Botnet Statistics [2010-11-29]

I wrote about failure notices I got when sending notifications to CNCERT two weeks ago.  But then the problem disappeared before I had done anything about it.  I guess I was just lucky. 

I also send notifications about zombie computers in India to the CERT of India.  Unfortunately they began to reject my notifications two days ago.  I might not be so lucky this time...

detection period: 2010-11-29 00:00-23:59 UTC
total number of suspected botnet IPs: 2393
number of botnet IPs notified to network operators: 1949
number of blocked spams: 338506
recipient count of blocked spams: 11568541

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	462
2	BSNLNET	320
3	RCOM	59
4	AR-TEAR7-LACNIC	52
5	000.065.376/0002-65	36
6	TATACOMM-IN	35
7	002.558.134/0001-58	35
8	TRUENET	30
9	KORNET-KR	28
10	CAT-BB-NET	28

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	492
2	Taiwan	477
3	China	268
4	Brazil	224
5	Russian Federation	152
6	Thailand	106
7	Argentina	102
8	Ukraine	60
9	United States	54
10	South Korea	48

Botnet Statistics [2010-11-28]

I decommissioned one of my vpses yesterday, as its billing period will be up today.  So I have only two detection systems in operation for the time being.  I also got hold of some domains suitable for greylisting last week.  A lot of work need to be done before I can detect botnet computers with greylisting, but I have high hope for its detection capability.

detection period: 2010-11-28 00:00-23:59 UTC
total number of suspected botnet IPs: 2428
number of botnet IPs notified to network operators: 2013
number of blocked spams: 132822
recipient count of blocked spams: 4440382

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	529
2	BSNLNET	363
3	AR-TEAR7-LACNIC	76
4	UKRTELNET	52
5	RCOM	41
6	002.558.134/0001-58	40
7	TRUENET	36
8	KORNET-KR	35
9	000.065.376/0002-65	32
10	TATACOMM-IN	30

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	544
2	India	507
3	China	233
4	Russian Federation	181
5	Brazil	177
6	Argentina	135
7	Thailand	117
8	Ukraine	79
9	South Korea	53
10	United States	32

Botnet Statistics [2010-11-27]

detection period: 2010-11-27 00:00-23:59 UTC
total number of suspected botnet IPs: 1137
number of botnet IPs notified to network operators: 915
number of blocked spams: 408109
recipient count of blocked spams: 14027401

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	497
2	CHINANET-GD	39
3	KORNET-KR	15
4	CHINANET-ZJ-WZ	13
5	000.065.376/0002-65	12
6	UNICOM-SD	10
7	CHINANET-FJ	10
8	033.530.486/0001-29	10
9	CHINANET-ZJ	9
10	CHINANET-JS	9

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	510
2	China	160
3	Brazil	72
4	Russian Federation	45
5	United States	41
6	South Korea	29
7	India	21
8	Colombia	20
9	Germany	17
10	Indonesia	16

Botnet Statistics [2010-11-26]

detection period: 2010-11-26 00:00-23:59 UTC
total number of suspected botnet IPs: 1169
number of botnet IPs notified to network operators: 933
number of blocked spams: 493765
recipient count of blocked spams: 16903168

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	497
2	CHINANET-GD	39
3	000.065.376/0002-65	15
4	KORNET-KR	13
5	CHINANET-ZJ-WZ	13
6	UNICOM-TJ	11
7	UNICOM-SD	10
8	CHINANET-JS	10
9	003.420.926/0002-05	9
10	TFN-NET	8

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	511
2	China	166
3	Brazil	79
4	United States	53
5	Russian Federation	49
6	South Korea	29
7	Colombia	21
8	India	18
9	Germany	18
10	Indonesia	15

Botnet Statistics [2010-11-25]

detection period: 2010-11-25 00:00-23:59 UTC
total number of suspected botnet IPs: 1346
number of botnet IPs notified to network operators: 1089
number of blocked spams: 406644
recipient count of blocked spams: 13887642

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	507
2	CHINANET-GD	95
3	CHINANET-ZJ-WZ	19
4	KORNET-KR	14
5	000.065.376/0002-65	14
6	002.558.157/0001-62	11
7	UNICOM-TJ	10
8	CHINANET-JS	10
9	033.530.486/0001-29	10
10	003.420.926/0002-05	10

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	520
2	China	267
3	Brazil	87
4	United States	56
5	Russian Federation	53
6	South Korea	26
7	India	25
8	Colombia	24
9	Poland	21
10	Indonesia	20

Botnet Statistics [2010-11-24]

detection period: 2010-11-24 00:00-23:59 UTC
total number of suspected botnet IPs: 1289
number of botnet IPs notified to network operators: 1046
number of blocked spams: 368519
recipient count of blocked spams: 12409409

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	519
2	CHINANET-GD	115
3	KORNET-KR	16
4	CHINANET-ZJ-WZ	15
5	000.065.376/0002-65	13
6	CHINANET-JS	12
7	002.558.157/0001-62	11
8	UNICOM-SD	9
9	CHINANET-ZJ	9
10	076.535.764/0326-90	9

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	533
2	China	251
3	Brazil	81
4	Russian Federation	51
5	United States	46
6	South Korea	30
7	Thailand	21
8	India	19
9	Colombia	19
10	Ukraine	15

Botnet Statistics [2010-11-23]

detection period: 2010-11-23 00:00-23:59 UTC
total number of suspected botnet IPs: 1367
number of botnet IPs notified to network operators: 1093
number of blocked spams: 344224
recipient count of blocked spams: 11551330

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	486
2	000.065.376/0002-65	26
3	AR-TEAR7-LACNIC	17
4	TRUENET	16
5	CHINANET-ZJ-WZ	15
6	033.530.486/0001-29	14
7	002.558.157/0001-62	14
8	002.558.134/0001-58	14
9	KORNET-KR	13
10	CHINANET-GD	12

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	502
2	China	183
3	Brazil	130
4	Russian Federation	77
5	Thailand	47
6	United States	46
7	Argentina	40
8	India	35
9	South Korea	29
10	Colombia	26

Botnet Statistics [2010-11-22]

detection period: 2010-11-22 00:00-23:59 UTC
total number of suspected botnet IPs: 2535
number of botnet IPs notified to network operators: 2101
number of blocked spams: 373173
recipient count of blocked spams: 12470735

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	525
2	BSNLNET	342
3	RCOM	58
4	AR-TEAR7-LACNIC	54
5	TRUENET	44
6	CAT-BB-NET	42
7	002.558.134/0001-58	40
8	000.065.376/0002-65	37
9	TATACOMM-IN	36
10	UNICOM-SD	31

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	541
2	India	506
3	China	301
4	Brazil	230
5	Russian Federation	161
6	Thailand	141
7	Argentina	102
8	Ukraine	63
9	United States	45
10	Colombia	33

Botnet Statistics [2010-11-21]

detection period: 2010-11-21 00:00-23:59 UTC
total number of suspected botnet IPs: 2347
number of botnet IPs notified to network operators: 1910
number of blocked spams: 384464
recipient count of blocked spams: 12692141

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	524
2	BSNLNET	121
3	CHINANET-GD	120
4	AR-TEAR7-LACNIC	55
5	CAT-BB-NET	42
6	TRUEBB-NET	39
7	LASVEGASNETWORK	38
8	002.558.134/0001-58	36
9	UKRTELNET	35
10	000.065.376/0002-65	31

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	543
2	China	408
3	India	196
4	Brazil	179
5	Russian Federation	160
6	Thailand	139
7	Argentina	101
8	United States	97
9	Ukraine	75
10	South Korea	34

Botnet Statistics [2010-11-20]

detection period: 2010-11-20 00:00-23:59 UTC
total number of suspected botnet IPs: 3182
number of botnet IPs notified to network operators: 2697
number of blocked spams: 448414
recipient count of blocked spams: 14658745

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	509
2	CHINANET-GD	499
3	BSNLNET	352
4	AR-TEAR7-LACNIC	64
5	RCOM	60
6	CAT-BB-NET	48
7	TATACOMM-IN	45
8	UKRTELNET	41
9	LASVEGASNETWORK	39
10	002.558.134/0001-58	30

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	813
2	India	536
3	Taiwan	529
4	Brazil	216
5	Russian Federation	165
6	Thailand	132
7	United States	105
8	Argentina	104
9	Ukraine	90
10	Indonesia	35

Botnet Statistics [2010-11-19]

detection period: 2010-11-19 00:00-23:59 UTC
total number of suspected botnet IPs: 2542
number of botnet IPs notified to network operators: 2158
number of blocked spams: 191363
recipient count of blocked spams: 5560774

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	539
2	CHINANET-GD	278
3	BSNLNET	232
4	AR-TEAR7-LACNIC	62
5	RCOM	55
6	TATACOMM-IN	42
7	002.558.134/0001-58	41
8	UKRTELNET	39
9	CAT-BB-NET	39
10	000.065.376/0002-65	34

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	555
2	China	500
3	India	398
4	Brazil	231
5	Russian Federation	145
6	Thailand	123
7	Argentina	104
8	Ukraine	79
9	United States	34
10	Colombia	33

Botnet Statistics [2010-11-18]

detection period: 2010-11-18 00:00-23:59 UTC
total number of suspected botnet IPs: 2826
number of botnet IPs notified to network operators: 2408
number of blocked spams: 231663
recipient count of blocked spams: 7558923

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	532
2	HINET-NET	512
3	AR-TEAR7-LACNIC	75
4	RCOM	70
5	TATACOMM-IN	61
6	HATHWAY-NET	46
7	002.558.134/0001-58	46
8	000.065.376/0002-65	37
9	TRUEBB-NET	34
10	CAT-BB-NET	33

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	766
2	Taiwan	528
3	China	317
4	Brazil	261
5	Russian Federation	156
6	Argentina	125
7	Thailand	117
8	Ukraine	64
9	United States	43
10	Colombia	38

Botnet Statistics [2010-11-17]

detection period: 2010-11-17 00:00-23:59 UTC
total number of suspected botnet IPs: 3229
number of botnet IPs notified to network operators: 2809
number of blocked spams: 288266
recipient count of blocked spams: 9330792

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1151
2	BSNLNET	360
3	AR-TEAR7-LACNIC	68
4	RCOM	65
5	TATACOMM-IN	48
6	CAT-BB-NET	42
7	002.558.134/0001-58	42
8	HATHWAY-NET	38
9	TRUENET	33
10	076.535.764/0326-90	32

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1167
2	India	574
3	China	291
4	Brazil	254
5	Russian Federation	163
6	Thailand	132
7	Argentina	125
8	Ukraine	48
9	United States	37
10	Colombia	33

Botnet Statistics [2010-11-16]

To reduce the number of mail I have to send, I usually collect information about zombie computers within China in a single notification to CNCERT, National Computer network Emergency Response technical Team/Coordination Center of China.  And China has done a good job on botnet reduction for the past year, which leads to its absence from various reports on spam and botnets, like the "dirty dozen" by Sophos, the top 12 countries of spam source by M86 security, and the top 10 countries sending spam by ICSA Labs.  While China is still the all time number one for the Top Spam Server Countries of Project Honey Pot, it is now at number 17 of the last 30 days.

Since November 1 this year, I started to get failure notice for my notification to CNCERT, which seems to be caused by alias expansion to a mailbox exceeding its quota.   In the mean time, China started to move back up to number 14 on the Top Spam Server Countries of the last 7 days.  I might need to find another way soon to contact them before China returns to top 10 again.

detection period: 2010-11-16 00:00-23:59 UTC
total number of suspected botnet IPs: 3376
number of botnet IPs notified to network operators: 2993
number of blocked spams: 363063
recipient count of blocked spams: 12123150

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1351
2	BSNLNET	405
3	AR-TEAR7-LACNIC	63
4	RCOM	59
5	CAT-BB-NET	43
6	TATACOMM-IN	40
7	002.558.134/0001-58	37
8	TRUENET	33
9	TRUEBB-NET	33
10	HATHWAY-NET	32

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1361
2	India	590
3	China	295
4	Brazil	240
5	Russian Federation	146
6	Thailand	142
7	Argentina	118
8	Ukraine	53
9	United States	34
10	South Korea	34

Botnet Statistics [2010-11-15]

detection period: 2010-11-15 00:00-23:59 UTC
total number of suspected botnet IPs: 3265
number of botnet IPs notified to network operators: 2834
number of blocked spams: 380185
recipient count of blocked spams: 12746466

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1349
2	BSNLNET	356
3	AR-TEAR7-LACNIC	62
4	RCOM	56
5	TATACOMM-IN	49
6	CAT-BB-NET	36
7	TRUEBB-NET	35
8	HATHWAY-NET	32
9	000.065.376/0002-65	29
10	TRUENET	28

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1360
2	India	543
3	China	283
4	Brazil	189
5	Russian Federation	146
6	Thailand	136
7	Argentina	109
8	Ukraine	48
9	United States	40
10	South Korea	28

Merely taking C&C servers offline is not going to destroy botnets

Everybody knows that the destructive power of botnets lies in their massive number.  While those malware-infected computers often have unpatched vulnerabilities, which makes them easy to compromise, it still takes a long time to get hold of so many computers.  The only reason hackers can construct botnets is because most victims are completely unaware that their computers have been compromised.

Now most botnet mitigation efforts, from the disconnection of McColo in 2008 to the recent Bredolab takedown by Dutch police, try to bring down botnets by taking C&C servers offline.  While it is a good step, merely doing that is not enough.  They often fail to notify the victims.  Thus the vulnerabilities within those zombie computers will remain unfixed, and it is just a matter of time before hackers take control of those computers again.  In my point of view, botnet notification should be a priority, so victims can fix the security loopholes inside their computers.

Notifying victims also addresses other problems.  For example, botnets can collect data about people, which are sometimes used in phone scams.  If victims know their computers have been compromised, they will beware of suspicious phone calls, and change their passwords as soon as possible.  That helps to limit the scope of damage caused by botnets.

Botnet Statistics [2010-11-14]

detection period: 2010-11-14 00:00-23:59 UTC
total number of suspected botnet IPs: 2918
number of botnet IPs notified to network operators: 2557
number of blocked spams: 401636
recipient count of blocked spams: 13425377

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1468
2	BSNLNET	128
3	CAT-BB-NET	37
4	TRUEBB-NET	36
5	AR-TEAR7-LACNIC	34
6	TRUENET	31
7	000.065.376/0002-65	31
8	RCOM	28
9	CHINANET-ZJ-WZ	27
10	UNICOM-SD	26

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1479
2	China	279
3	India	203
4	Brazil	176
5	Thailand	131
6	Russian Federation	105
7	Argentina	74
8	United States	47
9	Ukraine	45
10	South Korea	32

Botnet Statistics [2010-11-13]

detection period: 2010-11-13 00:00-23:59 UTC
total number of suspected botnet IPs: 3154
number of botnet IPs notified to network operators: 2775
number of blocked spams: 391839
recipient count of blocked spams: 12984415

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1479
2	BSNLNET	235
3	AR-TEAR7-LACNIC	52
4	RCOM	47
5	000.065.376/0002-65	28
6	CAT-BB-NET	27
7	002.558.134/0001-58	27
8	TRUENET	26
9	TATACOMM-IN	26
10	HATHWAY-NET	23

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1492
2	India	381
3	China	262
4	Brazil	210
5	Russian Federation	131
6	Thailand	100
7	Argentina	96
8	United States	48
9	Ukraine	44
10	Indonesia	32

Botnet Statistics [2010-11-12]

detection period: 2010-11-12 00:00-23:59 UTC
total number of suspected botnet IPs: 3698
number of botnet IPs notified to network operators: 3238
number of blocked spams: 348619
recipient count of blocked spams: 11262658

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1401
2	BSNLNET	474
3	RCOM	73
4	AR-TEAR7-LACNIC	55
5	TATACOMM-IN	54
6	002.558.134/0001-58	40
7	000.065.376/0002-65	38
8	HATHWAY-NET	35
9	CAT-BB-NET	34
10	076.535.764/0326-90	33

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1415
2	India	704
3	China	319
4	Brazil	279
5	Russian Federation	144
6	Thailand	113
7	Argentina	109
8	Ukraine	56
9	United States	54
10	Indonesia	39

Botnet Statistics [2010-11-11]

detection period: 2010-11-11 00:00-23:59 UTC
total number of suspected botnet IPs: 3776
number of botnet IPs notified to network operators: 3250
number of blocked spams: 378879
recipient count of blocked spams: 12568860

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1558
2	BSNLNET	408
3	AR-TEAR7-LACNIC	72
4	RCOM	69
5	002.558.134/0001-58	49
6	CAT-BB-NET	43
7	TATACOMM-IN	40
8	000.065.376/0002-65	39
9	076.535.764/0326-90	34
10	002.558.157/0001-62	33

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1570
2	India	600
3	China	340
4	Brazil	291
5	Russian Federation	155
6	Argentina	127
7	Thailand	115
8	Ukraine	59
9	United States	48
10	Colombia	36

Botnet Statistics [2010-11-10]

detection period: 2010-11-10 00:00-23:59 UTC
total number of suspected botnet IPs: 3515
number of botnet IPs notified to network operators: 2980
number of blocked spams: 294536
recipient count of blocked spams: 9348965

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1346
2	BSNLNET	431
3	AR-TEAR7-LACNIC	82
4	RCOM	57
5	TATACOMM-IN	50
6	002.558.134/0001-58	43
7	000.065.376/0002-65	41
8	CAT-BB-NET	38
9	076.535.764/0326-90	34
10	HATHWAY-NET	33

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1357
2	India	637
3	China	292
4	Brazil	274
5	Russian Federation	161
6	Argentina	130
7	Thailand	119
8	Ukraine	49
9	United States	40
10	Colombia	35

Botnet Statistics [2010-11-09]

detection period: 2010-11-09 00:00-23:59 UTC
total number of suspected botnet IPs: 2762
number of botnet IPs notified to network operators: 2299
number of blocked spams: 457837
recipient count of blocked spams: 15567843

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1132
2	BSNLNET	205
3	AR-TEAR7-LACNIC	55
4	000.065.376/0002-65	37
5	002.558.134/0001-58	33
6	RCOM	31
7	CAT-BB-NET	31
8	076.535.764/0326-90	25
9	TRUEBB-NET	23
10	TRUENET	21

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1141
2	India	318
3	China	246
4	Brazil	221
5	Russian Federation	134
6	Argentina	100
7	Thailand	98
8	United States	47
9	Ukraine	47
10	Colombia	34

Botnet Statistics [2010-11-08]

detection period: 2010-11-08 00:00-23:59 UTC
total number of suspected botnet IPs: 2671
number of botnet IPs notified to network operators: 2244
number of blocked spams: 493310
recipient count of blocked spams: 17069546

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1208
2	BSNLNET	158
3	AR-TEAR7-LACNIC	40
4	000.065.376/0002-65	37
5	CAT-BB-NET	33
6	002.558.134/0001-58	33
7	003.420.926/0002-05	26
8	076.535.764/0326-90	25
9	002.558.157/0001-62	24
10	RCOM	22

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1219
2	India	247
3	Brazil	231
4	China	228
5	Russian Federation	106
6	Thailand	87
7	Argentina	71
8	United States	47
9	Ukraine	44
10	Colombia	35

Botnet Statistics [2010-11-07]

detection period: 2010-11-07 00:00-23:59 UTC
total number of suspected botnet IPs: 2782
number of botnet IPs notified to network operators: 2354
number of blocked spams: 450059
recipient count of blocked spams: 15035374

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1387
2	BSNLNET	94
3	AR-TEAR7-LACNIC	56
4	000.065.376/0002-65	35
5	CAT-BB-NET	34
6	TRUENET	25
7	UNICOM-SD	24
8	002.558.134/0001-58	23
9	CHINANET-GD	21
10	076.535.764/0326-90	21

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1403
2	China	236
3	Brazil	200
4	India	152
5	Russian Federation	122
6	Thailand	104
7	Argentina	96
8	United States	40
9	Ukraine	39
10	Colombia	31

Botnet Statistics [2010-11-06]

detection period: 2010-11-06 00:00-23:59 UTC
total number of suspected botnet IPs: 3045
number of botnet IPs notified to network operators: 2592
number of blocked spams: 424488
recipient count of blocked spams: 14200845

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1404
2	BSNLNET	186
3	AR-TEAR7-LACNIC	78
4	CAT-BB-NET	37
5	000.065.376/0002-65	35
6	002.558.134/0001-58	32
7	UNICOM-SD	30
8	TATACOMM-IN	25
9	RCOM	25
10	002.558.157/0001-62	25

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1419
2	India	288
3	China	271
4	Brazil	230
5	Russian Federation	129
6	Argentina	121
7	Thailand	93
8	United States	42
9	Ukraine	41
10	Colombia	38

Botnet Statistics [2010-11-05]

detection period: 2010-11-05 00:00-23:59 UTC
total number of suspected botnet IPs: 2703
number of botnet IPs notified to network operators: 2316
number of blocked spams: 225196
recipient count of blocked spams: 6585880

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1413
2	BSNLNET	57
3	AR-TEAR7-LACNIC	54
4	002.558.134/0001-58	39
5	000.065.376/0002-65	35
6	CHINANET-ZJ-WZ	29
7	CAT-BB-NET	29
8	002.558.157/0001-62	28
9	033.530.486/0001-29	24
10	TRUENET	23

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1423
2	Brazil	239
3	China	235
4	India	115
5	Russian Federation	96
6	Argentina	94
7	Thailand	76
8	Colombia	40
9	United States	38
10	Ukraine	37

Botnet Statistics [2010-11-04]

detection period: 2010-11-04 00:00-23:59 UTC
total number of suspected botnet IPs: 1968
number of botnet IPs notified to network operators: 1746
number of blocked spams: 229075
recipient count of blocked spams: 6951935

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1375
2	CHINANET-ZJ-WZ	17
3	003.420.926/0002-05	16
4	000.065.376/0002-65	14
5	CHINANET-GD	12
6	CHINANET-FJ	11
7	UNICOM-SD	10
8	KORNET-KR	10
9	033.530.486/0001-29	9
10	002.558.157/0001-62	9

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1384
2	China	129
3	Brazil	92
4	Russian Federation	42
5	United States	34
6	India	22
7	Indonesia	19
8	South Korea	18
9	Colombia	18
10	Thailand	14

Botnet Statistics [2010-11-03]

detection period: 2010-11-03 00:00-23:59 UTC
total number of suspected botnet IPs: 3150
number of botnet IPs notified to network operators: 2753
number of blocked spams: 306931
recipient count of blocked spams: 9543006

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1424
2	BSNLNET	419
3	RCOM	63
4	TATACOMM-IN	55
5	AR-TEAR7-LACNIC	32
6	000.065.376/0002-65	31
7	CAT-BB-NET	29
8	HATHWAY-NET	24
9	003.420.926/0002-05	24
10	UNICOM-SD	22

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1433
2	India	612
3	China	263
4	Brazil	173
5	Russian Federation	94
6	Thailand	72
7	Argentina	69
8	Indonesia	37
9	United States	35
10	Colombia	28

Botnet Statistics [2010-11-02]

detection period: 2010-11-02 00:00-23:59 UTC
total number of suspected botnet IPs: 3975
number of botnet IPs notified to network operators: 3392
number of blocked spams: 332668
recipient count of blocked spams: 10554495

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1428
2	BSNLNET	651
3	RCOM	93
4	AR-TEAR7-LACNIC	73
5	TATACOMM-IN	61
6	CAT-BB-NET	49
7	HATHWAY-NET	40
8	UNICOM-SD	38
9	000.065.376/0002-65	36
10	CHINANET-GD	35

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1438
2	India	921
3	China	389
4	Brazil	225
5	Russian Federation	152
6	Thailand	128
7	Argentina	125
8	Ukraine	48
9	United States	44
10	Indonesia	40

Botnet Statistics [2010-11-01]

detection period: 2010-11-01 00:00-23:59 UTC
total number of suspected botnet IPs: 3702
number of botnet IPs notified to network operators: 3141
number of blocked spams: 322848
recipient count of blocked spams: 10346545

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1337
2	BSNLNET	475
3	AR-TEAR7-LACNIC	88
4	RCOM	73
5	002.558.134/0001-58	65
6	TATACOMM-IN	61
7	CAT-BB-NET	42
8	HATHWAY-NET	39
9	000.065.376/0002-65	35
10	TRUENET	33

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1352
2	India	732
3	China	346
4	Brazil	286
5	Argentina	149
6	Russian Federation	138
7	Thailand	123
8	Ukraine	48
9	Indonesia	45
10	United States	42

Botnet Statistics for October 2010

detection period: 2010-10-01 00:00 - 2010-10-31 23:59 UTC
total number of suspected botnet IPs: 45210
number of blocked spams: 12852722
recipient count of blocked spams: 422888928

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	17046
2	India	13469
3	China	3205
4	Brazil	2430
5	Argentina	1810
6	Russian Federation	1531
7	Thailand	1395
8	Ukraine	610
9	Mexico	371
10	Uruguay	339
11	Ethiopia	270
12	United States	256
13	Belarus	188
14	Indonesia	183
15	South Korea	167
16	Germany	148
17	Chile	146
18	Colombia	136
19	Kazakhstan	119
20	Japan	103
21	Algeria	86
22	France	70
23	Italy	68
24	Hong Kong	67
25	Poland	62

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	2103799
2	Taiwan	1686939
3	Brazil	1610881
4	United States	1327674
5	Russian Federation	713575
6	India	536008
7	Colombia	480263
8	Thailand	367951
9	Indonesia	267641
10	South Korea	205043
11	France	189044
12	Italy	188119
13	Germany	183637
14	Poland	173690
15	Argentina	155478
16	Ukraine	144311
17	Iraq	129850
18	Philippines	110608
19	Czech Republic	104275
20	Australia	103758
21	Canada	95906
22	Mexico	91376
23	Hong Kong	89559
24	United Kingdom	83852
25	Peru	83298

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2010-10-31]

detection period: 2010-10-31 00:00-23:59 UTC
total number of suspected botnet IPs: 2915
number of botnet IPs notified to network operators: 2425
number of blocked spams: 461402
recipient count of blocked spams: 15529237

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1406
2	BSNLNET	91
3	AR-TEAR7-LACNIC	66
4	CAT-BB-NET	37
5	TRUENET	31
6	000.065.376/0002-65	29
7	002.558.134/0001-58	28
8	033.530.486/0001-29	24
9	RCOM	20
10	003.420.926/0002-05	19

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1415
2	China	273
3	Brazil	190
4	India	165
5	Russian Federation	125
6	Argentina	116
7	Thailand	108
8	United States	50
9	Ukraine	44
10	South Korea	31