One bot-infected PC = 600,000 spam messages a day
Rustock, Xarvester top the list as most efficient spam-spewing bots — Computerworld) Some bot-infected PCs can crank out as many as 25,000 spam messages per hour, new research released today claimed. — Orange, Calif.-based Marshal8e6 …
Context & Ripple Effects
Marshal8e6's new research puts a hard number on what a single hijacked Windows machine is worth to a spam operation: up to 25,000 messages an hour, roughly 600,000 a day, with Rustock and Xarvester identified as the most efficient senders in the wild. The finding extends a measurement arc that began when the Storm Worm was caught pushing 15 million pump-and-dump e-mails in October 2007 — the industry has moved from observing botnets' volume to pricing their per-node productivity.
Why it matters now is scale arithmetic: at these per-machine rates, even a modest botnet rivals legitimate bulk-mail infrastructure in output, which is why filter vendors and ISPs treat infection counts rather than message counts as the metric that matters.
First-order effects
- Rustock and Xarvester operators gain a benchmarkable efficiency claim — Marshal8e6's numbers give them (and defenders) a per-bot yield figure that will drive both takedown targeting and infection-value estimates.
- Owners of infected PCs are unknowingly supplying send capacity that, at 600,000 messages a day per machine, makes each compromised endpoint a meaningful piece of spam infrastructure rather than background noise.
Second-order effects
- Filter vendors and ISPs must respond to per-bot throughput this high by weighting reputation and sending-pattern analysis over content filtering alone, since volume from clean-looking residential IPs defeats keyword defenses.
- Antivirus and managed-security providers get a sales argument built on Marshal8e6's data — every enterprise endpoint left unpatched is quantifiable as potential spam capacity, tightening the link between hygiene spending and mail-reputation risk.
Third-order effects
- If per-node yields keep climbing, spam economics shift decisively toward renting infected machines by capacity, making botnet takedowns — not message filtering — the structural choke point for the mail ecosystem.
- The pattern points toward botnets as multi-purpose criminal platforms where the same infected fleet is monetized across spam, DDoS, and data theft, forcing security vendors to compete on detection of the fleet itself rather than any single abuse type.
The trend: Botnet research is shifting from measuring total spam volume to pricing individual infected machines as rentable send-capacity, with Rustock-class efficiency figures becoming the yardstick for takedown priorities.