Sudden spam drop leaves experts baffled

Spam volumes appear to have dropped to averages last seen in 2008 after an expected surge in bogus email over the Christmas period failed to materialise.

Estimating real spam volumes is a notoriously difficult exercise thanks to a tendency of spam to naturally ebb and flow over time and the fact that no agency has a single view on the phenomenon. However, figures revealed in recent weeks by a number of companies that have compiled stats make curious reading – every vendor’s figures show a fall of some sort.

According to Cisco’s IronPort SenderBase, spam volumes for 2010 peaked in late summer before dropping by around a third month-on-month between September and December. The total volumes were also noticeably lower in November and December than they had been for any month during 2010.

Over at Commtouch, after a year-high spike in September, spam volumes fell by around 30 percent between September and December 2010, mirroring a fall in the number of zombie PCs detected by the company during the same period.

According to UK-US outfit M86 Security, its spam volume index measured using honeypot domains fell by as much as half during December when compared to the numbers for the spring and summer.

None of the vendors’ numbers showed the expected surge in spam over the Christmas period, traditionally a time when spammers boost their output.

As yet, no security company has come up with a reason for the fall, which is larger than the fall registered in late 2009, but still modest compared to the historic plunge that happened in late 2008 after rogue ISP McColo was shut down.

Given that no large ISPs or botnets have been shut down in the corresponding period, it could simply be a seasonal lull. It could also mark a change in tactics by spammers towards using channels other than conventional email, such as social media, to reach computer users. According to a report by Websense in November, noted a marked rise in spam on Facebook and Twitter with as much as 10 percent of status updates on the former containing spam.