Botnet Statistics for July 2009

The following is collected from two vpses of mine. I tried to keep at least two vpses running at the same time. If an unexpected hardware or network problem hits one vps, I still have something on the other one to report.

detection period: 2009-07-01 00:00 - 2009-07-31 23:59 UTC
total number of suspected botnet IPs: 78186
number of blocked spams: 2465875
recipient count of blocked spams: 54559064

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	19257
2	India	18531
3	Brazil	12300
4	China	10100
5	Argentina	7297
6	Russian Federation	2392
7	Uruguay	939
8	Ukraine	667
9	Chile	624
10	Hong Kong	585
11	Mexico	541
12	Ethiopia	464
13	Colombia	406
14	United States	294
15	Thailand	273
16	Algeria	236
17	Kazakhstan	235
18	Germany	234
19	South Korea	175
20	Belarus	168
21	Japan	143
22	Indonesia	137
23	Turkey	134
24	Italy	129
25	Costa Rica	124

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	Taiwan	1036100
2	China	449094
3	Brazil	229515
4	India	171946
5	Argentina	96138
6	Malaysia	91380
7	Russian Federation	53137
8	United States	35679
9	Hong Kong	23099
10	Ukraine	22541
11	Indonesia	18734
12	Germany	18535
13	Colombia	18459
14	Poland	16696
15	France	15755
16	Thailand	15580
17	South Korea	14999
18	Chile	10815
19	Iran	9416
20	Bulgaria	9097
21	Venezuela	8474
22	Viet Nam	7022
23	Uruguay	7001
24	United Kingdom	5797
25	Spain	5428

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Rank	Country	recipient count of blocked spams
1	Taiwan	12073134
2	China	12039776
3	Brazil	7562266
4	India	5677884
5	Argentina	3290320
6	Russian Federation	1723848
7	Malaysia	1568184
8	United States	990733
9	Hong Kong	753180
10	Ukraine	725080
11	Colombia	614611
12	Germany	611783
13	Indonesia	576531
14	Poland	552982
15	France	507054
16	Thailand	494366
17	South Korea	470731
18	Chile	369304
19	Iran	301053
20	Bulgaria	296226
21	Venezuela	292595
22	Uruguay	237960
23	Viet Nam	225930
24	Italy	161234
25	Spain	158582

The top 25 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	13832
2	HINET-NET	10156
3	APOL-NET	7596
4	AR-TEAR7-LACNIC	6204
5	002.558.157/0001-62	4146
6	002.558.134/0001-58	2538
7	002.449.992/0001-64	2065
8	UNICOM-SD	1814
9	TATACOMM-IN	1516
10	040.432.544/0001-47	1252
11	TFN-NET	1108
12	CHINANET-GD	1049
13	RCOM	994
14	UY-ANTA-LACNIC	931
15	HATHWAY-NET	734
16	CHINANET-ZJ-WZ	606
17	UKRTELNET	584
18	UNICOM-HE	579
19	HGC	571
20	UNICOM-LN	569
21	000.065.376/0002-65	558
22	ETHIONET	464
23	UNICOM-HA	453
24	RU-AVANGARD-DSL	437
25	CL-TNCS-LACNIC	429

The top 25 networks (as found in WHOIS), ordered by number of blocked spams are:

Rank	Network	# of blocked spams
1	HINET-NET	800119
2	APOL-NET	175964
3	CHINANET-ZJ-WZ	114462
4	BSNLNET	93464
5	AR-TEAR7-LACNIC	57145
6	TMIDC-MY	54562
7	UNICOM-SD	48920
8	002.558.157/0001-62	48508
9	TFN-NET	39915
10	EASTGATE	31116
11	002.558.134/0001-58	27454
12	000.065.376/0002-65	26132
13	UNICOM-HA	23796
14	UNICOM-HE	22041
15	076.535.764/0326-90	21756
16	RCOM	21435
17	HGC	21280
18	033.530.486/0001-29	21123
19	TATACOMM-IN	19682
20	002.449.992/0001-64	18117
21	UNICOM-BJ	16819
22	CHINANET-GD	15910
23	AR-CASA10-LACNIC	12800
24	PL-TPSA-20031203	11877
25	AR-PRSA-LACNIC	11792

The top 25 networks (as found in WHOIS), ordered by recipient count of blocked spams are:

Rank	Network	recipient count of blocked spams
1	HINET-NET	9426191
2	BSNLNET	3135680
3	AR-TEAR7-LACNIC	1969305
4	CHINANET-ZJ-WZ	1807727
5	002.558.157/0001-62	1625106
6	UNICOM-SD	1595763
7	APOL-NET	1425467
8	002.558.134/0001-58	931675
9	TMIDC-MY	873808
10	000.065.376/0002-65	838355
11	UNICOM-HA	730155
12	076.535.764/0326-90	706698
13	HGC	697018
14	UNICOM-HE	682252
15	RCOM	678094
16	TATACOMM-IN	652549
17	033.530.486/0001-29	647735
18	002.449.992/0001-64	623067
19	TFN-NET	596687
20	UNICOM-BJ	560528
21	EASTGATE	497856
22	AR-CASA10-LACNIC	442958
23	AR-PRSA-LACNIC	411276
24	PL-TPSA-20031203	406389
25	UKRTELNET	387057