Botnet Statistics [2010-01-31]

Last week I read a paper titled "Spamming Chains: A New Way of Understanding Spammer Behavior" from CEAS 2009, and then realized that I should add number of blocked spams and recipient count of blocked spams to my daily statistics. So here they are.

detection period: 2010-01-31 00:00-23:59 UTC
total number of suspected botnet IPs: 3140
number of botnet IPs notified to network operators: 2876
number of blocked spams: 142094
recipient count of blocked spams: 4283754

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1338
2	BSNLNET	221
3	TFN-NET	149
4	002.558.157/0001-62	84
5	UNICOM-SD	64
6	AR-TEAR7-LACNIC	60
7	CHINANET-JS	43
8	UNICOM-HA	38
9	CHINANET-GD	38
10	002.558.134/0001-58	35

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1499
2	China	579
3	India	315
4	Brazil	255
5	Argentina	124
6	Russian Federation	55
7	United States	32
8	Colombia	21
9	Thailand	19
10	Indonesia	19