In early August, a number of very well-known social networking websites were reported to be victims of distributed denial of service (DDoS) attacks. The attacks appear to be linked with a “Joe Job” style spam run against an anti-Russian blogger. A “Joe Job” is a spam technique that spoofs the From: email address using a real email address (i.e. an unsuspecting victim) to make it appear as though that person was responsible for the email.

The spam run, as far as MessageLabs Intelligence can determine, was estimated at less than one percent of all spam at that time and distributed from a currently unclassified botnet. The run was significantly smaller compared with some of the more recent spam runs, such as the URL-shortening attacks from Donbot.  

Although it is presumed that this spam run contributed to the DDoS attacks on these social networking websites, it is unlikely that this run alone could have caused all the reported disruption,...

Real Host, an ISP based in Riga, Latvia was alleged to be linked to command-and-control servers for infected botnet computers, as well as being linked to malicious websites, phishing websites and “rogue” anti-virus products.  Real Host was disconnected by its upstream providers on 1 August 2009. The impact was immediately felt, as can be seen in Figure 1, where spam volumes dropped briefly by as much as 38% in the subsequent 48-hour period. 

Much of this spam was linked to the Cutwail botnet, currently one of the largest botnets and responsible for approximately 15-20% of all spam. Its activity levels fell by as much as 90% when Real Host was taken offline, but quickly recovered in a matter of days.

Figure 1 shows the relative proportion of spam originating from the five major botnets globally during the period of this attack: Cutwail, Xarvester, Rustock, Mega-D, and Donbot. The scale used is a relative index based on the relative volumes and...

Spam: In August 2009, the global ratio of spam in email traffic was down by 0.9% from the previous month at 88.5% (1 in 1.13 emails).

Hong Kong was the most spammed country in August although levels fell by 0.8% to 93.4% Spam levels in the US and Canada rose to 89.5% and 88.7% respectively. The majority of other countries saw a decline in August with levels in the UK falling to 91.6%, Germany to 90.4%, France to 90.7%, and The Netherlands to 86.3%. Levels in Australia and Japan declined to 90.6% and 89.2% respectively.

Anti-Virus and Trojans: The global ratio of email-borne viruses in email traffic was 1 in 296.6 emails (0.34%) in August, almost unchanged since July.

In August, 14.8% of email-borne malware contained links to malicious websites, a decrease of 0.4% since July. Spoofed...