I have just been reading an report that analyzed the Mega-D Botnet, but what I haven't fully understood is how they are used to send spam?

What email address is the mail sent from? Does each bot send the spam through an SMTP server? Does each bot have an SMTP server installed on it?

Can any one clear this up for me as no article that I have read seemed to shed any light on this.

2 Answers 2


From what I could find out about it in a few minutes of googling, Mega-D/Ozdok is a pretty typical smabot: It implements the STMP protocol internally and do handles retries to work around greylisting.

The email address used in the "from" part of the mail depends on the exact template that was sent to the bot. If you look at the fortigate description of the bot, you'll see what options could be used to built it and some samples. It doesn't seem to be using anything from the bot client's machine but it seems to often use the recipient's email in the from field (which means you can protect against these spam using SPF or DKIM).

The bots WILL send their mail through a SMTP server but that will be the recipient's SMTP server: what is referenced in the MX DNS record of their mail domain (or the A record if there is no MX but there is an A).

If you want an analogy to the real world, it's as if, instead of sending (regular) mail to your home through the postal system the spammer hired a lot of strangers to deliver it directly into your home's mail box.

As for whether each spambot has a SMTP server installed, the closer to an answer is: no, there is no SMTP server installed on the client that will accept and relay mail. However, it will accept spam templates from the CC servers as well as "job lists" containing the target email address and then act as a SMTP client to send these mails directly to the recipient's SMTP server.

  • So each bot includes code that would set up an SMTP server on each computer to send out spam?
    – user12054
    Oct 2, 2013 at 12:48
  • No. SMTP is the name of the protocol and "server" means it will accept connections from client using that protocol. In that sens,e the bots do not do that. They act as SMTP clients (they connects to servers using SMTP) and uses a different protocol to receive their instructions (proprietary to the bot).
    – Stephane
    Oct 2, 2013 at 12:52
  • What SMTP servers do they connect to? If they are connecting to the Gmail SMTP server then they obviously have to have accounts for those to be able to send out messages
    – user12054
    Oct 2, 2013 at 12:58
  • Read my explanation again and check the links I included: it uses MX DNS record of the target mail domain to find what SMTP server to connect to. It's the recipient's email address, not any relay.
    – Stephane
    Oct 2, 2013 at 13:33

Personal email addresses, and things like it, are not involved. All you need to send email is a cooperative server to act as your forwarding agent.

Some botnets use compromised machines to sent spam through their primary ISP, and most ISPs are not alarmed when one of their regular customers start sending zillions of emails. Originating email this way doesn't require any authentication beyond the fact that a machine is connected to the ISP's network. The contents are not their concern, as long as the customer keeps paying his bills.

Others rent servers (very cheap to do so) and use them to send spam wholesale. Once again, not a concern for the folks who supplied the server, as long as the customer's check's don't bounce.

Even if the ISPs want to be good citizens (and are willing to deprive themselves of revenue) it's strictly a game of whack-a-mole. Fundamentally, email protocols were designed when the internet have 5 nodes, and all of them were friendly.

  • This is incorrect. Very few (if any) spambot will use a relay server to send their spam. That's the reason why spammers use botnets to send their mails: because otherwise it is pretty easy to shut them down through IP blocking and blacklists. Using the user's ISP server isn't good either since, contrary to what you say, most ISP to monitor the amount of message you sent through them and do care about their SMTP server's reputation.
    – Stephane
    Oct 2, 2013 at 7:52
  • I do not mean a relay server - they are essentially extinct as you say. I mean renting a server and using it to pump out spam directly.
    – ddyer
    Oct 2, 2013 at 23:43
  • They are still not doing this. They do rent servers from "friendly" providers but that's mostly for C&C servers.
    – Stephane
    Oct 3, 2013 at 7:10

You must log in to answer this question.