Postini: Spam up again following McColo takedown
It has taken spammers only four months to get their botnets back up after hosting company McColo Corp. was shut down, according to statistics due to be released on Tuesday from Google's Postini e-mail security provider.
Context & Ripple Effects
The November 2008 shutdown of hosting firm McColo Corp. briefly collapsed global spam volumes by cutting off the command infrastructure for several major botnets — the first time a single upstream provider action had visibly moved worldwide spam levels.
Postini's new statistics show how temporary that relief was: within four months spammers had rebuilt their botnets, with syndicated coverage putting spam back at roughly 94% of all e-mail. The rebound follows a late-2008 stretch in which spam had already been climbing while Google's CAPTCHA defenses faltered, and it lands amid ongoing researcher efforts such as the Storm Worm hijacking used to track botnet profits.
First-order effects
- Mail administrators and filtering vendors like Postini lose the post-McColo reprieve and must absorb spam volumes returning toward pre-shutdown levels.
Second-order effects
- Upstream hosting providers come under renewed scrutiny over which customers they will carry, since the McColo takedown showed a single host's cleanup can dent global spam — but only until spammers relocate.
Third-order effects
- If every takedown is followed by this kind of rebuild cycle, anti-spam strategy shifts structurally away from one-off infrastructure strikes toward continuous layered filtering, with each future botnet disruption measured against the McColo baseline.
The trend: Botnet-driven spam is proving resilient to infrastructure takedowns, turning spam defense into a recurring arms race between hosting cleanups and rapid botnet relocation.