5

I always wondered the following: how do infected computers send emails? I read all the stories of large botnets sending 1-2 billion emails a day. When I use the SMTP server of my ISP and I try to send my newsletter to less then 100 people my ISPs SMTP server blocks. I tried to do this by multiple friends (with all different ISPs) and it was all the same. But how can these bonnets produce such a large volume of email when I cant even send 100?

Thanks in advance, Jori.

Jori
  • 1,122
  • 2
  • 18
  • 36
  • I don't know how they abuse the system, but a botnet is more than one computer in many different locations. So they are not in the same situation as you trying to send out your newsletter. – Amicable Jun 27 '12 at 09:07

2 Answers2

2

They are not trying to abuse the system, they only sent small amount of mail. But if you have (just an unreallistic example) 10k computers infected, each sending 25 mails every hours. You end up with 10k * 25 * 24 = 6 000 000 mail/day.

After that, you just have to scale that 3 numbers and you can have a massive spam bot. You can take a look at this article in wikipedia for example of sizes and capacities.

Mualig
  • 1,444
  • 1
  • 19
  • 42
0

I'm not sure, but I could imagine the zombies don't (only) use the SMTP server your ISP provides but directly connect to the recipients SMTP server or some other (open) SMTP relay. So connecting to 100 servers simultaneously, sending 10 mails each, results in 1000 mails sent (from one zombie).

Even if such mails are often blocked (e.g. by graylisting, blocking dynamic IPs or some other technique) some are probably not. It does not cost the botnets operator anything to simply try it: If the mail is delivered that's good (for the botnets operator), if not that's no problem.

siegi
  • 5,646
  • 2
  • 30
  • 42
  • Open SMTP relays are extremely rare and if they exist most of them are black listed as you mentioned. Also many ISPs block access to port 25 if it is send to a domain that is not theirs. – Jori Feb 02 '13 at 13:40
  • Well, you are probably right, but at least connecting to the recipients SMTP should work (unless some other mechanism blocks it, as noted above). So my answer is still valid, if the zombies connect to these servers. So they could send 10 mails to 100 different domains simultaneously :-P – siegi Feb 02 '13 at 18:42