Daily Botnet Statistics: April 2010

Friday, April 30, 2010

Botnet Statistics for March 2010

detection period: 2010-03-01 00:00 - 2010-03-31 23:59 UTC
total number of suspected botnet IPs: 55591
number of blocked spams: 4225893
recipient count of blocked spams: 79043657

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	14476
2	India	13161
3	China	12452
4	Brazil	4939
5	Argentina	2579
6	United States	2376
7	Russian Federation	1103
8	Thailand	610
9	Mexico	387
10	Uruguay	364
11	Ukraine	307
12	Ethiopia	276
13	Spain	244
14	Chile	177
15	South Korea	158
16	United Kingdom	152
17	Colombia	144
18	France	112
19	Germany	110
20	Indonesia	99
21	Kazakhstan	91
22	Italy	70
23	Canada	70
24	Japan	69
25	Belarus	67

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	1662639
2	Brazil	607645
3	Taiwan	359716
4	India	235181
5	United States	143707
6	Indonesia	118070
7	Russian Federation	100260
8	Thailand	99239
9	Argentina	96704
10	Colombia	95130
11	France	86624
12	South Korea	59094
13	Poland	56118
14	Ukraine	43226
15	Viet Nam	35247
16	United Kingdom	33218
17	Turkey	32695
18	Mexico	30306
19	European Union	28545
20	Canada	26114
21	Czech Republic	23393
22	South Africa	19825
23	Japan	18599
24	Chile	15310
25	Germany	14438

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2010-04-29]

detection period: 2010-04-29 00:00-23:59 UTC
total number of suspected botnet IPs: 4300
number of botnet IPs notified to network operators: 3906
number of blocked spams: 151892
recipient count of blocked spams: 2969118

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1309
2	BSNLNET	629
3	RITELE	253
4	AR-TEAR7-LACNIC	151
5	002.558.157/0001-62	133
6	CHINANET-GD	117
7	RCOM	83
8	002.558.134/0001-58	63
9	HATHWAY-NET	60
10	TATACOMM-IN	48

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1316
2	India	913
3	China	747
4	Brazil	405
5	Argentina	227
6	Russian Federation	119
7	Thailand	95
8	United States	90
9	Colombia	32
10	Indonesia	31

Thursday, April 29, 2010

Botnet Statistics [2010-04-28]

detection period: 2010-04-28 00:00-23:59 UTC
total number of suspected botnet IPs: 4270
number of botnet IPs notified to network operators: 3905
number of blocked spams: 162235
recipient count of blocked spams: 3067912

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1331
2	BSNLNET	674
3	RITELE	141
4	CHINANET-GD	133
5	AR-TEAR7-LACNIC	129
6	002.558.157/0001-62	116
7	RCOM	75
8	002.558.134/0001-58	62
9	TATACOMM-IN	60
10	HATHWAY-NET	56

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1339
2	India	951
3	China	670
4	Brazil	404
5	Argentina	200
6	Russian Federation	112
7	United States	97
8	Thailand	67
9	Mexico	35
10	Ukraine	34

Wednesday, April 28, 2010

Botnet Statistics [2010-04-27]

detection period: 2010-04-27 00:00-23:59 UTC
total number of suspected botnet IPs: 4300
number of botnet IPs notified to network operators: 3909
number of blocked spams: 140917
recipient count of blocked spams: 2841104

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1356
2	BSNLNET	493
3	RITELE	226
4	CHINANET-GD	197
5	AR-TEAR7-LACNIC	108
6	002.558.157/0001-62	100
7	RCOM	86
8	HATHWAY-NET	68
9	TATACOMM-IN	57
10	002.558.134/0001-58	56

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1365
2	China	840
3	India	780
4	Brazil	372
5	Argentina	192
6	Russian Federation	127
7	United States	106
8	Thailand	81
9	Mexico	36
10	Colombia	29

Tuesday, April 27, 2010

Botnet Statistics for February 2010

detection period: 2010-02-01 00:00 - 2010-02-28 23:59 UTC
total number of suspected botnet IPs: 65322
number of blocked spams: 3806452
recipient count of blocked spams: 109294730

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	22952
2	Taiwan	15903
3	Brazil	7531
4	China	7254
5	Argentina	3781
6	Russian Federation	1904
7	Thailand	891
8	Uruguay	660
9	Mexico	579
10	Ethiopia	482
11	Ukraine	421
12	Chile	233
13	Colombia	220
14	South Korea	172
15	Germany	156
16	Kazakhstan	153
17	Algeria	140
18	United States	138
19	Belarus	136
20	Japan	133
21	Indonesia	100
22	South Africa	84
23	Venezuela	82
24	Bulgaria	81
25	Peru	67

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	1253026
2	Brazil	602052
3	India	392523
4	Taiwan	382621
5	Argentina	130993
6	Colombia	123351
7	Russian Federation	116877
8	Thailand	112174
9	France	83723
10	United States	73363
11	Indonesia	72951
12	Poland	49457
13	Ukraine	38512
14	South Korea	31244
15	South Africa	30517
16	Germany	29079
17	Chile	22527
18	United Kingdom	19777
19	Turkey	18522
20	Viet Nam	15595
21	Venezuela	15199
22	Greece	14793
23	Japan	12591
24	Hong Kong	11664
25	European Union	10575

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2010-04-26]

detection period: 2010-04-26 00:00-23:59 UTC
total number of suspected botnet IPs: 4446
number of botnet IPs notified to network operators: 4005
number of blocked spams: 198051
recipient count of blocked spams: 3126691

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1352
2	BSNLNET	587
3	CHINANET-GD	272
4	AR-TEAR7-LACNIC	142
5	002.558.157/0001-62	123
6	RITELE	93
7	RCOM	85
8	002.558.134/0001-58	64
9	000.065.376/0002-65	54
10	TATACOMM-IN	48

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1363
2	India	857
3	China	804
4	Brazil	426
5	Argentina	224
6	Russian Federation	149
7	United States	96
8	Thailand	81
9	Mexico	39
10	Colombia	31

Monday, April 26, 2010

Botnet Statistics [2010-04-25]

detection period: 2010-04-25 00:00-23:59 UTC
total number of suspected botnet IPs: 3665
number of botnet IPs notified to network operators: 3339
number of blocked spams: 199124
recipient count of blocked spams: 2808409

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1367
2	CHINANET-GD	333
3	BSNLNET	264
4	RITELE	191
5	AR-TEAR7-LACNIC	102
6	002.558.157/0001-62	87
7	CAT-BB-NET	44
8	002.558.134/0001-58	38
9	TRUENET	33
10	UNICOM-SD	31

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1376
2	China	874
3	India	345
4	Brazil	275
5	Argentina	173
6	United States	121
7	Thailand	99
8	Russian Federation	74
9	Mexico	29
10	Indonesia	23

Sunday, April 25, 2010

Botnet Statistics [2010-04-24]

detection period: 2010-04-24 00:00-23:59 UTC
total number of suspected botnet IPs: 3324
number of botnet IPs notified to network operators: 3028
number of blocked spams: 140692
recipient count of blocked spams: 2087204

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1280
2	BSNLNET	294
3	RITELE	286
4	CHINANET-GD	167
5	AR-TEAR7-LACNIC	77
6	002.558.157/0001-62	53
7	RCOM	49
8	CAT-BB-NET	36
9	TRUENET	32
10	HATHWAY-NET	29

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1288
2	China	742
3	India	447
4	Brazil	184
5	Argentina	137
6	United States	132
7	Thailand	80
8	Russian Federation	61
9	Colombia	24
10	Ukraine	17

Saturday, April 24, 2010

Botnet Statistics for January 2010

detection period: 2010-01-01 00:00 - 2010-01-31 23:59 UTC
total number of suspected botnet IPs: 65037
number of blocked spams: 5197435
recipient count of blocked spams: 169541745

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	17327
2	India	16994
3	China	14190
4	Brazil	6842
5	Argentina	2778
6	Russian Federation	1587
7	United States	653
8	Ukraine	522
9	Ethiopia	492
10	Uruguay	369
11	Thailand	283
12	Chile	246
13	Mexico	190
14	South Korea	181
15	Colombia	175
16	Germany	171
17	Algeria	158
18	Italy	125
19	Indonesia	117
20	Bulgaria	97
21	Belarus	91
22	Japan	73
23	United Kingdom	73
24	Venezuela	72
25	Poland	71

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	2036479
2	Taiwan	734831
3	Brazil	536722
4	India	288372
5	United States	166481
6	Russian Federation	153591
7	Argentina	121782
8	Indonesia	108413
9	Thailand	102065
10	Colombia	101427
11	France	84516
12	Ukraine	79742
13	United Kingdom	62186
14	Poland	59526
15	South Korea	46077
16	Germany	29816
17	European Union	28565
18	Turkey	28155
19	Hong Kong	23321
20	Chile	22358
21	Pakistan	22140
22	Italy	20869
23	Venezuela	19995
24	Greece	19855
25	Viet Nam	18359

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2010-04-23]

detection period: 2010-04-23 00:00-23:59 UTC
total number of suspected botnet IPs: 3456
number of botnet IPs notified to network operators: 3156
number of blocked spams: 91506
recipient count of blocked spams: 1696696

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1287
2	BSNLNET	361
3	RITELE	247
4	CHINANET-GD	204
5	002.558.157/0001-62	73
6	RCOM	59
7	AR-TEAR7-LACNIC	51
8	TATACOMM-IN	34
9	UNICOM-SD	33
10	TRUENET	31

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1291
2	China	784
3	India	532
4	Brazil	227
5	United States	128
6	Argentina	94
7	Thailand	78
8	Russian Federation	68
9	Colombia	23
10	Indonesia	18

Friday, April 23, 2010

Botnet Statistics [2010-04-22]

detection period: 2010-04-22 00:00-23:59 UTC
total number of suspected botnet IPs: 3324
number of botnet IPs notified to network operators: 3055
number of blocked spams: 118397
recipient count of blocked spams: 1840552

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1307
2	BSNLNET	304
3	RITELE	259
4	CHINANET-GD	179
5	AR-TEAR7-LACNIC	77
6	002.558.157/0001-62	63
7	RCOM	52
8	TATACOMM-IN	40
9	UNICOM-SD	33
10	000.065.376/0002-65	31

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1309
2	China	754
3	India	472
4	Brazil	218
5	Argentina	126
6	United States	86
7	Russian Federation	64
8	Thailand	60
9	Indonesia	21
10	Colombia	20

Thursday, April 22, 2010

Botnet Statistics [2010-04-21]

detection period: 2010-04-21 00:00-23:59 UTC
total number of suspected botnet IPs: 3444
number of botnet IPs notified to network operators: 3147
number of blocked spams: 107105
recipient count of blocked spams: 1903794

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1327
2	BSNLNET	273
3	CHINANET-GD	255
4	RITELE	250
5	AR-TEAR7-LACNIC	94
6	002.558.157/0001-62	53
7	RCOM	41
8	000.065.376/0002-65	31
9	TATACOMM-IN	30
10	UNICOM-SD	27

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1334
2	China	808
3	India	433
4	Brazil	196
5	Argentina	146
6	United States	124
7	Thailand	69
8	Russian Federation	69
9	Colombia	27
10	Indonesia	25

Wednesday, April 21, 2010

Botnet Statistics for December 2009

detection period: 2009-12-01 00:00 - 2009-12-31 23:59 UTC
total number of suspected botnet IPs: 57949
number of blocked spams: 3155913
recipient count of blocked spams: 79702344

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	21701
2	China	12138
3	India	11110
4	Brazil	5017
5	Argentina	2417
6	Russian Federation	1306
7	Ukraine	460
8	United States	424
9	Ethiopia	391
10	Uruguay	300
11	Thailand	291
12	Chile	196
13	South Korea	174
14	Colombia	137
15	Algeria	129
16	Mexico	127
17	Germany	120
18	Kazakhstan	88
19	Indonesia	86
20	Bulgaria	72
21	United Kingdom	70
22	Italy	69
23	Belarus	69
24	Poland	68
25	Hong Kong	63

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	1176442
2	Taiwan	498018
3	Brazil	236205
4	United Kingdom	170750
5	Russian Federation	139714
6	India	135926
7	United States	83076
8	Argentian	59411
9	Poland	58815
10	South Korea	47017
11	Thailand	43585
12	Colombia	41202
13	Indonesia	37860
14	Ukraine	33319
15	Iran	29011
16	Arab Emirates	28465
17	France	24515
18	Germany	20768
19	Pakistan	19918
20	Australia	19788
21	Philippines	18936
22	Italy	18379
23	Czech Republic	17047
24	Greece	15701
25	Hungary	14118

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2010-04-20]

detection period: 2010-04-20 00:00-23:59 UTC
total number of suspected botnet IPs: 3672
number of botnet IPs notified to network operators: 3313
number of blocked spams: 104227
recipient count of blocked spams: 1901575

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1298
2	BSNLNET	395
3	RITELE	261
4	CHINANET-GD	173
5	AR-TEAR7-LACNIC	73
6	002.558.157/0001-62	72
7	RCOM	47
8	UNICOM-SD	41
9	TATACOMM-IN	39
10	076.535.764/0326-90	34

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1306
2	China	804
3	India	571
4	Brazil	259
5	United States	129
6	Argentina	128
7	Thailand	75
8	Russian Federation	75
9	Indonesia	28
10	Colombia	23

Tuesday, April 20, 2010

Botnet Statistics [2010-04-19]

detection period: 2010-04-19 00:00-23:59 UTC
total number of suspected botnet IPs: 3354
number of botnet IPs notified to network operators: 3045
number of blocked spams: 82224
recipient count of blocked spams: 1541979

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1316
2	RITELE	305
3	BSNLNET	250
4	CHINANET-GD	132
5	002.558.157/0001-62	61
6	AR-TEAR7-LACNIC	60
7	UNICOM-SD	33
8	NAC-NETBLK07	32
9	002.558.134/0001-58	32
10	000.065.376/0002-65	32

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1319
2	China	769
3	India	388
4	Brazil	243
5	United States	121
6	Argentina	104
7	Thailand	72
8	Russian Federation	70
9	Indonesia	26
10	Colombia	23

Monday, April 19, 2010

Botnet Statistics [2010-04-18]

detection period: 2010-04-18 00:00-23:59 UTC
total number of suspected botnet IPs: 2683
number of botnet IPs notified to network operators: 2442
number of blocked spams: 75466
recipient count of blocked spams: 1458970

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1187
2	RITELE	385
3	BSNLNET	128
4	AR-TEAR7-LACNIC	48
5	002.558.157/0001-62	38
6	TRUENET	31
7	CAT-BB-NET	25
8	000.065.376/0002-65	24
9	UNICOM-LN	23
10	CHINANET-ZJ-WZ	19

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1192
2	China	714
3	India	181
4	Brazil	151
5	Argentina	88
6	Thailand	79
7	Russian Federation	37
8	United States	24
9	Indonesia	18
10	Colombia	16

Sunday, April 18, 2010

Botnet Statistics for November 2009

detection period: 2009-11-01 00:00 - 2009-11-30 23:59 UTC
total number of suspected botnet IPs: 53088
number of blocked spams: 3805343
recipient count of blocked spams: 59327314

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	15350
2	India	11504
3	Taiwan	8659
4	Brazil	6025
5	Argentina	3710
6	Russian Federation	1919
7	Ukraine	693
8	Thailand	660
9	Uruguay	520
10	Mexico	367
11	Ethiopia	355
12	United States	331
13	Chile	277
14	Peru	242
15	Colombia	222
16	Hong Kong	182
17	South Korea	151
18	Kazakhstan	137
19	Algeria	123
20	Germany	122
21	Belarus	111
22	Japan	107
23	Indonesia	101
24	Poland	78
25	Bulgaria	71

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	1894394
2	Brazil	321441
3	Taiwan	196271
4	United Kingdom	163573
5	India	128323
6	United States	117254
7	France	103380
8	Russian Federation	87901
9	South Korea	79169
10	Ukraine	56337
11	Viet Nam	52955
12	Argentina	51102
13	Thailand	50374
14	Colombia	46353
15	Indonesia	44668
16	Slovakia	38502
17	Latvia	37943
18	Mexico	30632
19	Germany	26479
20	Arab Emirates	22539
21	Pakistan	19319
22	Poland	18955
23	Turkey	17820
24	Chile	16244
25	Bulgaria	13850

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2010-04-17]

detection period: 2010-04-17 00:00-23:59 UTC
total number of suspected botnet IPs: 3125
number of botnet IPs notified to network operators: 2802
number of blocked spams: 135735
recipient count of blocked spams: 2458869

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1336
2	BSNLNET	293
3	RITELE	216
4	AR-TEAR7-LACNIC	68
5	002.558.157/0001-62	63
6	RCOM	46
7	TRUENET	37
8	UNICOM-SD	30
9	002.558.134/0001-58	29
10	000.065.376/0002-65	29

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1340
2	China	557
3	India	444
4	Brazil	229
5	Argentina	114
6	Thailand	84
7	Russian Federation	64
8	United States	25
9	Mexico	24
10	Indonesia	22

Saturday, April 17, 2010

Botnet Statistics [2010-04-16]

detection period: 2010-04-16 00:00-23:59 UTC
total number of suspected botnet IPs: 2916
number of botnet IPs notified to network operators: 2637
number of blocked spams: 80470
recipient count of blocked spams: 1663028

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1184
2	BSNLNET	281
3	RITELE	205
4	AR-TEAR7-LACNIC	72
5	002.558.157/0001-62	69
6	TRUENET	36
7	RCOM	34
8	002.558.134/0001-58	33
9	UNICOM-SD	32
10	002.449.992/0001-64	26

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1193
2	China	533
3	India	404
4	Brazil	254
5	Argentina	132
6	Thailand	71
7	Russian Federation	61
8	United States	24
9	Mexico	24
10	Indonesia	22

Friday, April 16, 2010

Botnet Statistics [2010-04-15]

detection period: 2010-04-15 00:00-23:59 UTC
total number of suspected botnet IPs: 3661
number of botnet IPs notified to network operators: 3303
number of blocked spams: 127660
recipient count of blocked spams: 2450356

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1244
2	BSNLNET	415
3	RITELE	374
4	AR-TEAR7-LACNIC	97
5	002.558.157/0001-62	92
6	RCOM	68
7	TATACOMM-IN	47
8	002.558.134/0001-58	44
9	HATHWAY-NET	40
10	002.449.992/0001-64	37

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1252
2	China	755
3	India	634
4	Brazil	325
5	Argentina	166
6	Russian Federation	96
7	Thailand	75
8	United States	40
9	Indonesia	24
10	Ukraine	23

Thursday, April 15, 2010

Botnet Statistics for October 2009

detection period: 2009-10-01 00:00 - 2009-10-31 23:59 UTC
total number of suspected botnet IPs: 76181
number of blocked spams: 3779164
recipient count of blocked spams: 70722504

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	22294
2	India	16365
3	Taiwan	11943
4	Brazil	9493
5	Argentina	5339
6	Russian Federation	2932
7	Uruguay	807
8	Ukraine	768
9	Mexico	549
10	Thailand	526
11	Ethiopia	497
12	United States	445
13	Hong Kong	377
14	Chile	333
15	Algeria	326
16	Colombia	284
17	Peru	271
18	South Korea	222
19	Kazakhstan	221
20	Germany	180
21	Belarus	157
22	Japan	138
23	Indonesia	119
24	Pakistan	82
25	Italy	81

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	1876022
2	Taiwan	972674
3	Brazil	234643
4	India	151568
5	Argentina	83899
6	Russian Federation	69876
7	United States	41642
8	Thailand	31022
9	France	28893
10	Colombia	28617
11	Ukraine	28441
12	South Korea	25523
13	Indonesia	17353
14	Poland	15591
15	Hong Kong	14052
16	Bulgaria	10760
17	United Kingdom	10602
18	Mexico	10067
19	Slovakia	8679
20	Chile	8505
21	Germany	7174
22	Pakistan	7155
23	Kazakhstan	7143
24	Greece	6627
25	Algeria	5921

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2010-04-14]

detection period: 2010-04-14 00:00-23:59 UTC
total number of suspected botnet IPs: 2839
number of botnet IPs notified to network operators: 2494
number of blocked spams: 110730
recipient count of blocked spams: 2000940

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	760
2	BSNLNET	211
3	CHINANET-GD	180
4	AR-TEAR7-LACNIC	95
5	RITELE	90
6	002.558.157/0001-62	83
7	UNICOM-SD	47
8	RCOM	42
9	002.558.134/0001-58	38
10	TRUENET	33

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	773
2	China	647
3	India	342
4	Brazil	304
5	Argentina	160
6	United States	137
7	Russian Federation	82
8	Thailand	77
9	Mexico	28
10	Colombia	26

Wednesday, April 14, 2010

Botnet Statistics [2010-04-13]

detection period: 2010-04-13 00:00-23:59 UTC
total number of suspected botnet IPs: 3269
number of botnet IPs notified to network operators: 3022
number of blocked spams: 101094
recipient count of blocked spams: 1715697

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1289
2	RITELE	395
3	BSNLNET	218
4	CHINANET-GD	201
5	002.558.157/0001-62	53
6	AR-TEAR7-LACNIC	52
7	RCOM	39
8	UNICOM-SD	37
9	000.065.376/0002-65	26
10	TATACOMM-IN	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1301
2	China	883
3	India	341
4	Brazil	205
5	United States	150
6	Argentina	87
7	Russian Federation	43
8	Thailand	28
9	Indonesia	22
10	Colombia	20

Tuesday, April 13, 2010

Botnet Statistics [2010-04-12]

detection period: 2010-04-12 00:00-23:59 UTC
total number of suspected botnet IPs: 2661
number of botnet IPs notified to network operators: 2479
number of blocked spams: 91716
recipient count of blocked spams: 1404349

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1262
2	RITELE	360
3	CHINANET-GD	242
4	002.558.157/0001-62	49
5	BSNLNET	27
6	AR-TEAR7-LACNIC	27
7	076.535.764/0326-90	23
8	000.065.376/0002-65	16
9	UNICOM-SD	15
10	JUMPSTART-5	13

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1269
2	China	768
3	Brazil	172
4	United States	114
5	India	62
6	Argentina	56
7	Russian Federation	35
8	Colombia	19
9	Poland	18
10	Indonesia	18

Monday, April 12, 2010

Botnet Statistics for September 2009

detection period: 2009-09-01 00:00 - 2009-09-30 23:59 UTC
total number of suspected botnet IPs: 58046
number of blocked spams: 3951387
recipient count of blocked spams: 76339236

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	15991
2	China	12491
3	India	10181
4	Brazil	7303
5	Argentina	4111
6	Russian Federation	1771
7	Ukraine	542
8	Uruguay	510
9	United States	443
10	Thailand	402
11	Ethiopia	384
12	Mexico	358
13	Hong Kong	325
14	Colombia	270
15	Chile	270
16	South Korea	262
17	Germany	206
18	Algeria	186
19	Kazakhstan	125
20	Belarus	117
21	Indonesia	115
22	Peru	101
23	Bulgaria	91
24	Japan	83
25	France	80

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	2017572
2	Taiwan	1023959
3	Brazil	214592
4	India	118687
5	Argentina	76432
6	Russian Federation	55048
7	France	43419
8	United States	38941
9	Malaysia	32500
10	South Korea	32464
11	Poland	29222
12	Indonesia	27160
13	Ukraine	24070
14	Colombia	22829
15	Thailand	19618
16	Hong Kong	19174
17	Germany	14638
18	Iran	12654
19	Greece	9991
20	United Kingdom	9221
21	Mexico	7886
22	Pakistan	7341
23	Bulgaria	6990
24	Venezuela	5314
25	Algeria	4916

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2010-04-11]

detection period: 2010-04-11 00:00-23:59 UTC
total number of suspected botnet IPs: 2784
number of botnet IPs notified to network operators: 2603
number of blocked spams: 125654
recipient count of blocked spams: 1858074

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1321
2	CHINANET-GD	306
3	RITELE	243
4	BSNLNET	53
5	SHARKTECH-3	27
6	076.535.764/0326-90	21
7	002.558.157/0001-62	21
8	UNICOM-SD	20
9	AR-TEAR7-LACNIC	20
10	JUMPSTART-5	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1329
2	China	766
3	United States	210
4	Brazil	122
5	India	83
6	Argentina	43
7	Russian Federation	27
8	Ukraine	15
9	Poland	15
10	South Korea	15

Sunday, April 11, 2010

Botnet Statistics [2010-04-10]

detection period: 2010-04-10 00:00-23:59 UTC
total number of suspected botnet IPs: 3330
number of botnet IPs notified to network operators: 3091
number of blocked spams: 109389
recipient count of blocked spams: 1912613

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1338
2	RITELE	427
3	CHINANET-GD	262
4	BSNLNET	158
5	AR-TEAR7-LACNIC	46
6	002.558.157/0001-62	42
7	RCOM	35
8	SHARKTECH-3	30
9	UNICOM-SD	25
10	HATHWAY-NET	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1347
2	China	951
3	India	267
4	United States	211
5	Brazil	183
6	Argentina	87
7	Russian Federation	52
8	Colombia	20
9	South Korea	18
10	Ukraine	15

Saturday, April 10, 2010

Botnet Statistics [2010-04-09]

detection period: 2010-04-09 00:00-23:59 UTC
total number of suspected botnet IPs: 2983
number of botnet IPs notified to network operators: 2724
number of blocked spams: 115472
recipient count of blocked spams: 2215063

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1225
2	BSNLNET	207
3	RITELE	181
4	CHINANET-GD	164
5	002.558.157/0001-62	67
6	AR-TEAR7-LACNIC	65
7	RCOM	43
8	002.558.134/0001-58	30
9	002.449.992/0001-64	29
10	UNICOM-SD	26

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1233
2	China	622
3	India	335
4	Brazil	261
5	Argentina	111
6	United States	95
7	Russian Federation	69
8	Indonesia	24
9	Colombia	23
10	Ukraine	17

Friday, April 9, 2010

Botnet Statistics for August 2009

detection period: 2009-08-01 00:00 - 2009-08-31 23:59 UTC
total number of suspected botnet IPs: 107902
number of blocked spams: 4900728
recipient count of blocked spams: 104544986

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	25424
2	China	20873
3	Taiwan	20236
4	Brazil	16852
5	Argentina	9338
6	Russian Federation	3427
7	Uruguay	1088
8	Ukraine	981
9	Hong Kong	894
10	Ethiopia	836
11	Chile	830
12	Mexico	809
13	Colombia	514
14	United States	504
15	Thailand	503
16	Algeria	365
17	Kazakhstan	340
18	Germany	287
19	South Korea	285
20	Peru	248
21	Belarus	241
22	Egypt	199
23	Indonesia	171
24	Turkey	158
25	Italy	152

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	2013844
2	Taiwan	1249943
3	Brazil	411700
4	India	260666
5	Argentina	163315
6	Russian Federation	91918
7	United States	74856
8	Malaysia	57732
9	South Korea	49825
10	Indonesia	44388
11	France	43420
12	Ukraine	38882
13	Hong Kong	37172
14	Colombia	34010
15	Poland	32303
16	Thailand	29761
17	Germany	22946
18	Bulgaria	18163
19	Chile	17615
20	Venezuela	17276
21	Iran	9749
22	Algeria	8313
23	Romania	7861
24	Uruguay	7572
25	Italy	7555

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2010-04-08]

detection period: 2010-04-08 00:00-23:59 UTC
total number of suspected botnet IPs: 3022
number of botnet IPs notified to network operators: 2756
number of blocked spams: 116917
recipient count of blocked spams: 2242221

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1247
2	RITELE	396
3	BSNLNET	243
4	002.558.157/0001-62	73
5	AR-TEAR7-LACNIC	50
6	RCOM	38
7	002.558.134/0001-58	29
8	002.449.992/0001-64	29
9	TATACOMM-IN	27
10	UNICOM-SD	26

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1260
2	China	685
3	India	374
4	Brazil	248
5	Argentina	99
6	Russian Federation	69
7	United States	27
8	Indonesia	27
9	Colombia	24
10	Thailand	19

Thursday, April 8, 2010

Botnet Statistics [2010-04-07]

detection period: 2010-04-07 00:00-23:59 UTC
total number of suspected botnet IPs: 2652
number of botnet IPs notified to network operators: 2390
number of blocked spams: 98899
recipient count of blocked spams: 1710477

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	970
2	RITELE	386
3	BSNLNET	232
4	002.558.157/0001-62	58
5	AR-TEAR7-LACNIC	45
6	RCOM	39
7	HATHWAY-NET	26
8	076.535.764/0326-90	25
9	UNICOM-SD	24
10	002.449.992/0001-64	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	980
2	China	652
3	India	360
4	Brazil	227
5	Argentina	79
6	Russian Federation	58
7	United States	32
8	Ukraine	24
9	Indonesia	24
10	Thailand	21

Wednesday, April 7, 2010

Botnet Statistics [2010-04-06]

A network named RITELE have been staying on my botnet charts for several weeks. After looking up for its WHOIS data, why it is staying there is beyond me. That particular network is composed of 2 class B networks, and belongs to Research Institution of Telecom in Beijing, China.

Although I could not find their website, an organization with such name (Research? Telecom?) should be very good at securing their computers. It is very unusual to let hundreds of their computers participate in spam runs for so long. Did I notify the wrong contact? I don't think so, because it is CNCERT who I notify of most bots in China.

detection period: 2010-04-06 00:00-23:59 UTC
total number of suspected botnet IPs: 2827
number of botnet IPs notified to network operators: 2599
number of blocked spams: 101451
recipient count of blocked spams: 1747767

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1293
2	RITELE	357
3	BSNLNET	148
4	002.558.157/0001-62	51
5	AR-TEAR7-LACNIC	45
6	UNICOM-SD	26
7	RCOM	26
8	076.535.764/0326-90	26
9	TATACOMM-IN	25
10	HATHWAY-NET	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1306
2	China	623
3	India	244
4	Brazil	234
5	Argentina	89
6	Russian Federation	52
7	United States	33
8	Indonesia	25
9	Ukraine	19
10	Colombia	19

Tuesday, April 6, 2010

Botnet Statistics for July 2009

The following is collected from two vpses of mine. I tried to keep at least two vpses running at the same time. If an unexpected hardware or network problem hits one vps, I still have something on the other one to report.

detection period: 2009-07-01 00:00 - 2009-07-31 23:59 UTC
total number of suspected botnet IPs: 78186
number of blocked spams: 2465875
recipient count of blocked spams: 54559064

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	19257
2	India	18531
3	Brazil	12300
4	China	10100
5	Argentina	7297
6	Russian Federation	2392
7	Uruguay	939
8	Ukraine	667
9	Chile	624
10	Hong Kong	585
11	Mexico	541
12	Ethiopia	464
13	Colombia	406
14	United States	294
15	Thailand	273
16	Algeria	236
17	Kazakhstan	235
18	Germany	234
19	South Korea	175
20	Belarus	168
21	Japan	143
22	Indonesia	137
23	Turkey	134
24	Italy	129
25	Costa Rica	124

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	Taiwan	1036100
2	China	449094
3	Brazil	229515
4	India	171946
5	Argentina	96138
6	Malaysia	91380
7	Russian Federation	53137
8	United States	35679
9	Hong Kong	23099
10	Ukraine	22541
11	Indonesia	18734
12	Germany	18535
13	Colombia	18459
14	Poland	16696
15	France	15755
16	Thailand	15580
17	South Korea	14999
18	Chile	10815
19	Iran	9416
20	Bulgaria	9097
21	Venezuela	8474
22	Viet Nam	7022
23	Uruguay	7001
24	United Kingdom	5797
25	Spain	5428

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2010-04-05]

detection period: 2010-04-05 00:00-23:59 UTC
total number of suspected botnet IPs: 3109
number of botnet IPs notified to network operators: 2862
number of blocked spams: 147399
recipient count of blocked spams: 2630787

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1393
2	RITELE	324
3	BSNLNET	238
4	002.558.157/0001-62	73
5	AR-TEAR7-LACNIC	63
6	RCOM	47
7	TATACOMM-IN	39
8	076.535.764/0326-90	33
9	002.558.134/0001-58	33
10	002.449.992/0001-64	26

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1399
2	China	584
3	India	388
4	Brazil	279
5	Argentina	106
6	Russian Federation	63
7	United States	36
8	Indonesia	32
9	Ukraine	18
10	Thailand	17

Monday, April 5, 2010

Botnet Statistics [2010-04-04]

detection period: 2010-04-04 00:00-23:59 UTC
total number of suspected botnet IPs: 2440
number of botnet IPs notified to network operators: 2223
number of blocked spams: 154994
recipient count of blocked spams: 2873753

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1070
2	RITELE	316
3	BSNLNET	110
4	AR-TEAR7-LACNIC	55
5	002.558.157/0001-62	42
6	UNICOM-SD	33
7	002.558.134/0001-58	22
8	076.535.764/0326-90	19
9	UNICOM-LN	17
10	000.065.376/0002-65	17

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1077
2	China	628
3	India	172
4	Brazil	162
5	Argentina	92
6	United States	44
7	Russian Federation	44
8	Indonesia	23
9	Ukraine	16
10	Thailand	16

Sunday, April 4, 2010

Botnet Statistics [2010-04-03]

detection period: 2010-04-03 00:00-23:59 UTC
total number of suspected botnet IPs: 2614
number of botnet IPs notified to network operators: 2366
number of blocked spams: 121717
recipient count of blocked spams: 2386290

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	887
2	RITELE	426
3	BSNLNET	235
4	AR-TEAR7-LACNIC	61
5	002.558.157/0001-62	56
6	RCOM	40
7	002.558.134/0001-58	30
8	TATACOMM-IN	25
9	HATHWAY-NET	25
10	UNICOM-SD	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	895
2	China	720
3	India	371
4	Brazil	201
5	Argentina	108
6	Russian Federation	43
7	United States	39
8	Indonesia	23
9	Thailand	19
10	Colombia	17

Saturday, April 3, 2010

Botnet Statistics for June 2009

I started to detect and report bots around last June, when I rented my first vps from VPSLink. I did not have the chance to publish my work from the start, as this blog was an afterthought. To put all the collected data in another perspective, I decided to present them in a new, monthly format.

I regularly move the collected data (mail log) off my vpses, which only have limited storage space. Now all the old data (since last June) reside on my Windows PC at home. Unable to move them back to the vps (I have only 256Kbps upload bandwidth at home), I have to process them under UWIN , a UNIX emulation under Windows by AT&T, instead. A script taking minutes to run in the vps, now takes hours to complete under UWIN. I knew Windows was not a good fit for a UNIX environment, but I never thought the difference would be so huge.

detection period: 2009-06-08 07:37 - 2009-06-30 23:59 UTC
total number of suspected botnet IPs: 15240
number of blocked spams: 940245
recipient count of blocked spams: 13480394

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	14726
2	China	258
3	Brazil	54
4	India	46
5	Russian Federation	23
6	United States	22
7	Indonesia	8
8	Bulgaria	8
9	Hong Kong	7
10	Germany	6
11	Colombia	6
12	Argentina	6
13	Pakistan	5
14	France	5
15	Egypt	5
16	Thailand	4
17	South Korea	4
18	Iran	4
19	Czech Republic	4
20	Philippines	3
21	Malaysia	3
22	United Kingdom	3
23	Spain	3
24	Ukraine	2
25	Mongolia	2

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	Taiwan	725865
2	Malaysia	152121
3	China	57677
4	Brazil	802
5	United States	618
6	India	411
7	Russian Federation	364
8	Hong Kong	342
9	Indonesia	278
10	Ukraine	208
11	Argentina	150
12	Bangladesh	144
13	Colombia	122
14	Germany	118
15	Bulgaria	112
16	Czech Republic	108
17	United Kingdom	71
18	Czechoslovakia	68
19	Belgium	64
20	Italy	61
21	Thailand	60
22	Philippines	60
23	Pakistan	52
24	Egypt	47
25	Canada	47

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are: