In November 2009 the security company FireEye knocked the Mega-D botnet (also called Ozdok) offline, but the win was short. Mega-D was sending more spam than before the takedown by 22 November 2009, according to M86 Security, and it accounted for 17% of worldwide spam by 13 December. Today the main defence against spam is sender authentication rather than botnet takedowns. Since 2024, Gmail and Yahoo have required bulk senders to use SPF, DKIM and DMARC, offer one-click unsubscribe and keep their spam rate low. Microsoft’s Outlook.com added similar rules on 5 May 2025.
According to theregister.co.uk, a botnet known as Mega-D or Ozdok, which was described as responsible for a third of the world’s spam, had been wiped off the map. FireEye studied how the botnet worked and went after its command and control channels in a coordinated strike that started on 5 and 6 November 2009. The botnet’s registered domains were pointed to a sinkhole, which left the infected machines with no instructions and no way to get new ones. Dozens of internet service providers, domain registrars and non-profit groups such as Shadowserver helped with the operation.
The “one third” figure needs context. Some estimates put Mega-D at about 32% of global spam at its 2008 peak. By the time of the takedown its share was much smaller: MessageLabs measured it at 11.8% of all spam on 1 November 2009. Terry Zink of Microsoft also said on his blog that Microsoft’s own data could not confirm the one-third claim.
How the botnet worked
Mega-D ran on control channels that sent orders to “zombie” machines, which were ordinary home and office computers infected with malware. The zombies then sent the spam. Because the mail came from hundreds of thousands of different addresses, blocking any single source did very little.
Why the takedown changed less than it seemed
The takedown was good news, but it did less than the headlines suggested. More than 264,000 IP addresses reported to FireEye’s sinkholes, and most of them were already on spam blocklists. Internet service providers still had to find every infected machine on their networks and clean it up.
The effect was dramatic for a few days. MessageLabs reported that Mega-D’s share of spam fell below 0.1% within three days. Then the operators rebuilt their control servers, and the botnet was soon running at full strength again.
The criminal case took longer. In November 2010 the FBI arrested Oleg Nikolaenko, a Russian national named as Mega-D’s alleged operator, in Las Vegas. He was charged with violating the CAN-SPAM Act of 2003.
What the spam numbers looked like then and now
Cisco’s 2008 Annual Security Report put spam at nearly 200 billion messages per day, about 90% of all email worldwide. The original version of this post said that removing Mega-D would bring the daily total down to about 134 billion. That figure simply took a third off Cisco’s number, and it was wrong for two reasons: Mega-D’s real share just before the takedown was nearer 12%, and the botnet came back within weeks, reaching about 17% of worldwide spam by 13 December 2009, according to M86 Security.
Spam is still a big part of email traffic today. Kaspersky’s report on 2025 found that 44.99% of global email traffic was spam, which is almost one message in every two. Kaspersky also counted more than 144 million malicious or potentially unwanted email attachments, a 15% rise on the year before.
| Measure | 2008 to 2009 | Latest figure |
|---|---|---|
| Spam share of all email | About 90% (Cisco, 2008) | 44.99% (Kaspersky, 2025) |
| Daily spam volume | Nearly 200 billion (Cisco, 2008) | Not part of Kaspersky’s headline figures |
| Mega-D share of spam | 11.8% on 1 Nov 2009 (MessageLabs) | Botnet no longer a major source |
What this means for legitimate senders today
Botnets like Mega-D are the reason mailbox providers now judge every sender by authentication and reputation. If your domain can’t prove who it is, your mail gets the same treatment that zombie spam got in 2009.
These are the current rules:
- Gmail and Yahoo (since February 2024): Senders of 5,000 or more messages a day to personal accounts must use SPF and DKIM, publish a DMARC record, offer one-click unsubscribe on marketing mail and handle unsubscribe requests within two days. Google says you should keep your spam rate below 0.1% and never let it reach 0.3%. Once your spam rate reaches 0.3%, Google won’t offer you mitigation. You become eligible again once your spam rate stays below 0.3% for seven days in a row.
- Microsoft Outlook.com (since 5 May 2025): Senders of 5,000 or more messages to Microsoft’s consumer mailboxes must pass SPF and DKIM and publish DMARC at
p=noneor stricter. Mail that fails can be rejected with the error550 5.7.515 Access denied, sending domain does not meet the required authentication level.
A basic DMARC record looks like this. Once your reports show that all your real mail passes, you can raise the policy from none to quarantine or reject:
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
FAQ
Was Mega-D really responsible for a third of the world’s spam?
Only at its peak in 2008, by some estimates. MessageLabs measured its share at 11.8% on 1 November 2009, just before the takedown. Microsoft’s anti-spam team said publicly that its own data could not confirm the one-third figure.
Did the FireEye takedown stop Mega-D for good?
No. Spam from Mega-D almost stopped for a few days in November 2009. The botnet then went past its pre-takedown volume by 22 November and reached 17% of global spam by mid-December, according to M86 Security.
How much of today’s email is spam?
Kaspersky’s report on 2025 found that 44.99% of global email traffic was spam. That is far below the roughly 90% Cisco reported in 2008, but it is still close to one message in two.
Can a botnet hurt my own email deliverability?
Yes, if your domain is spoofed. Spammers can forge your “From” address, and without DMARC, mailbox providers can’t tell their mail from yours. Publishing SPF, DKIM and DMARC protects your domain’s reputation and lets you see who is sending mail in your name.
What rules do bulk senders have to follow now?
Gmail and Yahoo require senders of 5,000 or more messages a day to use SPF, DKIM and DMARC, offer one-click unsubscribe and keep their spam rate under 0.3%. Microsoft’s Outlook.com has required SPF, DKIM and DMARC at that volume since 5 May 2025. US senders must also follow CAN-SPAM, which requires an honest sender, a valid postal address and a working opt-out.
Is buying an email list a safe way to grow after a spam crackdown?
No. Purchased lists are full of addresses that never agreed to hear from you, which pushes your spam complaint rate toward the 0.3% limit. Grow your list with signups that people choose, and confirm them where you can.
Sources
- Google: Email sender guidelines
- Google: Email sender guidelines FAQ
- Yahoo Sender Hub: Sender best practices
- Microsoft Support: Fix NDR error “550 5.7.515” in Outlook.com
- FTC: CAN-SPAM Act, A Compliance Guide for Business
- Kaspersky: Kaspersky reports 15% growth in malicious email attacks in 2025