Botnet Statistics for the year of 2017

detection period: 2017-01-01 00:00 - 2017-12-31 23:59 UTC
total number of suspected botnet IPs: 103740
number of blocked spams: 17220086
recipient count of blocked spams: 369595290
detection methods: fake open relay + greylisting

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	44902
2	Taiwan	19140
3	Viet Nam	8333
4	United States	7619
5	India	3218
6	Ukraine	1738
7	Brazil	1456
8	Russian Federation	1107
9	Netherlands	953
10	Iran	820
11	Mexico	775
12	United Kingdom	718
13	Indonesia	598
14	Turkey	558
15	Italy	535
16	Colombia	496
17	Poland	489
18	Peru	489
19	Argentina	453
20	South Korea	439
21	Thailand	420
22	Romania	412
23	Hong Kong	398
24	Pakistan	386
25	Bulgaria	341

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	4531866
2	Taiwan	3890439
3	United States	3012233
4	Brazil	840434
5	South Korea	602432
6	Russian Federation	462929
7	Poland	340562
8	Netherlands	323180
9	Hong Kong	311700
10	Ukraine	276767
11	Germany	263873
12	United Kingdom	248179
13	Canada	241403
14	Czech Republic	205562
15	Venezuela	187789
16	Azerbaijan	150585
17	India	117025
18	Romania	102556
19	South Africa	91706
20	Singapore	73829
21	Norway	63083
22	Italy	57475
23	Israel	56881
24	France	50498
25	Belize	48602

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics for the year of 2016

detection period: 2016-01-01 00:00 - 2016-12-31 23:59 UTC
total number of suspected botnet IPs: 277464
number of blocked spams: 4349886
recipient count of blocked spams: 55283278
detection methods: fake open relay + greylisting

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	95112
2	Taiwan	47932
3	Viet Nam	26200
4	India	22097
5	Mexico	12547
6	Iran	6308
7	Brazil	5402
8	Colombia	3633
9	Turkey	3611
10	Indonesia	3423
11	Pakistan	3408
12	United States	3315
13	Peru	2773
14	Tunisia	1720
15	Thailand	1498
16	Bangladesh	1477
17	Argentina	1452
18	Romania	1391
19	Russian Federation	1354
20	Italy	1310
21	Venezuela	1269
22	Arab Emirates	1267
23	Philippines	1210
24	Poland	1135
25	Bolivia	1090

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	Taiwan	1448316
2	China	1168680
3	United States	665790
4	Poland	499047
5	Brazil	210130
6	Mexico	65594
7	Germany	40658
8	Thailand	21382
9	India	20017
10	Romania	18195
11	Hong Kong	13715
12	Turkey	12433
13	Italy	11855
14	Russian Federation	11528
15	Slovenia	10707
16	Colombia	10418
17	France	9188
18	Viet Nam	9010
19	South Korea	8593
20	Bolivia	5335
21	Argentina	4944
22	United Kingdom	4870
23	Sweden	4663
24	Spain	4642
25	Philippines	4093

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics for the year of 2015

detection period: 2015-01-01 00:00 - 2015-12-31 23:59 UTC
total number of suspected botnet IPs: 462099
number of blocked spams: 37360084
recipient count of blocked spams: 1077604616
detection methods: fake open relay + greylisting

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	206035
2	China	177411
3	Viet Nam	13324
4	United States	12622
5	Russian Federation	4432
6	India	3569
7	Turkey	2976
8	Brazil	2571
9	South Korea	2238
10	Ukraine	1986
11	Argentina	1893
12	Spain	1879
13	Mexico	1790
14	France	1707
15	Germany	1558
16	United Kingdom	1428
17	Italy	1301
18	Canada	1240
19	Indonesia	1220
20	Romania	1033
21	Poland	889
22	Colombia	875
23	Chile	863
24	Kazakhstan	760
25	Iran	707

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	Taiwan	26302367
2	United States	3720433
3	China	2119211
4	Germany	795391
5	Brazil	517488
6	Indonesia	461086
7	France	282809
8	Hong Kong	250020
9	Iran	230364
10	Russian Federation	207808
11	South Korea	202869
12	Viet Nam	191202
13	Bangladesh	186049
14	Australia	172749
15	Malaysia	127584
16	India	122121
17	Saudi Arabia	114007
18	Turkey	111692
19	Ivory Coast	99175
20	Poland	92103
21	Ukraine	77147
22	Mongolia	72576
23	Italy	64276
24	Ecuador	58102
25	United Kingdom	57631

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics for the year of 2014

detection period: 2014-01-01 00:00 - 2014-12-31 23:59 UTC
total number of suspected botnet IPs: 476581
number of blocked spams: 26490538
recipient count of blocked spams: 847739355
detection methods: fake open relay + greylisting

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	331136
2	Taiwan	63427
3	United States	8916
4	Viet Nam	8791
5	India	5983
6	Russian Federation	5008
7	Argentina	2991
8	Italy	2559
9	South Korea	2511
10	Brazil	2506
11	United Kingdom	2464
12	Peru	2401
13	France	2220
14	Indonesia	1651
15	Spain	1609
16	Chile	1565
17	Germany	1479
18	Colombia	1464
19	Poland	1424
20	Turkey	1367
21	Mexico	1272
22	Ukraine	1175
23	Iran	1134
24	Isreal	1049
25	Kazakhstan	1034

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	Taiwan	12013880
2	China	6660858
3	United States	1149260
4	Brazil	749321
5	Russian Federation	715848
6	Indonesia	663566
7	Hong Kong	332272
8	Saudi Arabia	300162
9	Iran	272697
10	Ukraine	269034
11	India	189967
12	South Korea	184997
13	Viet Nam	179720
14	Poland	169709
15	United Kingdom	154353
16	Malaysia	150996
17	Turkey	149129
18	Colombia	148257
19	Ivory Coast	135947
20	Italy	129012
21	Thailand	117765
22	Germany	102325
23	Bangladesh	102004
24	Philippines	83772
25	France	74414

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics for the year of 2013

detection period: 2013-01-01 00:00 - 2013-12-31 23:59 UTC
total number of suspected botnet IPs: 778866
number of blocked spams: 28179569
recipient count of blocked spams: 955885959
detection methods: fake open relay + greylisting

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	369154
2	Taiwan	102278
3	Belarus	46978
4	United States	35984
5	Kazakhstan	17177
6	India	15853
7	Ukraine	12413
8	Viet Nam	11292
9	Spain	10118
10	Argentina	9909
11	Peru	9839
12	Russian Federation	8655
13	Colombia	7655
14	Italy	7523
15	United Kingdom	6824
16	Mexico	6634
17	Iran	6276
18	Brazil	5781
19	Germany	5725
20	Poland	5161
21	Romania	4212
22	Canada	3955
23	South Korea	3898
24	Chile	3857
25	Turkey	3822

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	Taiwan	6339165
2	China	5870709
3	Brazil	2849191
4	United States	2275300
5	Russian Federation	1560085
6	United Kingdom	691147
7	Iran	515977
8	India	509058
9	Ukraine	483038
10	South Korea	470287
11	France	415739
12	Colombia	328107
13	Germany	300302
14	Indonesia	293460
15	Thailand	268891
16	Peru	267810
17	Poland	245957
18	Argentina	236023
19	Mexico	233041
20	Kuwait	222378
21	Saudi Arabia	179580
22	Pakistan	157184
23	Hong Kong	157036
24	Philippines	154559
25	Israel	150750

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics for the year of 2012

detection period: 2012-01-01 00:00 - 2012-12-31 23:59 UTC
total number of suspected botnet IPs: 487145
number of blocked spams: 51254364
recipient count of blocked spams: 1719754924
detection methods: fake open relay + greylisting

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	158154
2	Taiwan	60135
3	India	36298
4	Viet Nam	17675
5	United States	15516
6	Russian Federation	14121
7	Brazil	13094
8	Indonesia	12655
9	Pakistan	11649
10	South Korea	10791
11	Peru	8424
12	Poland	7564
13	Argentina	6997
14	Iran	5832
15	Kazakhstan	5533
16	Romania	5450
17	Colombia	5346
18	Belarus	5004
19	Spain	4797
20	Ukraine	4728
21	Germany	4124
22	Chile	3782
23	Saudi Arabia	3714
24	Mexico	3250
25	Italy	3081

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	10723842
2	Brazil	6475326
3	United States	4709454
4	Russian Federation	3058489
5	Taiwan	2836443
6	India	1693333
7	South Korea	1516794
8	Germany	1261333
9	France	1203345
10	Ukraine	1167266
11	United Kingdom	1095941
12	Indonesia	955286
13	Netherlands	893971
14	Canada	807871
15	Iran	712989
16	Colombia	617621
17	Poland	605354
18	Mexico	604618
19	Viet Nam	477857
20	Thailand	452145
21	Hong Kong	437928
22	Italy	432666
23	Argentina	408383
24	Czech Republic	388182
25	Chile	339323

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics for the year of 2011

detection period: 2011-01-01 00:00 - 2011-12-31 23:59 UTC
total number of suspected botnet IPs: 380460
number of blocked spams: 38914483
recipient count of blocked spams: 1223285076

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	84684
2	India	52392
3	Taiwan	39729
4	Russian Federation	21648
5	Brazil	18039
6	Viet Nam	13782
7	South Korea	13515
8	Indonesia	11933
9	Ukraine	10211
10	Pakistan	7769
11	United States	6921
12	Argentina	6570
13	Belarus	5689
14	Poland	5147
15	Colombia	3959
16	Thailand	3935
17	Kazakhstan	3721
18	Romania	3639
19	Peru	3000
20	Italy	2884
21	Germany	2841
22	Spain	2835
23	Serbia	2803
24	Chile	2743
25	Saudi Arabia	2572

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	9816412
2	Brazil	4190815
3	United States	2788793
4	Taiwan	2588712
5	Russian Federation	1701130
6	India	1613433
7	Indonesia	1109140
8	France	1097131
9	Colombia	1027442
10	South Korea	734183
11	Thailand	732573
12	Ukraine	715576
13	Germany	707242
14	Poland	569829
15	Italy	450460
16	Mexico	429969
17	Viet Nam	389127
18	Czech Republic	386720
19	Argentina	380784
20	United Kingdom	369401
21	Chile	354747
22	Iran	315707
23	Philippines	311967
24	Canada	289399
25	European Union	282641

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics for the year of 2010

My detection systems have been working throughout 2010. It would be interesting to summarize my data for the whole year. Because some ip blocks are missing from my network mapping table, around 4000 botnet IPs could not be mapped to the networks they belong to. I am a bit lazy recently, so I decide not to amend the mapping table this time, and release the yearly statistics without the top 25 networks.

In terms of number of bots, I expected China or Taiwan to take the crown, but to my surprise, India tops the list by a large margin. The top 6 countries are India, China, Brazil, Taiwan, Argentina, and Russian Federation. All but Argentina have been regulars on my botnet charts. Argentina has been successfully staying out of my daily chart for some time.

My statistics is by no means complete. It just describes the bots I found with the particular detection mechanism I use, which are fake open relays. Botnet detection with other means may come out with vastly different results.

detection period: 2010-01-01 00:00 - 2010-12-31 23:59 UTC
total number of suspected botnet IPs: 414398
number of blocked spams: 79256717
recipient count of blocked spams: 2328674624

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	152502
2	China	83429
3	Brazil	43875
4	Taiwan	32981
5	Argentina	25599
6	Russian Federation	15658
7	Thailand	12348
8	United States	6342
9	Ukraine	5434
10	Uruguay	3883
11	Mexico	3759
12	Ethiopia	2376
13	Chile	2069
14	Belarus	1699
15	Germany	1621
16	South Korea	1396
17	Kazakhstan	1357
18	Colombia	1353
19	Indonesia	1264
20	Algeria	1175
21	France	1057
22	Japan	999
23	Hong Kong	718
24	Italy	644
25	Spain	593

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	19216036
2	Taiwan	10256800
3	Brazil	8999024
4	United States	5823431
5	India	4072434
6	Russian Federation	3738420
7	Colombia	2414074
8	Thailand	1928087
9	Indonesia	1578363
10	Argentina	1351358
11	South Korea	1160235
12	France	1153097
13	Germany	1133384
14	Poland	1110894
15	Ukraine	964565
16	Italy	816715
17	United Kingdom	590121
18	Malaysia	573573
19	Mexico	530913
20	Iran	465483
21	Philippines	460976
22	Czech Republic	460585
23	Chile	451506
24	Saudi Arabia	410480
25	Turkey	375195

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are: