Daily Botnet Statistics: botnet detection

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for June 2025. To get an idea of what IP is scanning the Internet currently, please watch: Daily Botnet Detection Live Streaming.)
detection period: 2025-06-28 00:00-23:59 UTC
total number of suspected botnet IPs: 22773
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21443
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	MSFT	1591
2	AL-3	1493
3	ASEPL-SG	1130
4	GOOGLE-CLOUD	1018
5	PAN-22	959
6	BSNLNET	737
7	ALISOFT	492
8	VOLCANO-ENGINE	491
9	CENSY	392
10	VE-CSVE-LACNIC	377

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	7922
2	China	4461
3	India	1371
4	Singapore	1285
5	South Korea	549
6	Hong Kong	451
7	Russian Federation	408
8	Venezuela	391
9	Indonesia	391
10	United Kingdom	358

20250629 Botnet Detection Live Streaming 70+ zombies detected)

Wednesday, March 5, 2025

Botnet Statistics [2025-03-04]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for January 2025. To get an idea of what IP is scanning the Internet currently, please watch: Daily Botnet Detection Live Streaming.)
detection period: 2025-03-04 00:00-23:59 UTC
total number of suspected botnet IPs: 25785
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 24046
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	6001	173049
2	9922	54690
3	22	48901
4	6002	42291
5	6022	42285
6	6000	34210
7	3022	29366
8	5900	27938
9	2233	24336
10	3333	16154

Rank	Network	# of suspected botnet IPs
1	MSFT	1342
2	AL-3	1177
3	HINET-NET	1024
4	GOOGLE-CLOUD	986
5	PAN-22	948
6	ASEPL-SG	804
7	BSNLNET	755
8	ALISOFT	526
9	CMNET	469
10	CENSY	394

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8489
2	China	5599
3	India	1533
4	Taiwan	1205
5	Singapore	1041
6	South Korea	664
7	United Kingdom	636
8	Hong Kong	574
9	Russian Federation	478
10	Brazil	428

20250305 Botnet Detection Live Streaming 20+ zombies detected)

Wednesday, February 10, 2016

ZBTrap: a Virtual Appliance for Botnet Detection

I have created a Virtualbox VM named "ZBTrap" (shortened from ZomBie Trap), which can be used to detect spam sending computers with greylisting. Anyone can download and configure this VM, and then start detecting malware-infected computers themselves.

ZBTrap is licensed under Creative Commons Attribution-ShareAlike 4.0 International License.

Warning: Even though this appliance seems to work correctly when I create and test it, I can not guarantee it will work for you. Use at your own risk.

Prerequisite: ZBTrap's operation is based on greylisting, so one or more heavily spammed domains with no active mail accounts are necessary for it to work. All incoming mail will be discarded, so don't use this for any domain which you intend to receive mail.

Built-in accounts/password:

root/cbf7b598 (root account)
zbtrap/8ad49a99

"zbtrap" is the account used for retrieving IP list of suspected zombie computers and associated spam mail headers.

Here is how to set up your own ZBTrap:

Download the "ZBTrap" virtual appliance (download link here). That file is almost 600MB, so be patient.
The appliance is in OVA format. Import it (File/Import Appliance...) into your Virtualbox manager.
Configure the network setting of your ZBTrap so that it is able to accept incoming SMTP connections. There are many ways to achieve this. When I tested it at home, I configured my ZBTrap to be "bridged" within my Virtualbox, so that it gets its own IP address. Then I set up my gateway to forward TCP port 25 (SMTP) of its external IP to my ZBTrap.
Start your ZBTrap VM. For each domain you use to detect botnets, you have to add one line to /usr/exim/grey_domains as the root user (here I assume that the domain to be added is "spammeddomain3.com"):

echo spammeddomain3.com >> /usr/exim/grey_domains

likewise, one line has to be appended to /usr/exim/domain_aliases, too:

echo "*@spammeddomain3.com: greyhole" >> /usr/exim/domain_aliases
Point the MX of your mail domain(s) to your ZBTrap, and it should be the sole MX for those domains. In my case described above, I created a domain name mapping to the public IP of my gateway, then used that for the MX.
Start the SMTP daemon with the root account by issuing this command:

/usr/exim/bin/exim -bd

Now your ZBTrap is ready to collect malware-infected computers' IP addresses.

The VM's timezone is currently set to UTC, which is important when you want to generate the IP list of the malware-infected computers for the previous day. Follow the procedure below to get the information you want.

If you want the IP list for a certain day, issue the following commands the next day as the zbtrap user.

cd; /bin/sh ~/bin/get_expired_entries.sh > ~/expired_list.txt

The file "expired_list.txt" contains the md5 string, message accepting time in UNIX epoch and source IP of expired messages (blocked by greylisting) from the previous day. If you are only interested in botnets' IPs, the 3rd column is what you want.
If you want to report these suspected bots to someone who can check and clean them, you will need the mail header. I have recorded the header data in the mail server's mainlog file, located under /var/spool/exim/log. At 00:00 UTC, log rotation script will rename the old mainlog to mainlog.01, which is our input data. Issue the following commands to match the expired_list's md5 strings to the corresponding mail headers from mainlog.01, and print them out.

cd; < /var/spool/exim/log/mainlog.01 awk -v expired_list=expired_list.txt -f bin/generate_daily_logs_gl.awk > ~/conn_log.txt

To view the mail headers from IP xxx.yyy.zzz.www, issue the following commands.

cd; < ~/conn_log.txt grep xxx.yyy.zzz.www | awk -f bin/show_mail_header.awk

If you encounter any difficulties when using ZBTrap, please post your problem here. I will do my best to answer them.

Sunday, May 29, 2011

Building a botnet detector with Exim and SQLite, a step-by-step procedure wannabe

In this post, I am going to explain how I employ greylisting to collect IP addresses of botnets. Please read "Botnet Detection with Greylisting" first to get familiar with the general idea. I will mostly talk about implementation details here.

To detect botnets in my way of greylisting, you would need:

A UNIX-like host
Linux, FreeBSD, NetBSD, or Solaris will all do. You don't need high-end hardware. Doorstop:) with single Pentium-III CPU, 64MB RAM, and 5GB hard disk should be plenty enough. Cheap VPS is even better, because it is easy to install and configure, saves on power and network bills, and are both environment and pocket friendly.
Heavily spammed domains with no active mailbox
We are going to trace back to the origin of spam to find botnets, so you need to possess some domains which regularly get lots of spam (something like 5K spam every day will do). No spam, no bots. To prevent collateral damage to existing mailboxes and simplify the system, my detection is designed for domains no longer in use, which I call them as "trap domains" below. You need to modify the system yourself when applying it to active domains.

I myself use a Linux VPS with Debian 5 distribution. The trap domains I use had been expired for some time, so there should be no active mail accounts in them. You are assumed be an experienced network administrator, familiar with setting up MX records, mail system troubleshooting, etc. What my detection system does is really simple:

Identify bots with greylisting
Any hosts trying to send mail to trap domains is all a bit problematic, but I want to focus on botnets, which seldom could pass greylisting. Mail servers (or abused open relays) which do retry sending mail will get a response like "no such user" for each recipient, and the corresponding sessions will be eliminated when compiling the resulting IP list of botnets.
Log full mail headers for trap domains
Most abuse contacts want you to include at least full mail headers when reporting mail related abuses, because it is easier for them to explain what happened to their clients. So for every mail destined for trap domains, and not originating from known mail servers, I keep its full mail header in log files for later notifications.

Here come the detailed implementation procedures:

Install Exim with SQLite support.
Exim is the SMTP server I am most familiar with, and its powerful ACL is a tremendous help for my detection. I knew from the start that I would need to query the data collected by greylisting a lot, so I based the greylisting I use on the Simple Greylist for Exim, which gives me the ability to use SQL without maintaining a full blown database server.

If you want to build Exim from source under Debian (like what I did), at least you need to make sure you have the development file for SQLite ready and change the makefile for Exim accordingly. Install the necessary library with the following command:

DDoS attacks make Wikileaks a great botnet detection system

News about Wikileaks has been flooding the media recently. Due to its controversy, Wikileaks has been under several DDoS attacks for the past week. The data volume from the biggest attack is said to be higher than 10Gbps.

This specific event looks to me like a perfect chance for botnet detection. All the botnet detection systems employing passive approaches, like the "follow the spam" strategy I currently use, face the same problem, which is "how to attract botnets to contact the system?" Wikileaks does a great job without much effort in this regards (that is, attracting botnets).

Now if Wikileaks already has in place some capable web server and reverse proxy, like lighttpd, nginx or varnish, a few scripts running on their log files will quickly produce a list of suspected zombie computers. Notifying those unsuspecting victims of what happened will help fight botnets tremendously.

Thursday, February 4, 2010

How Many Bots Can a Greylisting System Detect?

According to a paper presented at TANET 2005（Taiwan Academic Network Conference 2005), titled "Spam Filtering with Open Source Software, and Some Hard Facts from NTU's Email System" (title translated by me, not necessarily correct), their daily mail volume was 800K, of which 58 per cent were blocked by greylisting.

I myself detected 3651 suspected bots while blocking 211178 spams yesterday, so if the folks at NTU (National Taiwan University) had a similiar bots/spam ratio, they would be able to detect (800K * 58% * 3651 / 211178) = 8021 bots daily in 2005. Though I believe greylisting should do much better than my current detection setup.

Now imagine what will happen if some large greylisting users, like Texas A&M University, SpamCop, and Computer Science in Aarhus (DAIMI), all contribute their logs: tens of thousands of bots will be uncovered every day.

For those of you interested in the paper mentioned above, remember that it is written in Chinese. If you can not read Chinese yourself, don't forget to find someone who can to help you:).

Saturday, November 14, 2009

Botnet Detection with Greylisting

So how do we uncover botnets? If you google for botnet tracking, you will find that honeypots are often listed in the first page of search results. The strength of honeypots lies in their effectiveness at collecting malware binaries, which are needed to gain a deeper understanding of botnets. As I only track botnets so as to notify unsuspecting victims, and have no interest nor expertise to study the inner working of malware, honeypots are not really made for me. How to attract botnets to interact with honeypots is also a problem.

As I said before, my botnet detection strategy is to follow the spam upstream. According to the Q2/June edition of the MessageLabs Intelligence monthly report, 83.2% of all spam was sent via botnets. The fact is, botnets has accounted for more than half of global spam for several years. Isn't that convenient for us if we want to find botnets? If you manage your own mail server, and get a lot of spam every day, perhaps your server have been interacting with botnets all the time. The remaining problem, is how to identify botnet computers.

Thanks to greylisting, mail servers can easily filter out incoming spam from botnets. The SMTP engines built within malware often are not full blown SMTP servers, as malware authors tend to cut off the retry function of SMTP protocol. Greylisting takes advantage of that and is able to differentiate botnet computers from real mail servers by their lack of retry behavior. To extend from this, mail sending hosts which could not pass greylisting are very likely to be botnet computers, which are exactly what we look for.

Greylisting is a very powerful botnet tracking technique. Once a botnet computer begins to send out malicious mail, be it spam, virus or phishing mail, it will soon be detected by greylisting. If mail servers deploying greylisting could contribute their mail logs to compile the IP address list of suspected botnet computers, the useful life of botnets to cyber criminals will be greatly shortened, which will eventually lead to the demise of botnets. At least it should reduce bot-sent spam to a minimun, I hope.

I have posted my greylisting implementation, comments or questions are welcomed.

Tuesday, October 27, 2009

My Botnet Detection System

In terms of hardware specification, my botnet detection system is nothing to brag about. It is a small VPS with mere 256MB RAM and 6GB storage space. Its limited CPU power proves not to be an obstacle, as the passive detection I employ is not CPU bound.

Its software is equally modest. My botnet detection strategy is to follow the spam upstream, so I just installed an SMTP server I am familiar with over a plain vanilla Debian 5 OS. Originally the maximum number of concurrent SMTP connections was set to 90, but later it has been raised to 180. In real world condition, I have witnessed the system handling 150+ incoming SMTP connections at the same time with ease.

Next time, I'll write about how to uncover botnet computers.

Rank	TCP port number	# of connection attempts received
1	23	43890
2	22	43593
3	4514	28609
4	2022	24653
5	30357	22377
6	48193	21779
7	445	14469
8	1428	11070
9	1059	10252
10	1069	10238

Daily Botnet Statistics

Sunday, June 29, 2025

Botnet Statistics [2025-06-28]