Zombie IPs boost spam, malware levels

GajShield has unveiled its Q2 2008 e-mail threat trend report, in collaboration with Commtouch. The study revealed that spam and malware levels remained high this quarter, powered by the brawny and agile network of zombie IP. Botnets dodged defenses and polluted the Internet with all kinds of e-mail threats by operating millions of dynamic IPs everyday.

Spam levels throughout the second quarter averaged 77 percent, ranging from a low of 64 percent to a peak of 94 percent of all e-mails towards the end of the quarter. 10 million zombie IP addresses are active each day, on average; pharmaceutical spam is the most popular topic, comprising 40 percent of all spams. Phishing scams took advantage of the higher education community, as well as Google adwords users and spammers experimented with vertical display in Chinese-language spam.

The major spam topics witnessed in Q2 were pharmacy: 46 percent, pornography: three percent, sexual enhancers: 22 percent, software: two percent, replicas: 21 percent, loans/mortgage: two percent, academic degrees: three percent, others: one percent.

On an average, nearly 10 million zombie computers actively sent spams and e-mail based malware everyday during Q2; the vast majority of the IP addresses were dynamic, meaning that they were taken in or out of use at the will of the botmaster controlling them allowing continuous delivery of malicious material across the Internet. By the time the traditional security solutions identify and block the threat, the botmaster easily deactivates them and switches to another set of IPs under his control.

An outbreak that began mid-May featured promising love-themed subjects and messages. The body of the e-mail contained IP-address based URLs that delivered a malicious 'iloveyou.exe' executable file. Similarly romantic subjects lured users to open an e-mail message containing a link to download a version of the notorious storm malware, known by the monikers Zhelatin or Nuwar.

The trends of spams came through tax-related spam messages, pharma spam embedded in Microsoft content. Blogging platform Blogspot was one of the first to be exploited to host and distribute malicious content, pump-and-dump stock spam, vertical text Spam using tricks available with HTML tables.

UPTM appliances deploys multi-layered defense to preemptively stop sophisticated threats such as spams, phishing, pharming and zombie attacks. Customers can realize significant savings from network bandwidth, server storage and IT costs, as well as an overall improvement to the throughput of messaging systems.