The massive spam reduction caused by McColo's closure was quickly back to normal within days

That fact has left some researchers a little surprised that the latest decline in spam has lasted as long as it has.

"The volumes are still way down," said Matt Sergeant, senior anti-spam technologist at MessageLabs. "

"For now, bots that are searching for a C&C master are more visible, so FireEye is reaching out to the victims and notifying them of how to disconnect themselves from the botnet," Lin said.

said by swhitney2003 :

One positive to all the P2P crap ISPs have been giving customers (throttling, blocking, breaking IP standards, etc) may be a little effective towards these botnet structures?

What's remarkable about the McColo and Intercage shutdowns is that they weren't initiated by law enforcement officials or via court order. Neither did they happen because either company was forced into bankruptcy or had other financial problems. Instead, both companies were forced offline when their upstream ISPs, acting upon information provided by security researchers, simply disconnected them and their customers from the Internet.

Behind the scenes of the McColo and Intercage cases, a ferocious struggle is taking place between the purveyors of Web-based malware and loosely aligned but highly committed groups of security researchers who are out to neutralize them.

Backers claim that the effort to shut down miscreant ISPs is needed because of the inability of law enforcement agencies to deal with a problem that is global in nature, as well as a lack of applicable laws both domestically and internationally.

The fear of ending up on an Internet blacklist is also a powerful motivator in such cases. Several groups and companies -- including StopBadware.org, The Spaumhaus Project Ltd., HostExploit.com and Castlecops -- maintain extensive lists of Web sites and domains that are allegedly associated with spamming, rootkits, adware, spyware, phishing and other threats.

Others, though, say that the only people really opposed to the efforts of antispam and anti-malware groups are the cybercriminals themselves and those who support them for financial gain -- such as service providers that host spam sites.