The 2010 Christmas period saw a significant drop in spam levels, Symantec figures have shown.
This fall has somewhat flummoxed security researchers, especially considering the Christmas holidays are seen as a time of great activity for spammers.
The central reason behind the drop was the significant fall in activity from some mega botnets, in particular Rustock, which was the most dominant spam botnet in 2010 and appeared to have all but shut down from Christmas Day onwards.
The major Lethic and Xarvester botnets also saw a dramatic decline in activity. The former produced virtually nothing since 28 December and the latter did very little post New Year's Eve.
According to Symantec, the amount of spam hitting the security giant's spam honeypots was at its lowest since the McColo takedown in November 2008.
Why these botnets have gone on something of a hiatus remains something of a conundrum, however.
"At present we don't know why these botnets have stopped spamming, perhaps the botnet herders have decided they need a holiday too?" said Paul Wood, MessageLabs Intelligence senior analyst at Symantec Hosted Services, in a blog post.
Despite the lack of an answer as to why Rustock et al have taken a break, Wood warned people against complacency.
"As we saw after the closure of McColo in 2008, and following further takedown attempts in subsequent years, botnets rarely stay quiet for very long," Wood said.
"Even if these three botnets don't come back soon, we would expect other botnets, even new ones, to pick-up where they have left off - very soon."
It is not often security pros are left at a loss when something significant happens. The last time a serious drop in spam was recorded, in 2010, the reasons appeared to be clear as some massive botnets had been taken out by law enforcement.
