Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.
Security Response

Rustock Takedown’s Effect on Global Spam Volume

Created: 21 Mar 2011 17:39:49 GMT • Updated: 23 Jan 2014 18:22:00 GMT • Translations available: 日本語
Eric Park's picture
+1 1 Vote
Login to vote

When Brian Krebs posted a report about Rustock botnet takedown, Symantec observed a decline in overall spam traffic. posted a blog about this, and the Wall Street Journal is now reporting that Microsoft led this takedown.

On March 16, Symantec saw global spam drop 24.7% compared to March 15. On March 17, global spam volume dropped another 11.9% compared to March 16. Compared to a week prior, the volume on March 17 was down 40.4%.

As we typically see with a drop in global spam volume, the overall spam percentage saw a similar decline when spam volume fell. The increase seen on March 19 and 20 can be attributed to a weekend anomaly when the spam percentage is typically higher than on weekdays.

Symantec has kept a close eye on spam volume since Rustock temporarily ceased activity back in December. When Rustock, along with two other botnets, “fell asleep” on December 26, we saw a big decline in spam volume. The chart below shows the percentage decline in global spam volume using the trigger event as a baseline. While the fate of red line (representing current volume) remains to be seen, it looks to be mirroring the drop we saw back in December.