
With that in mind, of course, the numbers in real life would be lower, because not all receiving servers would be working correctly, and not all email addresses would be valid. In other words, the spam was constructed and sent on its way, but then trapped and measured instead of being delivered to its real destination. However, the messages weren’t allowed past a special dead-end server that was blocked off from the internet. SophosLabs in Hungary decided to find out, using a carefully-configured “honeybot” that would receive spamming commands from its botmasters, generate spam messages, and send them out. 10,000 computers sending 10,000 spams each will typically finish faster than one server sending 100,000,000 spams.īut just how much spam can a botnet send in real life? You also carry the risk of being blocklisted by your ISP, because you’re the only publicly visible email step in the spam sending chain. The crooks pay nothing for their bandwidth. Even if half of the zombified computers are cleaned of malware, the other half keep going. The crooks enjoy many benefits from using other people’s computers to send spam, namely:

(Audio player above not working? Download, or listen on Soundcloud.) If you want to send spam but you don’t have a botnet of your own, you can rent time on someone else’s, using the CaaS (crimeware-as-a-service) model. → The collective noun for a group of bots is a botnet, short for “robot network.” The cybercrooks that runs a botnet are known as botherders or botmasters. That’s because spammers don’t just use a bot here and a bot there to send unwanted emails, they use a whole collection of bots at the same time (typically tens of thousands or more), for truly distributed spamming power.


We write about bots, also known as zombies, fairly frequently on Naked Security. Attila came up with the idea for, and conducted the research used in, this article. Thanks to Attila Marosi of SophosLabs in Hungary.
