Botnet Statistics [2011-01-30]

detection period: 2011-01-30 00:00-23:59 UTC
total number of suspected botnet IPs: 1846
number of botnet IPs notified to network operators: 1604
number of blocked spams: 239748
recipient count of blocked spams: 6031419

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	482
2	UNICOM-BJ	329
3	HINET-NET	227
4	BSNLNET	21
5	003.420.926/0002-05	17
6	AR-TEAR7-LACNIC	16
7	033.530.486/0001-29	16
8	000.065.376/0002-65	16
9	CHINANET-ZJ-WZ	15
10	CHINANET-JS	15

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	966
2	Taiwan	230
3	Brazil	120
4	Russian Federation	63
5	India	59
6	Thailand	46
7	Argentina	35
8	Kazakhstan	28
9	Indonesia	28
10	United States	25

DISAN: a proposed framework for botnet mitigation

With the limited experience I gained from botnet detection and notification last year, I am going to propose a botnet mitigation framwork here, in the hope to solve the botnet threat we face currently. While still sounding like a very serious problem today, in reality botnets have shrunk quite a bit, as evident from the global spam drop observed in the second half of 2010. So the framework I am proposing is meant to reinforce what has already been done right.

The primary objective of this framework will be to find out the locations of botnets (that is, their IP addresses), and subsequently notify the unknowning victims. The framework will comprise three parts: detection, information sharing, and notification. Let's just call it "DISAN." The "A" from the word "and" is kept for ease of pronounciation.

The keyword for the detection part is "diversity," which mainly applies to how and where (in the cyber world) to detect botnets. Most detection methods work by monitoring various abnormal network behaviors that botnets exhibit, like sending spam, DDoS, etc. Different monitoring mechanisms are going to uncover differnet botnets, so it is necessary to diversify the detection approaches. As botnets are not evenly distributed in the Internet, it is also better to scatter the detection systems around the globe as diversely as possible. Various VPS offerings can help us achieve that.

The keyword for the information sharing part is "trust." Detection is not needed if you can get information about botnets from somebody else. But if you don't trust them, the usefulness of the information to you will be problematic. Likewise, if the information providers don't trust you, they might be reluctant to share with you the IP addresses of botnets, which are potentially vulnerable computers. So it would be better if information providers and recipients belong to an existing structure (like workgroups, taskforce, etc.), and already have mutual trust among them.

The keyword for the last part, notification, is "awareness." The only reason why botnets are such a formidable threat today, is because the victims do not know that their computers have been compromised. Then as time goes by, botnet herders are destined to have many zombie computers waiting for their commands. Without the victims cleaning the computers and fixing the vulnerabilities, efforts like taking C&C servers offline are futile, as I pointed out in my previous post.

Botnet Statistics [2011-01-29]

detection period: 2011-01-29 00:00-23:59 UTC
total number of suspected botnet IPs: 3156
number of botnet IPs notified to network operators: 2676
number of blocked spams: 241840
recipient count of blocked spams: 6305267

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	526
2	BSNLNET	500
3	UNICOM-BJ	323
4	HINET-NET	228
5	RCOM	91
6	TATACOMM-IN	81
7	AR-TEAR7-LACNIC	53
8	HATHWAY-NET	46
9	TRUENET	36
10	000.065.376/0002-65	31

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1064
2	India	784
3	Taiwan	235
4	Brazil	184
5	Russian Federation	153
6	Thailand	111
7	Argentina	90
8	Kazakhstan	57
9	Ukraine	54
10	Indonesia	36

Botnet Statistics [2011-01-28]

detection period: 2011-01-28 00:00-23:59 UTC
total number of suspected botnet IPs: 3661
number of botnet IPs notified to network operators: 3066
number of blocked spams: 219328
recipient count of blocked spams: 5483390

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	550
2	CHINANET-GD	533
3	UNICOM-BJ	367
4	HINET-NET	246
5	RCOM	112
6	TATACOMM-IN	97
7	HATHWAY-NET	47
8	AR-TEAR7-LACNIC	44
9	TRUEBB-NET	37
10	002.558.134/0001-58	34

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1174
2	India	878
3	Taiwan	256
4	Brazil	254
5	Russian Federation	184
6	Thailand	114
7	Argentina	86
8	Kazakhstan	73
9	Ukraine	64
10	United States	47

Botnet Statistics [2011-01-27]

detection period: 2011-01-27 00:00-23:59 UTC
total number of suspected botnet IPs: 2744
number of botnet IPs notified to network operators: 2220
number of blocked spams: 243632
recipient count of blocked spams: 7372701

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-BJ	379
2	BSNLNET	315
3	HINET-NET	241
4	CHINANET-GD	170
5	TATACOMM-IN	60
6	RCOM	56
7	002.558.134/0001-58	36
8	HATHWAY-NET	34
9	UKRTELNET	33
10	TRUENET	27

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	801
2	India	521
3	Taiwan	249
4	Brazil	215
5	Russian Federation	151
6	Thailand	103
7	Ukraine	66
8	Kazakhstan	63
9	Argentina	62
10	United States	45

Botnet Statistics [2011-01-26]

detection period: 2011-01-26 00:00-23:59 UTC
total number of suspected botnet IPs: 2059
number of botnet IPs notified to network operators: 1681
number of blocked spams: 249074
recipient count of blocked spams: 7794178

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-BJ	361
2	HINET-NET	235
3	CHINANET-GD	158
4	BSNLNET	78
5	RCOM	28
6	002.558.134/0001-58	28
7	CHINANET-ZJ-WZ	23
8	000.065.376/0002-65	22
9	AR-TEAR7-LACNIC	21
10	003.420.926/0002-05	21

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	740
2	Taiwan	238
3	Brazil	174
4	India	163
5	Russian Federation	123
6	Thailand	74
7	United States	43
8	Kazakhstan	42
9	Argentina	42
10	Ukraine	41

Botnet Statistics [2011-01-25]

detection period: 2011-01-25 00:00-23:59 UTC
total number of suspected botnet IPs: 2295
number of botnet IPs notified to network operators: 1807
number of blocked spams: 248842
recipient count of blocked spams: 7850190

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-BJ	265
2	HINET-NET	220
3	BSNLNET	208
4	CHINANET-GD	142
5	RCOM	54
6	002.558.134/0001-58	45
7	TATACOMM-IN	25
8	TRUEBB-NET	23
9	HATHWAY-NET	23
10	CHINANET-JS	23

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	639
2	India	353
3	Taiwan	228
4	Brazil	211
5	Russian Federation	131
6	Thailand	80
7	United States	60
8	Kazakhstan	56
9	Indonesia	44
10	Ukraine	42

Botnet Statistics [2011-01-24]

detection period: 2011-01-24 00:00-23:59 UTC
total number of suspected botnet IPs: 2440
number of botnet IPs notified to network operators: 1935
number of blocked spams: 257910
recipient count of blocked spams: 8115365

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-BJ	280
2	HINET-NET	235
3	BSNLNET	235
4	CHINANET-GD	149
5	RCOM	53
6	TATACOMM-IN	45
7	002.558.134/0001-58	31
8	CHINANET-JS	27
9	TRUENET	24
10	HATHWAY-NET	23

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	676
2	India	401
3	Taiwan	242
4	Brazil	199
5	Russian Federation	120
6	Thailand	93
7	Kazakhstan	58
8	United States	56
9	Indonesia	49
10	South Korea	46

Botnet Statistics [2011-01-23]

detection period: 2011-01-23 00:00-23:59 UTC
total number of suspected botnet IPs: 2668
number of botnet IPs notified to network operators: 2142
number of blocked spams: 166118
recipient count of blocked spams: 4743909

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	335
2	UNICOM-BJ	274
3	HINET-NET	246
4	CHINANET-GD	137
5	RCOM	60
6	TATACOMM-IN	59
7	HATHWAY-NET	41
8	AR-TEAR7-LACNIC	36
9	TRUEBB-NET	35
10	TRUENET	32

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	676
2	India	544
3	Taiwan	250
4	Brazil	195
5	Russian Federation	165
6	Thailand	126
7	Argentina	71
8	Kazakhstan	62
9	Ukraine	56
10	United States	51

Botnet Statistics [2011-01-22]

detection period: 2011-01-22 00:00-23:59 UTC
total number of suspected botnet IPs: 3043
number of botnet IPs notified to network operators: 2458
number of blocked spams: 299951
recipient count of blocked spams: 9434433

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	535
2	UNICOM-BJ	245
3	HINET-NET	235
4	CHINANET-GD	149
5	TATACOMM-IN	100
6	RCOM	79
7	HATHWAY-NET	49
8	AR-TEAR7-LACNIC	45
9	002.558.134/0001-58	41
10	TRUEBB-NET	37

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	842
2	China	664
3	Taiwan	247
4	Brazil	215
5	Russian Federation	169
6	Thailand	122
7	Argentina	89
8	Kazakhstan	66
9	United States	55
10	Ukraine	53

Botnet Statistics [2011-01-21]

detection period: 2011-01-21 00:00-23:59 UTC
total number of suspected botnet IPs: 3404
number of botnet IPs notified to network operators: 2739
number of blocked spams: 300417
recipient count of blocked spams: 9570119

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	640
2	UNICOM-BJ	238
3	HINET-NET	233
4	CHINANET-GD	137
5	RCOM	112
6	TATACOMM-IN	95
7	HATHWAY-NET	57
8	AR-TEAR7-LACNIC	56
9	000.065.376/0002-65	45
10	TRUEBB-NET	41

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	993
2	China	670
3	Brazil	271
4	Taiwan	248
5	Russian Federation	195
6	Thailand	123
7	Argentina	101
8	Kazakhstan	86
9	Ukraine	64
10	United States	63

Botnet Statistics [2011-01-20]

detection period: 2011-01-20 00:00-23:59 UTC
total number of suspected botnet IPs: 3189
number of botnet IPs notified to network operators: 2534
number of blocked spams: 254870
recipient count of blocked spams: 8225581

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	678
2	HINET-NET	188
3	UNICOM-BJ	152
4	CHINANET-GD	134
5	RCOM	101
6	TATACOMM-IN	97
7	HATHWAY-NET	69
8	TRUEBB-NET	38
9	ALLIANCEBROADBAND	38
10	000.065.376/0002-65	38

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	1034
2	China	562
3	Brazil	257
4	Taiwan	203
5	Russian Federation	179
6	Thailand	119
7	Kazakhstan	72
8	Ukraine	71
9	Argentina	71
10	United States	61

Botnet Statistics [2011-01-19]

detection period: 2011-01-19 00:00-23:59 UTC
total number of suspected botnet IPs: 1841
number of botnet IPs notified to network operators: 1334
number of blocked spams: 314601
recipient count of blocked spams: 10636863

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	137
2	HINET-NET	133
3	RCOM	35
4	000.065.376/0002-65	34
5	CHINANET-ZJ-WZ	32
6	002.558.134/0001-58	30
7	UKRTELNET	28
8	AR-TEAR7-LACNIC	25
9	TRUENET	24
10	TATACOMM-IN	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	269
2	India	261
3	Brazil	215
4	Taiwan	145
5	Russian Federation	124
6	Thailand	101
7	United States	57
8	Ukraine	57
9	Argentina	54
10	Indonesia	53

Botnet Statistics [2011-01-18]

detection period: 2011-01-18 00:00-23:59 UTC
total number of suspected botnet IPs: 1741
number of botnet IPs notified to network operators: 1258
number of blocked spams: 329869
recipient count of blocked spams: 11026352

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	135
2	HINET-NET	119
3	RCOM	33
4	UKRTELNET	28
5	AR-TEAR7-LACNIC	28
6	000.065.376/0002-65	28
7	002.558.134/0001-58	24
8	TRUENET	22
9	TATACOMM-IN	22
10	003.420.926/0002-05	21

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	251
2	India	243
3	Brazil	210
4	Russian Federation	133
5	Taiwan	129
6	Thailand	81
7	United States	62
8	Ukraine	58
9	Argentina	54
10	Indonesia	48

Botnet Statistics [2011-01-17]

detection period: 2011-01-17 00:00-23:59 UTC
total number of suspected botnet IPs: 1342
number of botnet IPs notified to network operators: 900
number of blocked spams: 328378
recipient count of blocked spams: 11188877

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	72
2	HINET-NET	32
3	RCOM	25
4	002.558.134/0001-58	24
5	CHINANET-JS	23
6	000.065.376/0002-65	20
7	033.530.486/0001-29	19
8	003.420.926/0002-05	19
9	UNICOM-SD	17
10	CHINANET-ZJ-WZ	17

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	232
2	Brazil	163
3	India	153
4	Russian Federation	104
5	Thailand	65
6	United States	56
7	Taiwan	41
8	Indonesia	38
9	South Korea	37
10	Ukraine	35

Botnet Statistics [2011-01-16]

detection period: 2011-01-16 00:00-23:59 UTC
total number of suspected botnet IPs: 1296
number of botnet IPs notified to network operators: 930
number of blocked spams: 334517
recipient count of blocked spams: 11409437

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	154
2	BSNLNET	32
3	TRUENET	21
4	KORNET-KR	20
5	002.558.134/0001-58	19
6	CHINANET-ZJ-WZ	18
7	003.420.926/0002-05	18
8	UKRTELNET	16
9	TRUEBB-NET	15
10	CHINANET-JS	14

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	204
2	Taiwan	157
3	Brazil	138
4	Russian Federation	90
5	India	78
6	Thailand	77
7	United States	51
8	Ukraine	38
9	South Korea	38
10	Indonesia	31

Botnet Statistics [2011-01-15]

detection period: 2011-01-15 00:00-23:59 UTC
total number of suspected botnet IPs: 1093
number of botnet IPs notified to network operators: 773
number of blocked spams: 334989
recipient count of blocked spams: 11397750

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-BJ	93
2	CHINANET-GD	68
3	HINET-NET	45
4	KORNET-KR	21
5	003.420.926/0002-05	18
6	RCOM	13
7	CO-ACSA-LACNIC	13
8	CHINANET-JS	13
9	UNICOM-SD	12
10	CHINANET-ZJ-WZ	11

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	331
2	Brazil	97
3	Russian Federation	57
4	United States	54
5	Taiwan	53
6	India	48
7	South Korea	40
8	Indonesia	31
9	Colombia	31
10	Thailand	27

Botnet Statistics [2011-01-14]

detection period: 2011-01-14 00:00-23:59 UTC
total number of suspected botnet IPs: 1087
number of botnet IPs notified to network operators: 739
number of blocked spams: 334238
recipient count of blocked spams: 11265656

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-BJ	95
2	CHINANET-GD	56
3	KORNET-KR	21
4	CHINANET-ZJ-WZ	17
5	CHINANET-JS	16
6	RCOM	15
7	003.420.926/0002-05	15
8	UNICOM-SD	14
9	BSNLNET	14
10	CO-ACSA-LACNIC	12

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	333
2	Brazil	99
3	Russian Federation	69
4	United States	58
5	India	50
6	South Korea	45
7	Indonesia	33
8	Colombia	30
9	Thailand	25
10	Kazakhstan	22

Botnet Statistics [2011-01-13]

detection period: 2011-01-13 00:00-23:59 UTC
total number of suspected botnet IPs: 1354
number of botnet IPs notified to network operators: 993
number of blocked spams: 285319
recipient count of blocked spams: 9014914

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-BJ	224
2	CHINANET-GD	106
3	RCOM	22
4	KORNET-KR	20
5	CHINANET-ZJ-WZ	18
6	003.420.926/0002-05	17
7	CHINANET-JS	16
8	BSNLNET	16
9	CO-ACSA-LACNIC	14
10	UNICOM-SD	13

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	523
2	Brazil	109
3	Russian Federation	82
4	India	71
5	United States	64
6	South Korea	43
7	Colombia	33
8	Indonesia	29
9	Thailand	25
10	France	24

Botnet Statistics [2011-01-12]

detection period: 2011-01-12 00:00-23:59 UTC
total number of suspected botnet IPs: 1125
number of botnet IPs notified to network operators: 785
number of blocked spams: 223651
recipient count of blocked spams: 7173266

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-BJ	175
2	KORNET-KR	16
3	CHINANET-GD	16
4	CHINANET-ZJ-WZ	14
5	CHINANET-JS	14
6	003.420.926/0002-05	14
7	UNICOM-SD	13
8	CO-ACSA-LACNIC	13
9	BSNLNET	12
10	033.530.486/0001-29	12

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	383
2	Brazil	94
3	Russian Federation	76
4	United States	58
5	India	47
6	South Korea	42
7	Indonesia	31
8	Colombia	28
9	Thailand	22
10	Poland	22

Botnet Statistics [2011-01-11]

detection period: 2011-01-11 00:00-23:59 UTC
total number of suspected botnet IPs: 1083
number of botnet IPs notified to network operators: 749
number of blocked spams: 307522
recipient count of blocked spams: 10299471

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	130
2	KORNET-KR	19
3	CHINANET-JS	15
4	UNICOM-SD	14
5	CHINANET-GD	14
6	003.420.926/0002-05	14
7	033.530.486/0001-29	13
8	CO-ACSA-LACNIC	12
9	CHINANET-FJ	12
10	BSNLNET	12

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	229
2	Taiwan	137
3	Brazil	97
4	Russian Federation	71
5	United States	59
6	India	49
7	South Korea	43
8	Indonesia	30
9	Colombia	25
10	Thailand	23

Botnet Statistics [2011-01-10]

detection period: 2011-01-10 00:00-23:59 UTC
total number of suspected botnet IPs: 1001
number of botnet IPs notified to network operators: 661
number of blocked spams: 334812
recipient count of blocked spams: 11474862

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	80
2	KORNET-KR	18
3	003.420.926/0002-05	15
4	UNICOM-SD	14
5	RCOM	14
6	CHINANET-JS	14
7	CHINANET-GD	14
8	033.530.486/0001-29	13
9	CO-ACSA-LACNIC	12
10	076.535.764/0326-90	11

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	203
2	Brazil	99
3	Taiwan	86
4	United States	56
5	Russian Federation	53
6	India	46
7	South Korea	39
8	Indonesia	34
9	Poland	26
10	Colombia	26

Botnet Statistics [2011-01-09]

detection period: 2011-01-09 00:00-23:59 UTC
total number of suspected botnet IPs: 921
number of botnet IPs notified to network operators: 640
number of blocked spams: 336817
recipient count of blocked spams: 11567907

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	104
2	CHINANET-ZJ-WZ	24
3	CHINANET-GD	23
4	KORNET-KR	17
5	003.420.926/0002-05	14
6	UNICOM-SD	13
7	CHINANET-JS	13
8	033.530.486/0001-29	13
9	UNICOM-BJ	12
10	CO-ACSA-LACNIC	10

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	219
2	Taiwan	108
3	Brazil	77
4	Russian Federation	51
5	United States	42
6	South Korea	36
7	India	30
8	Indonesia	28
9	Colombia	24
10	Poland	23

Botnet Statistics for the year of 2010

My detection systems have been working throughout 2010. It would be interesting to summarize my data for the whole year. Because some ip blocks are missing from my network mapping table, around 4000 botnet IPs could not be mapped to the networks they belong to. I am a bit lazy recently, so I decide not to amend the mapping table this time, and release the yearly statistics without the top 25 networks.

In terms of number of bots, I expected China or Taiwan to take the crown, but to my surprise, India tops the list by a large margin. The top 6 countries are India, China, Brazil, Taiwan, Argentina, and Russian Federation. All but Argentina have been regulars on my botnet charts. Argentina has been successfully staying out of my daily chart for some time.

My statistics is by no means complete. It just describes the bots I found with the particular detection mechanism I use, which are fake open relays. Botnet detection with other means may come out with vastly different results.

detection period: 2010-01-01 00:00 - 2010-12-31 23:59 UTC
total number of suspected botnet IPs: 414398
number of blocked spams: 79256717
recipient count of blocked spams: 2328674624

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	152502
2	China	83429
3	Brazil	43875
4	Taiwan	32981
5	Argentina	25599
6	Russian Federation	15658
7	Thailand	12348
8	United States	6342
9	Ukraine	5434
10	Uruguay	3883
11	Mexico	3759
12	Ethiopia	2376
13	Chile	2069
14	Belarus	1699
15	Germany	1621
16	South Korea	1396
17	Kazakhstan	1357
18	Colombia	1353
19	Indonesia	1264
20	Algeria	1175
21	France	1057
22	Japan	999
23	Hong Kong	718
24	Italy	644
25	Spain	593

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	19216036
2	Taiwan	10256800
3	Brazil	8999024
4	United States	5823431
5	India	4072434
6	Russian Federation	3738420
7	Colombia	2414074
8	Thailand	1928087
9	Indonesia	1578363
10	Argentina	1351358
11	South Korea	1160235
12	France	1153097
13	Germany	1133384
14	Poland	1110894
15	Ukraine	964565
16	Italy	816715
17	United Kingdom	590121
18	Malaysia	573573
19	Mexico	530913
20	Iran	465483
21	Philippines	460976
22	Czech Republic	460585
23	Chile	451506
24	Saudi Arabia	410480
25	Turkey	375195

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2011-01-08]

detection period: 2011-01-08 00:00-23:59 UTC
total number of suspected botnet IPs: 995
number of botnet IPs notified to network operators: 701
number of blocked spams: 335925
recipient count of blocked spams: 11504519

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	133
2	UNICOM-BJ	45
3	CHINANET-GD	45
4	KORNET-KR	15
5	CHINANET-ZJ-WZ	14
6	033.530.486/0001-29	13
7	UNICOM-SD	12
8	CHINANET-JS	12
9	003.420.926/0002-05	12
10	RCOM	10

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	257
2	Taiwan	138
3	Brazil	77
4	United States	46
5	India	42
6	Russian Federation	40
7	South Korea	34
8	Indonesia	26
9	Colombia	23
10	Thailand	18

Botnet Statistics [2011-01-07]

detection period: 2011-01-07 00:00-23:59 UTC
total number of suspected botnet IPs: 1020
number of botnet IPs notified to network operators: 697
number of blocked spams: 336822
recipient count of blocked spams: 11570120

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	110
2	CHINANET-GD	39
3	UNICOM-BJ	33
4	WHOLESALEINTERNET-2	30
5	KORNET-KR	14
6	CHINANET-JS	14
7	033.530.486/0001-29	14
8	CHINANET-ZJ-WZ	13
9	UNICOM-SD	12
10	003.420.926/0002-05	12

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	248
2	Taiwan	121
3	Brazil	80
4	United States	77
5	Russian Federation	41
6	India	38
7	South Korea	36
8	Indonesia	30
9	Colombia	25
10	Thailand	24

Botnet Statistics [2011-01-06]

detection period: 2011-01-06 00:00-23:59 UTC
total number of suspected botnet IPs: 1237
number of botnet IPs notified to network operators: 888
number of blocked spams: 270297
recipient count of blocked spams: 8884339

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	177
2	CHINANET-GD	82
3	UNICOM-BJ	47
4	WHOLESALEINTERNET-2	26
5	CHINANET-ZJ-WZ	23
6	KORNET-KR	16
7	CHINANET-JS	16
8	033.530.486/0001-29	14
9	UNICOM-SD	12
10	RCOM	12

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	335
2	Taiwan	185
3	United States	87
4	Brazil	87
5	Russian Federation	51
6	India	43
7	South Korea	42
8	Indonesia	31
9	Colombia	25
10	Poland	23

Botnet Statistics [2011-01-05]

detection period: 2011-01-05 00:00-23:59 UTC
total number of suspected botnet IPs: 1299
number of botnet IPs notified to network operators: 978
number of blocked spams: 237236
recipient count of blocked spams: 7648778

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	239
2	CHINANET-GD	169
3	WHOLESALEINTERNET-2	21
4	KORNET-KR	16
5	CHINANET-JS	16
6	033.530.486/0001-29	14
7	RCOM	13
8	CHINANET-ZJ-WZ	13
9	UNICOM-SD	11
10	CO-ACSA-LACNIC	11

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	356
2	Taiwan	247
3	Brazil	88
4	United States	72
5	Russian Federation	52
6	India	40
7	South Korea	39
8	Indonesia	30
9	Colombia	26
10	Thailand	25

Botnet Statistics [2011-01-04]

detection period: 2011-01-04 00:00-23:59 UTC
total number of suspected botnet IPs: 1117
number of botnet IPs notified to network operators: 846
number of blocked spams: 205878
recipient count of blocked spams: 6821910

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	227
2	CHINANET-GD	147
3	CHINANET-JS	16
4	WHOLESALEINTERNET-2	15
5	KORNET-KR	14
6	CHINANET-ZJ-WZ	14
7	UNICOM-SD	13
8	CHINANET-FJ	12
9	CO-ACSA-LACNIC	11
10	033.530.486/0001-29	11

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	310
2	Taiwan	235
3	Brazil	70
4	United States	61
5	Russian Federation	40
6	South Korea	32
7	India	25
8	Indonesia	24
9	Colombia	22
10	Thailand	19

Botnet Statistics [2011-01-03]

detection period: 2011-01-03 00:00-23:59 UTC
total number of suspected botnet IPs: 3032
number of botnet IPs notified to network operators: 2424
number of blocked spams: 225575
recipient count of blocked spams: 7619701

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	763
2	HINET-NET	209
3	CHINANET-GD	169
4	RCOM	116
5	TATACOMM-IN	104
6	HATHWAY-NET	91
7	ALLIANCEBROADBAND	46
8	000.065.376/0002-65	33
9	002.558.134/0001-58	32
10	AR-TEAR7-LACNIC	31

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	1177
2	China	420
3	Brazil	239
4	Taiwan	225
5	Thailand	115
6	Russian Federation	112
7	Argentina	68
8	United States	62
9	Ukraine	59
10	South Korea	58

Botnet Statistics [2011-01-02]

detection period: 2011-01-02 00:00-23:59 UTC
total number of suspected botnet IPs: 1403
number of botnet IPs notified to network operators: 1050
number of blocked spams: 237103
recipient count of blocked spams: 7994086

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	198
2	CHINANET-GD	174
3	KORNET-KR	21
4	BSNLNET	21
5	000.065.376/0002-65	20
6	002.558.134/0001-58	17
7	RCOM	16
8	002.558.157/0001-62	15
9	UNICOM-SD	14
10	TRUEBB-NET	14

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	360
2	Taiwan	209
3	Brazil	123
4	India	71
5	Thailand	62
6	Russian Federation	58
7	South Korea	44
8	United States	43
9	Argentina	38
10	Kazakhstan	35

Botnet Statistics for December 2010

detection period: 2010-12-01 00:00 - 2010-12-31 23:59 UTC
total number of suspected botnet IPs: 27020
number of blocked spams: 9202335
recipient count of blocked spams: 300574994

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	7625
2	Taiwan	6434
3	China	5981
4	Brazil	1194
5	Russian Federation	1049
6	Thailand	930
7	Argentina	679
8	Ukraine	506
9	Kazakhstan	222
10	South Korea	207
11	Belarus	186
12	United States	173
13	Indonesia	129
14	Ethiopia	108
15	Chile	101
16	Germany	94
17	Bulgaria	90
18	Uruguay	88
19	Colombia	86
20	Mexico	73
21	Algeria	73
22	France	63
23	Poland	54
24	Saudi Arabia	53
25	Italy	48

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	2078835
2	Brazil	941721
3	United States	595124
4	Russian Federation	517418
5	Colombia	332338
6	India	305268
7	Taiwan	281333
8	South Korea	227967
9	Poland	224771
10	Indonesia	216008
11	France	214358
12	Ukraine	197655
13	Thailand	195921
14	Germany	189537
15	Argentina	177570
16	Italy	162827
17	Saudi Arabia	138022
18	United Kingdom	107581
19	Chile	100575
20	Mexico	100458
21	Spain	99605
22	Canada	82613
23	Philippines	78657
24	Czech Republic	75535
25	Venezuela	74325

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2011-01-01]

detection period: 2011-01-01 00:00-23:59 UTC
total number of suspected botnet IPs: 3042
number of botnet IPs notified to network operators: 2454
number of blocked spams: 263716
recipient count of blocked spams: 8422416

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	758
2	HINET-NET	203
3	CHINANET-GD	164
4	RCOM	121
5	TATACOMM-IN	83
6	HATHWAY-NET	74
7	AR-TEAR7-LACNIC	48
8	000.065.376/0002-65	35
9	TRUEBB-NET	33
10	002.558.134/0001-58	33

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	1119
2	China	485
3	Taiwan	221
4	Brazil	200
5	Thailand	127
6	Russian Federation	120
7	Argentina	88
8	Ukraine	58
9	South Korea	57
10	Kazakhstan	55

Botnet Statistics [2010-12-31]

On the last day of 2010, I detected substantially more bots in India. Was there a malware outbreak happening in India?

detection period: 2010-12-31 00:00-23:59 UTC
total number of suspected botnet IPs: 3517
number of botnet IPs notified to network operators: 2826
number of blocked spams: 254531
recipient count of blocked spams: 8504023

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	937
2	HINET-NET	170
3	RCOM	148
4	CHINANET-GD	148
5	TATACOMM-IN	117
6	HATHWAY-NET	100
7	AR-TEAR7-LACNIC	78
8	000.065.376/0002-65	47
9	ALLIANCEBROADBAND	41
10	TRUENET	39

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	1407
2	China	473
3	Brazil	267
4	Taiwan	183
5	Russian Federation	160
6	Thailand	149
7	Argentina	133
8	Ukraine	69
9	Kazakhstan	66
10	South Korea	56