There was a minimal relief for internet users earlier this month regarding spasm due to shutting down of McColo, the web host on November 13th. This action was taken following its involvement with a series of botnets.
This company is based in San Jose and about 70% of spam throughout the world is hosted from here including Srizbi botnet, one of the major spam players. Botnets are not giving up as easily as expected as we can see a rise in the numbers again after a reprieve of two weeks.
Symantec-MessageLabs’ Matt Sergeant says levels of spam has alarmingly risen in capacity recently to a whopping 37% of its original numbers. At this rate, he says it is just a matter of another couple of weeks for the level to reach back the original if not more.
After the McColo was shut down, Srizbi, the creators of this malware was thought to be defunct. However, it seems they are one step ahead in plans. All they had to do was to procure a new bandwidth or a host provider. Machines that are infected are effectively intercepted and re routed to a location in Estonia where the command center is. Spyware authors have created this ingenious “rescue zones” all over the Internet. Distribution of spam is thereby revived almost instantly.
While it is relatively easy to identify and shut down a hosting company in the United States, doing this at the other end of the world is a different matter altogether.
