Net closes on world's 3rd biggest spambot

Richard Towey

20 Jul 2012

A US intelligence lab has announced that seven servers for 'Grum', the world's 3rd biggest botnet, have been taken offline.

FireEye Malware stated earlier this month that its team were closing in on the spamming device. Now, after three days of battling with Grum, internet users can now officially look forward to cleaner inboxes.  

FireEye used figures from a spam-tracker to highlight the influence carried by Grum, which was once responsible for 17 per cent of the world's email spam.   

"According to data coming from Spamhaus, on average, they used to see around 120,00 Grum IP addresses sending spam each day, but after the takedown, this number has reduced to 21,505. I hope that once the spam templates expire, the rest of the spam will fade away as well," the company said, in amongst a blog post cited by gmanetwork.com.

The news is expected to be welcomed by office workers around the world, but email marketing companies may also be pleased to hear of their competition being heavily reduced.  

According to csoonline.com, Grum was being deployed by five servers in Panama and the Ukraine, with Netherlands hosting the other two. Most of the messages sent out were advertising Rolex watches and viagra.

The battle isn't quite over just yet, though. Grum's master server and one additional command-and-control server is reportedly located in Russia - the headquarters of its controllers, according to FireEye researcher Atif Mushtaq.