Rustock Takedown’s Effect on Global Spam Volume

When Brian Krebs posted a report about Rustock botnet takedown, Symantec observed a decline in overall spam traffic. posted a blog about this, and the Wall Street Journal is now reporting that Microsoft led this takedown.

On March 16, Symantec saw global spam drop 24.7% compared to March 15. On March 17, global spam volume dropped another 11.9% compared to March 16. Compared to a week prior, the volume on March 17 was down 40.4%.

As we typically see with a drop in global spam volume, the overall spam percentage saw a similar decline when spam volume fell. The increase seen on March 19 and 20 can be attributed to a weekend anomaly when the spam percentage is typically higher than on weekdays.

Symantec has kept a close eye on spam volume since Rustock temporarily ceased activity back in December. When Rustock, along with two other botnets, “fell asleep” on December 26, we saw a big decline in spam volume. The chart below shows the percentage decline in global spam volume using the trigger event as a baseline. While the fate of red line (representing current volume) remains to be seen, it looks to be mirroring the drop we saw back in December.