Top 5 Spam Botnet "Crippled" but Still Kicking

Posted 09/01/2010 at 7:31am | by Paul Lilly

8

Comments

Print

One of the world's largest botnets responsible for as much as 10 percent of all spam suffered a temporary setback this week when several ISPs took action by unplugging infected servers, according to security firm M86 Security.

Known as the Pushdo or Cutwail network, this top 5 botnet specialized in sending out spam for fake AV software, designer goods, and pharmaceutical products, said Ed Rowley, product manager for M86 Security. But for the next couple of weeks, you can expect less of these emails in your inbox.

Security experts with the security company LastLine took it upon themselves to start contacting ISPs found to be hosting the command-and-control infrastructure of the botnet. All told, there were about 30 servers at 8 different ISPs keeping the botnet alive, 20 of which have since been taken offline.

According to Rowley, LastLine's efforts "will almost certainly have a positive effect for two to three weeks," but "the spammers will be able to find other hosting providers where they will be able to get their systems up and running."

Maybe sooner. Leaving at least 10 servers online is a major concern, as Pushdo is capable of generating random domain names, which can then be registered and activated.

Image Credit: Trend Micro