback for cybercriminals, who will move Cutwail and other spambots to new ISPs and resume operations.

"What happens is you take out one of the big boys and somebody will take over those customers and start spamming for them," said Matt Sergeant, senior antispam technologist for MessageLabs. "[Cutwail] dropped briefly after 3FN was taken down and some of the connectivity around the botnet was taken out, but since then it has really managed to find a way to recover and started spamming again."

For about eight hours following the shutdown of 3FN.net, Cutwail fell silent, but since then it has regained its footing and is currently operating at about 50%, Sergeant said.

"There's some issue that they're trying to resolve, but Cutwail is certainly not quite dead yet," Sergeant said.

1 comments

Facebook

LinkedIn

Digg