Botnet Statistics [2010-12-30]

detection period: 2010-12-30 00:00-23:59 UTC
total number of suspected botnet IPs: 1839
number of botnet IPs notified to network operators: 1374
number of blocked spams: 189188
recipient count of blocked spams: 6141358

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	179
2	HINET-NET	157
3	AR-TEAR7-LACNIC	44
4	RCOM	42
5	000.065.376/0002-65	40
6	TRUEBB-NET	33
7	TRUENET	30
8	002.558.134/0001-58	29
9	TATACOMM-IN	23
10	HATHWAY-NET	21

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	308
2	China	263
3	Brazil	200
4	Taiwan	164
5	Russian Federation	115
6	Thailand	109
7	Argentina	83
8	United States	54
9	Ukraine	50
10	South Korea	44

Botnet Statistics [2010-12-29]

detection period: 2010-12-29 00:00-23:59 UTC
total number of suspected botnet IPs: 1662
number of botnet IPs notified to network operators: 1234
number of blocked spams: 301453
recipient count of blocked spams: 10398196

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	182
2	HINET-NET	137
3	RCOM	36
4	AR-TEAR7-LACNIC	32
5	TRUENET	29
6	000.065.376/0002-65	27
7	CAT-BB-NET	25
8	002.558.134/0001-58	25
9	CHINANET-ZJ-WZ	23
10	TATACOMM-IN	20

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	295
2	China	242
3	Brazil	173
4	Taiwan	146
5	Russian Federation	111
6	Thailand	100
7	Argentina	54
8	United States	48
9	Kazakhstan	47
10	South Korea	43

Botnet Statistics [2010-12-28]

detection period: 2010-12-28 00:00-23:59 UTC
total number of suspected botnet IPs: 1719
number of botnet IPs notified to network operators: 1275
number of blocked spams: 338707
recipient count of blocked spams: 11668355

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	215
2	HINET-NET	122
3	000.065.376/0002-65	32
4	RCOM	29
5	HATHWAY-NET	26
6	AR-TEAR7-LACNIC	25
7	TATACOMM-IN	24
8	KORNET-KR	23
9	CHINANET-JS	23
10	CHINANET-GD	23

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	332
2	China	276
3	Brazil	166
4	Taiwan	133
5	Russian Federation	104
6	Thailand	81
7	Argentina	52
8	United States	48
9	South Korea	47
10	Kazakhstan	39

Botnet Statistics [2010-12-27]

detection period: 2010-12-27 00:00-23:59 UTC
total number of suspected botnet IPs: 1825
number of botnet IPs notified to network operators: 1379
number of blocked spams: 338812
recipient count of blocked spams: 11648076

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	209
2	HINET-NET	151
3	RCOM	43
4	CAT-BB-NET	35
5	TATACOMM-IN	30
6	AR-TEAR7-LACNIC	29
7	KORNET-KR	27
8	002.558.134/0001-58	25
9	000.065.376/0002-65	25
10	TRUENET	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	341
2	China	280
3	Brazil	170
4	Taiwan	161
5	Russian Federation	113
6	Thailand	105
7	Argentina	61
8	South Korea	50
9	Ukraine	49
10	United States	45

Botnet Statistics [2010-12-26]

detection period: 2010-12-26 00:00-23:59 UTC
total number of suspected botnet IPs: 1162
number of botnet IPs notified to network operators: 823
number of blocked spams: 336277
recipient count of blocked spams: 11602651

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	128
2	KORNET-KR	25
3	AR-TEAR7-LACNIC	19
4	000.065.376/0002-65	19
5	UNICOM-SD	16
6	CHINANET-GD	16
7	CHINANET-ZJ-WZ	15
8	CHINANET-JS	15
9	033.530.486/0001-29	12
10	TRUENET	11

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	232
2	Taiwan	135
3	Brazil	93
4	Russian Federation	69
5	Thailand	53
6	South Korea	45
7	United States	41
8	Argentina	38
9	India	37
10	Ukraine	34

Botnet Statistics [2010-12-25]

detection period: 2010-12-25 00:00-23:59 UTC
total number of suspected botnet IPs: 866
number of botnet IPs notified to network operators: 594
number of blocked spams: 257664
recipient count of blocked spams: 8618884

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	96
2	KORNET-KR	16
3	CHINANET-ZJ-WZ	14
4	CHINANET-JS	14
5	CHINANET-GD	14
6	UNICOM-SD	13
7	CHINANET-FJ	10
8	CO-ACSA-LACNIC	9
9	AKIMPOD	9
10	033.530.486/0001-29	9

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	196
2	Taiwan	105
3	Brazil	66
4	Russian Federation	41
5	United States	40
6	South Korea	34
7	Kazakhstan	28
8	India	24
9	Poland	21
10	Ukraine	19

Botnet Statistics [2010-12-24]

detection period: 2010-12-24 00:00-23:59 UTC
total number of suspected botnet IPs: 922
number of botnet IPs notified to network operators: 642
number of blocked spams: 326014
recipient count of blocked spams: 11156661

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	110
2	KORNET-KR	18
3	CHINANET-GD	16
4	AKIMPOD	15
5	CHINANET-JS	13
6	033.530.486/0001-29	13
7	UNICOM-SD	12
8	003.420.926/0002-05	10
9	CO-ACSA-LACNIC	9
10	CHINANET-ZJ-WZ	9

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	187
2	Taiwan	119
3	Brazil	76
4	Russian Federation	53
5	United States	37
6	Kazakhstan	36
7	South Korea	35
8	India	26
9	Colombia	23
10	Poland	21

Botnet Statistics [2010-12-23]

detection period: 2010-12-23 00:00-23:59 UTC
total number of suspected botnet IPs: 1007
number of botnet IPs notified to network operators: 714
number of blocked spams: 321749
recipient count of blocked spams: 11084589

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	105
2	HINET-NET	98
3	CHINANET-ZJ-WZ	17
4	033.530.486/0001-29	14
5	CHINANET-JS	13
6	AKIMPOD	13
7	UNICOM-SD	12
8	KORNET-KR	12
9	003.420.926/0002-05	11
10	002.558.134/0001-58	11

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	271
2	Taiwan	110
3	Brazil	91
4	Russian Federation	52
5	United States	39
6	Kazakhstan	32
7	South Korea	26
8	Indonesia	24
9	Poland	23
10	India	23

Botnet Statistics [2010-12-22]

detection period: 2010-12-22 00:00-23:59 UTC
total number of suspected botnet IPs: 1261
number of botnet IPs notified to network operators: 978
number of blocked spams: 330681
recipient count of blocked spams: 11296187

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	357
2	HINET-NET	63
3	CHINANET-ZJ-WZ	27
4	KORNET-KR	17
5	CHINANET-JS	15
6	033.530.486/0001-29	14
7	UNICOM-SD	13
8	003.420.926/0002-05	13
9	AKIMPOD	11
10	CO-ACSA-LACNIC	9

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	553
2	Brazil	92
3	Taiwan	74
4	Russian Federation	47
5	United States	43
6	South Korea	32
7	Kazakhstan	27
8	India	25
9	Poland	23
10	Ukraine	21

Botnet Statistics [2010-12-21]

detection period: 2010-12-21 00:00-23:59 UTC
total number of suspected botnet IPs: 1103
number of botnet IPs notified to network operators: 831
number of blocked spams: 330170
recipient count of blocked spams: 11275416

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	276
2	KORNET-KR	16
3	CHINANET-ZJ-WZ	15
4	033.530.486/0001-29	15
5	CHINANET-JS	13
6	UNICOM-SD	12
7	003.420.926/0002-05	12
8	AKIMPOD	11
9	000.065.376/0002-65	11
10	CO-ACSA-LACNIC	8

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	442
2	Brazil	97
3	Russian Federation	56
4	United States	40
5	South Korea	35
6	Poland	27
7	Kazakhstan	26
8	Colombia	23
9	India	22
10	Ukraine	21

Botnet Statistics [2010-12-20]

detection period: 2010-12-20 00:00-23:59 UTC
total number of suspected botnet IPs: 1015
number of botnet IPs notified to network operators: 725
number of blocked spams: 326418
recipient count of blocked spams: 11134893

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	189
2	KORNET-KR	18
3	CHINANET-ZJ-WZ	15
4	CHINANET-JS	15
5	033.530.486/0001-29	14
6	UNICOM-SD	13
7	003.420.926/0002-05	12
8	AKIMPOD	11
9	000.065.376/0002-65	9
10	CO-ACSA-LACNIC	8

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	356
2	Brazil	86
3	Russian Federation	59
4	United States	45
5	South Korea	34
6	Poland	26
7	India	25
8	Kazakhstan	23
9	Ukraine	22
10	Colombia	22

Botnet Statistics [2010-12-19]

detection period: 2010-12-19 00:00-23:59 UTC
total number of suspected botnet IPs: 1524
number of botnet IPs notified to network operators: 1254
number of blocked spams: 267674
recipient count of blocked spams: 8567762

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	736
2	CHINANET-ZJ-WZ	22
3	KORNET-KR	14
4	UNICOM-SD	13
5	033.530.486/0001-29	13
6	003.420.926/0002-05	11
7	CHINANET-JS	9
8	AKIMPOD	9
9	000.065.376/0002-65	9
10	CO-ACSA-LACNIC	8

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	911
2	Brazil	78
3	Russian Federation	52
4	United States	39
5	South Korea	31
6	Poland	25
7	Thailand	22
8	India	22
9	Ukraine	21
10	Kazakhstan	20

Botnet Statistics [2010-12-18]

detection period: 2010-12-18 00:00-23:59 UTC
total number of suspected botnet IPs: 1582
number of botnet IPs notified to network operators: 1314
number of blocked spams: 279726
recipient count of blocked spams: 8824478

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	765
2	KORNET-KR	18
3	033.530.486/0001-29	16
4	CHINANET-ZJ-WZ	15
5	UNICOM-SD	14
6	CHINANET-JS	12
7	AKIMPOD	11
8	003.420.926/0002-05	10
9	RCOM	9
10	CO-ACSA-LACNIC	8

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	933
2	Brazil	86
3	Russian Federation	55
4	United States	40
5	South Korea	36
6	India	29
7	Poland	24
8	Kazakhstan	24
9	Ukraine	22
10	Colombia	21

Botnet Statistics [2010-12-17]

Taiwan, where I live, had stayed on my list of top 10 botnet countries for a long time.  It does not feel good for me to see my home country so high on the list.  Though I detected many bots in Taiwan, which showed how effective my detection was, I really wished that Taiwan could make some progress in the war against botnets.  So I am gladly surprised that Taiwan has recently dropped out of the top 10.  The number of bots detected in Taiwan daily has also reduced from more than 1000 to less than 100 now.  Great!

detection period: 2010-12-17 00:00-23:59 UTC
total number of suspected botnet IPs: 998
number of botnet IPs notified to network operators: 718
number of blocked spams: 334267
recipient count of blocked spams: 11460845

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	184
2	KORNET-KR	17
3	CHINANET-ZJ-WZ	16
4	033.530.486/0001-29	15
5	UNICOM-SD	14
6	CHINANET-JS	11
7	003.420.926/0002-05	11
8	AKIMPOD	10
9	CO-ACSA-LACNIC	9
10	002.558.157/0001-62	9

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	342
2	Brazil	89
3	Russian Federation	60
4	South Korea	41
5	United States	39
6	Colombia	24
7	Ukraine	23
8	Poland	23
9	Kazakhstan	23
10	France	21

Botnet Statistics [2010-12-16]

detection period: 2010-12-16 00:00-23:59 UTC
total number of suspected botnet IPs: 1026
number of botnet IPs notified to network operators: 732
number of blocked spams: 330442
recipient count of blocked spams: 11278179

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	227
2	UNICOM-SD	16
3	CHINANET-ZJ-WZ	16
4	KORNET-KR	15
5	033.530.486/0001-29	15
6	CHINANET-JS	12
7	003.420.926/0002-05	12
8	CO-ACSA-LACNIC	9
9	AKIMPOD	8
10	RCOM	7

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	383
2	Brazil	79
3	Russian Federation	69
4	United States	45
5	South Korea	34
6	India	27
7	Colombia	24
8	Poland	22
9	France	21
10	Ukraine	20

Botnet Statistics [2010-12-15]

detection period: 2010-12-15 00:00-23:59 UTC
total number of suspected botnet IPs: 935
number of botnet IPs notified to network operators: 642
number of blocked spams: 329418
recipient count of blocked spams: 11079869

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	120
2	CHINANET-ZJ-WZ	24
3	033.530.486/0001-29	16
4	UNICOM-SD	15
5	KORNET-KR	15
6	CHINANET-GD	12
7	CO-ACSA-LACNIC	10
8	CHINANET-JS	10
9	003.420.926/0002-05	10
10	CHINANET-ZJ	8

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	178
2	Taiwan	132
3	Brazil	78
4	Russian Federation	62
5	United States	50
6	South Korea	29
7	India	26
8	Colombia	26
9	Poland	24
10	Ukraine	21

Botnet Statistics [2010-12-14]

detection period: 2010-12-14 00:00-23:59 UTC
total number of suspected botnet IPs: 1067
number of botnet IPs notified to network operators: 764
number of blocked spams: 325826
recipient count of blocked spams: 11145771

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	233
2	KORNET-KR	18
3	033.530.486/0001-29	17
4	UNICOM-SD	15
5	CHINANET-ZJ-WZ	12
6	CHINANET-GD	12
7	CHINANET-JS	11
8	003.420.926/0002-05	11
9	002.558.157/0001-62	11
10	CO-ACSA-LACNIC	10

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	242
2	China	174
3	Brazil	85
4	Russian Federation	59
5	United States	45
6	India	30
7	South Korea	29
8	Ukraine	26
9	Colombia	26
10	Indonesia	25

Botnet Statistics [2010-12-13]

detection period: 2010-12-13 00:00-23:59 UTC
total number of suspected botnet IPs: 1382
number of botnet IPs notified to network operators: 1054
number of blocked spams: 292960
recipient count of blocked spams: 9493034

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	455
2	CHINANET-ZJ-WZ	22
3	033.530.486/0001-29	18
4	KORNET-KR	16
5	002.558.157/0001-62	15
6	UNICOM-SD	14
7	CHINANET-GD	14
8	CHINANET-JS	13
9	003.420.926/0002-05	12
10	CHINANET-ZJ	11

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	469
2	China	211
3	Brazil	103
4	Russian Federation	66
5	United States	49
6	India	35
7	South Korea	30
8	Ukraine	26
9	Colombia	25
10	Poland	24

Botnet Statistics [2010-12-12]

detection period: 2010-12-12 00:00-23:59 UTC
total number of suspected botnet IPs: 1325
number of botnet IPs notified to network operators: 1019
number of blocked spams: 424114
recipient count of blocked spams: 9819166

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	458
2	KORNET-KR	18
3	CHINANET-JS	17
4	033.530.486/0001-29	17
5	CHINANET-ZJ-WZ	16
6	UNICOM-SD	14
7	CHINANET-GD	13
8	CHINANET-FJ	13
9	CO-ACSA-LACNIC	10
10	003.420.926/0002-05	10

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	468
2	China	206
3	Brazil	84
4	Russian Federation	65
5	United States	47
6	South Korea	30
7	Poland	27
8	India	27
9	Colombia	24
10	Ukraine	21

Botnet Statistics [2010-12-11]

A week ago, I still detected more than 5000 bots on December 4. This week I detected far less bots, sometimes dropped below 1000 per day. But the weekly bot count graph in Shadowserver disagrees with my statistics. Its bot count increased from around 20K to just below 80K, almost quadrupled in the past week. Considering the recent Wikileaks controversy, and the fact that I can only detect spam sending bots, I guess a large portion of those new bots are used for DDoS attacks.

detection period: 2010-12-11 00:00-23:59 UTC
total number of suspected botnet IPs: 1303
number of botnet IPs notified to network operators: 989
number of blocked spams: 344381
recipient count of blocked spams: 8365799

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	429
2	KORNET-KR	19
3	033.530.486/0001-29	17
4	UNICOM-SD	16
5	CHINANET-ZJ-WZ	15
6	CHINANET-JS	14
7	CHINANET-FJ	14
8	CHINANET-GD	13
9	002.558.157/0001-62	12
10	CO-ACSA-LACNIC	10

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	440
2	China	204
3	Brazil	87
4	Russian Federation	71
5	United States	41
6	India	41
7	South Korea	35
8	Poland	29
9	Colombia	26
10	Ukraine	25

Botnet Statistics [2010-12-10]

detection period: 2010-12-10 00:00-23:59 UTC
total number of suspected botnet IPs: 1300
number of botnet IPs notified to network operators: 1014
number of blocked spams: 246624
recipient count of blocked spams: 8033387

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	484
2	CHINANET-ZJ-WZ	40
3	KORNET-KR	19
4	033.530.486/0001-29	16
5	002.558.157/0001-62	16
6	CHINANET-GD	15
7	UNICOM-SD	14
8	CHINANET-FJ	12
9	CHINANET-JS	11
10	CO-ACSA-LACNIC	9

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	497
2	China	207
3	Brazil	80
4	Russian Federation	57
5	United States	42
6	India	38
7	South Korea	31
8	Colombia	26
9	Poland	24
10	Ukraine	23

Botnet Statistics [2010-12-09]

detection period: 2010-12-09 00:00-23:59 UTC
total number of suspected botnet IPs: 1060
number of botnet IPs notified to network operators: 796
number of blocked spams: 303095
recipient count of blocked spams: 10279527

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	312
2	CHINANET-ZJ-WZ	17
3	KORNET-KR	15
4	033.530.486/0001-29	15
5	002.558.157/0001-62	15
6	UNICOM-SD	13
7	CHINANET-JS	13
8	CHINANET-GD	13
9	CHINANET-FJ	10
10	CO-ACSA-LACNIC	9

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	326
2	China	178
3	Brazil	75
4	Russian Federation	50
5	United States	44
6	India	32
7	Colombia	27
8	South Korea	25
9	Poland	24
10	Indonesia	22

Botnet Statistics [2010-12-08]

detection period: 2010-12-08 00:00-23:59 UTC
total number of suspected botnet IPs: 1038
number of botnet IPs notified to network operators: 796
number of blocked spams: 205843
recipient count of blocked spams: 6861150

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	394
2	CHINANET-ZJ-WZ	17
3	033.530.486/0001-29	14
4	UNICOM-SD	13
5	CHINANET-JS	12
6	003.420.926/0002-05	11
7	KORNET-KR	9
8	CO-ACSA-LACNIC	9
9	002.558.157/0001-62	9
10	TRUENET	8

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	405
2	China	149
3	Brazil	67
4	Russian Federation	46
5	United States	35
6	India	35
7	Colombia	23
8	Thailand	20
9	South Korea	19
10	Indonesia	19

Botnet Statistics [2010-12-07]

detection period: 2010-12-07 00:00-23:59 UTC
total number of suspected botnet IPs: 837
number of botnet IPs notified to network operators: 565
number of blocked spams: 261754
recipient count of blocked spams: 8807849

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	136
2	CHINANET-ZJ-WZ	18
3	033.530.486/0001-29	16
4	CHINANET-JS	15
5	UNICOM-SD	12
6	003.420.926/0002-05	11
7	KORNET-KR	10
8	CHINANET-GD	10
9	002.558.157/0001-62	10
10	CO-ACSA-LACNIC	9

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	155
2	Taiwan	148
3	Brazil	77
4	Russian Federation	52
5	United States	41
6	Colombia	27
7	India	25
8	South Korea	22
9	Poland	20
10	Ukraine	17

Botnet Statistics [2010-12-06]

detection period: 2010-12-06 00:00-23:59 UTC
total number of suspected botnet IPs: 1183
number of botnet IPs notified to network operators: 904
number of blocked spams: 321289
recipient count of blocked spams: 11029497

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	459
2	KORNET-KR	14
3	UNICOM-SD	13
4	033.530.486/0001-29	13
5	CHINANET-ZJ-WZ	11
6	CHINANET-JS	11
7	003.420.926/0002-05	11
8	CHINANET-GD	10
9	000.065.376/0002-65	10
10	CO-ACSA-LACNIC	9

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	470
2	China	159
3	Brazil	79
4	Russian Federation	63
5	United States	43
6	Colombia	29
7	India	28
8	South Korea	26
9	Indonesia	22
10	Poland	21

Botnet Statistics [2010-12-05]

detection period: 2010-12-05 00:00-23:59 UTC
total number of suspected botnet IPs: 1821
number of botnet IPs notified to network operators: 1456
number of blocked spams: 263606
recipient count of blocked spams: 8879125

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	514
2	CHINANET-GD	95
3	BSNLNET	40
4	AR-TEAR7-LACNIC	38
5	KORNET-KR	23
6	TRUENET	22
7	000.065.376/0002-65	22
8	TRUEBB-NET	18
9	RCOM	18
10	UNICOM-SD	17

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	529
2	China	311
3	Brazil	144
4	Russian Federation	88
5	Argentina	86
6	India	85
7	Thailand	65
8	United States	47
9	South Korea	44
10	Ukraine	43

Botnet Statistics [2010-12-04]

detection period: 2010-12-04 00:00-23:59 UTC
total number of suspected botnet IPs: 5208
number of botnet IPs notified to network operators: 4441
number of blocked spams: 286454
recipient count of blocked spams: 9322186

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	1352
2	CHINANET-GD	751
3	HINET-NET	548
4	RCOM	174
5	TATACOMM-IN	160
6	AR-TEAR7-LACNIC	111
7	HATHWAY-NET	88
8	UKRTELNET	74
9	ALLIANCEBROADBAND	53
10	TRUENET	51

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	1921
2	China	1073
3	Taiwan	567
4	Brazil	270
5	Russian Federation	234
6	Argentina	171
7	Thailand	151
8	Ukraine	127
9	South Korea	60
10	Kazakhstan	59

DDoS attacks make Wikileaks a great botnet detection system

News about Wikileaks has been flooding the media recently. Due to its controversy, Wikileaks has been under several DDoS attacks for the past week. The data volume from the biggest attack is said to be higher than 10Gbps.

This specific event looks to me like a perfect chance for botnet detection. All the botnet detection systems employing passive approaches, like the "follow the spam" strategy I currently use, face the same problem, which is "how to attract botnets to contact the system?" Wikileaks does a great job without much effort in this regards (that is, attracting botnets).

Now if Wikileaks already has in place some capable web server and reverse proxy, like lighttpd, nginx or varnish, a few scripts running on their log files will quickly produce a list of suspected zombie computers. Notifying those unsuspecting victims of what happened will help fight botnets tremendously.

Botnet Statistics [2010-12-03]

detection period: 2010-12-03 00:00-23:59 UTC
total number of suspected botnet IPs: 5295
number of botnet IPs notified to network operators: 4478
number of blocked spams: 285107
recipient count of blocked spams: 9212247

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	1206
2	CHINANET-GD	904
3	HINET-NET	489
4	RCOM	163
5	TATACOMM-IN	148
6	AR-TEAR7-LACNIC	104
7	HATHWAY-NET	103
8	UKRTELNET	76
9	002.558.134/0001-58	62
10	000.065.376/0002-65	57

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	1777
2	China	1248
3	Taiwan	507
4	Brazil	355
5	Russian Federation	254
6	Argentina	176
7	Thailand	144
8	Ukraine	123
9	South Korea	61
10	Kazakhstan	50

Botnet Statistics [2010-12-02]

detection period: 2010-12-02 00:00-23:59 UTC
total number of suspected botnet IPs: 4158
number of botnet IPs notified to network operators: 3527
number of blocked spams: 178751
recipient count of blocked spams: 4835427

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	827
2	HINET-NET	549
3	CHINANET-GD	329
4	RCOM	174
5	AR-TEAR7-LACNIC	92
6	TATACOMM-IN	78
7	HATHWAY-NET	74
8	UKRTELNET	65
9	000.065.376/0002-65	51
10	TRUENET	47

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	1295
2	China	639
3	Taiwan	567
4	Brazil	331
5	Russian Federation	253
6	Argentina	153
7	Thailand	144
8	Ukraine	110
9	Kazakhstan	55
10	South Korea	54

Botnet Statistics [2010-12-01]

detection period: 2010-12-01 00:00-23:59 UTC
total number of suspected botnet IPs: 2764
number of botnet IPs notified to network operators: 1627
number of blocked spams: 296214
recipient count of blocked spams: 9520499

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	485
2	BSNLNET	417
3	RCOM	86
4	AR-TEAR7-LACNIC	70
5	TATACOMM-IN	53
6	000.065.376/0002-65	49
7	UKRTELNET	44
8	HATHWAY-NET	41
9	002.558.134/0001-58	36
10	CAT-BB-NET	31

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	658
2	Taiwan	504
3	China	301
4	Brazil	249
5	Russian Federation	163
6	Argentina	122
7	Thailand	98
8	Ukraine	76
9	South Korea	50
10	United States	47

Botnet Statistics for November 2010

detection period: 2010-11-01 00:00 - 2010-11-30 23:59 UTC
total number of suspected botnet IPs: 40754
number of blocked spams: 10491156
recipient count of blocked spams: 347545981

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	16984
2	India	9719
3	China	3672
4	Brazil	1882
5	Thailand	1784
6	Russian Federation	1528
7	Argentina	1373
8	Ukraine	698
9	United States	272
10	Belarus	249
11	Uruguay	246
12	Kazakhstan	198
13	South Korea	171
14	Ethiopia	165
15	Mexico	145
16	Indonesia	145
17	Germany	134
18	Colombia	114
19	Chile	112
20	Algeria	76
21	Hong Kong	61
22	Bulgaria	61
23	Poland	59
24	Italy	56
25	Iran	54

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	2121950
2	Brazil	1302625
3	Taiwan	1160342
4	United States	722775
5	Russian Federation	646022
6	India	374273
7	Colombia	328955
8	Thailand	245807
9	Germany	210781
10	South Korea	206726
11	Argentina	177956
12	Ukraine	172465
13	France	169121
14	Indonesia	164513
15	Poland	162099
16	Italy	156307
17	Mexico	116290
18	Philippines	96926
19	Turkey	82025
20	Saudi Arabia	81639
21	Iran	80066
22	Viet Nam	79188
23	United Kingdom	76462
24	Czech Republic	76423
25	Venezuela	73585

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2010-11-30]

detection period: 2010-11-30 00:00-23:59 UTC
total number of suspected botnet IPs: 2303
number of botnet IPs notified to network operators: 1890
number of blocked spams: 330365
recipient count of blocked spams: 11370535

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	427
2	BSNLNET	307
3	RCOM	63
4	AR-TEAR7-LACNIC	57
5	TATACOMM-IN	39
6	000.065.376/0002-65	35
7	002.558.134/0001-58	28
8	KORNET-KR	27
9	HATHWAY-NET	25
10	CAT-BB-NET	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	495
2	Taiwan	442
3	China	270
4	Brazil	211
5	Russian Federation	126
6	Argentina	98
7	Thailand	77
8	United States	67
9	Ukraine	51
10	South Korea	48