Botnet Statistics [2011-03-30]

detection period: 2011-03-30 00:00-23:59 UTC
total number of suspected botnet IPs: 2271
number of botnet IPs notified to network operators: 1775
number of blocked spams: 60980
recipient count of blocked spams: 1244078

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	345
2	UNICOM-HA	163
3	CHINANET-GD	146
4	UNICOM-GD	90
5	BSNLNET	58
6	TELKOMNET	44
7	CHINANET-JS	40
8	PTCL	39
9	CTTNET	38
10	CRTC	36

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	690
2	Taiwan	353
3	Brazil	177
4	India	135
5	Indonesia	97
6	Russian Federation	82
7	United States	47
8	Viet Nam	45
9	Pakistan	42
10	Kazakhstan	42

Botnet Statistics [2011-03-29]

detection period: 2011-03-29 00:00-23:59 UTC
total number of suspected botnet IPs: 1645
number of botnet IPs notified to network operators: 1296
number of blocked spams: 46978
recipient count of blocked spams: 923431

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	188
2	UNICOM-HA	177
3	CHINANET-GD	151
4	UNICOM-GD	107
5	CRTC	36
6	CHINANET-JS	35
7	CTTNET	34
8	BSNLNET	33
9	TELKOMNET	30
10	UNICOM-SD	20

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	676
2	Taiwan	195
3	India	90
4	Brazil	86
5	Russian Federation	59
6	Indonesia	59
7	Colombia	39
8	United States	34
9	Kazakhstan	32
10	Poland	23

Botnet Statistics [2011-03-28]

detection period: 2011-03-28 00:00-23:59 UTC
total number of suspected botnet IPs: 1430
number of botnet IPs notified to network operators: 1152
number of blocked spams: 52658
recipient count of blocked spams: 1010887

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	176
2	UNICOM-HA	142
3	UNICOM-GD	112
4	HINET-NET	106
5	CRTC	40
6	BSNLNET	29
7	CTTNET	28
8	UNICOM-SD	21
9	CHINANET-JS	18
10	VNPT-VNNIC-VN	17

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	683
2	Taiwan	113
3	Brazil	92
4	India	62
5	Russian Federation	50
6	Indonesia	35
7	United States	33
8	Colombia	29
9	Kazakhstan	28
10	South Korea	25

Botnet Statistics [2011-03-27]

detection period: 2011-03-27 00:00-23:59 UTC
total number of suspected botnet IPs: 2071
number of botnet IPs notified to network operators: 1478
number of blocked spams: 113050
recipient count of blocked spams: 3183391

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-GD	186
2	UNICOM-HA	164
3	CHINANET-GD	119
4	KORNET-KR	56
5	CHINANET-JS	56
6	CRTC	43
7	BSNLNET	39
8	002.558.134/0001-58	24
9	UNICOM-SD	22
10	CTTNET	21

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	791
2	Brazil	155
3	South Korea	115
4	United States	89
5	India	88
6	Russian Federation	78
7	Argentina	38
8	Indonesia	37
9	Kazakhstan	36
10	Ukraine	35

Botnet Statistics [2011-03-26]

detection period: 2011-03-26 00:00-23:59 UTC
total number of suspected botnet IPs: 2290
number of botnet IPs notified to network operators: 1626
number of blocked spams: 129647
recipient count of blocked spams: 3929129

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-GD	168
2	UNICOM-HA	155
3	BSNLNET	149
4	CHINANET-GD	107
5	CRTC	35
6	RCOM	34
7	CTTNET	33
8	KORNET-KR	31
9	CHINANET-JS	30
10	002.558.134/0001-58	28

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	740
2	India	308
3	Brazil	171
4	United States	119
5	Russian Federation	119
6	South Korea	55
7	Indonesia	49
8	Viet Nam	48
9	Kazakhstan	46
10	Ukraine	44

Botnet Statistics [2011-03-25]

detection period: 2011-03-25 00:00-23:59 UTC
total number of suspected botnet IPs: 2446
number of botnet IPs notified to network operators: 1728
number of blocked spams: 130225
recipient count of blocked spams: 3946090

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-HA	164
2	UNICOM-GD	130
3	BSNLNET	121
4	CHINANET-GD	117
5	TELKOMNET	42
6	CRTC	36
7	RCOM	33
8	VNPT-VNNIC-VN	32
9	PTCL	29
10	NTHAIRNET	28

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	734
2	India	300
3	Brazil	211
4	Russian Federation	128
5	United States	111
6	Indonesia	79
7	South Korea	52
8	Ukraine	49
9	Colombia	45
10	Viet Nam	44

Botnet Statistics [2011-03-24]

detection period: 2011-03-24 00:00-23:59 UTC
total number of suspected botnet IPs: 2676
number of botnet IPs notified to network operators: 1921
number of blocked spams: 132010
recipient count of blocked spams: 3983430

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-GD	202
2	UNICOM-HA	150
3	CHINANET-GD	130
4	BSNLNET	129
5	VNPT-VNNIC-VN	52
6	RCOM	38
7	CRTC	35
8	TELKOMNET	33
9	UNICOM-BJ	32
10	CHINANET-JS	30

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	847
2	India	313
3	Brazil	217
4	Russian Federation	144
5	United States	109
6	Viet Nam	75
7	Indonesia	72
8	Ukraine	66
9	South Korea	53
10	Kazakhstan	49

Botnet Statistics [2011-03-23]

detection period: 2011-03-23 00:00-23:59 UTC
total number of suspected botnet IPs: 2676
number of botnet IPs notified to network operators: 1934
number of blocked spams: 90539
recipient count of blocked spams: 2213335

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-GD	162
2	UNICOM-HA	161
3	CHINANET-GD	138
4	HINET-NET	137
5	BSNLNET	74
6	UNICOM-BJ	37
7	000.065.376/0002-65	34
8	CHINANET-JS	32
9	PTCL	31
10	VNPT-VNNIC-VN	30

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	795
2	Brazil	227
3	India	208
4	Taiwan	153
5	Russian Federation	126
6	United States	113
7	Colombia	69
8	Indonesia	66
9	South Korea	54
10	Ukraine	49

Botnet Statistics [2011-03-22]

detection period: 2011-03-22 00:00-23:59 UTC
total number of suspected botnet IPs: 1960
number of botnet IPs notified to network operators: 1503
number of blocked spams: 59929
recipient count of blocked spams: 1269738

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-GD	213
2	HINET-NET	210
3	UNICOM-HA	152
4	CHINANET-GD	120
5	BSNLNET	40
6	CTTNET	38
7	VNPT-VNNIC-VN	29
8	CHINANET-JS	27
9	KORNET-KR	25
10	CRTC	25

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	721
2	Taiwan	219
3	Brazil	140
4	India	131
5	Russian Federation	89
6	South Korea	57
7	Indonesia	47
8	Kazakhstan	37
9	Viet Nam	35
10	Colombia	35

Botnet Statistics [2011-03-21]

detection period: 2011-03-21 00:00-23:59 UTC
total number of suspected botnet IPs: 2144
number of botnet IPs notified to network operators: 1674
number of blocked spams: 55764
recipient count of blocked spams: 1074071

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	250
2	UNICOM-GD	231
3	CHINANET-GD	157
4	UNICOM-HA	152
5	CTTNET	43
6	KORNET-KR	38
7	CHINANET-ZJ-WZ	29
8	UNICOM-BJ	26
9	CRTC	25
10	BSNLNET	25

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	822
2	Taiwan	260
3	Brazil	143
4	India	105
5	Russian Federation	95
6	South Korea	86
7	Indonesia	49
8	Argentina	41
9	Viet Nam	37
10	Kazakhstan	36

Botnet Statistics [2011-03-20]

detection period: 2011-03-20 00:00-23:59 UTC
total number of suspected botnet IPs: 1563
number of botnet IPs notified to network operators: 1198
number of blocked spams: 61527
recipient count of blocked spams: 938142

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	147
2	UNICOM-GD	139
3	UNICOM-HA	133
4	HINET-NET	112
5	CRTC	23
6	CTTNET	22
7	CHINANET-JS	22
8	VNPT-VNNIC-VN	19
9	UNICOM-BJ	19
10	TELKOMNET	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	636
2	Taiwan	118
3	Brazil	92
4	Russian Federation	76
5	Indonesia	48
6	India	41
7	Kazakhstan	34
8	Ukraine	31
9	Viet Nam	30
10	United States	29

Botnet Statistics [2011-03-19]

detection period: 2011-03-19 00:00-23:59 UTC
total number of suspected botnet IPs: 2200
number of botnet IPs notified to network operators: 1621
number of blocked spams: 123551
recipient count of blocked spams: 3336255

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	312
2	UNICOM-HA	153
3	CHINANET-GD	151
4	CHINANET-JS	38
5	BSNLNET	36
6	CRTC	32
7	CTTNET	27
8	UNICOM-BJ	26
9	BY-BELPAK-20091210	25
10	VNPT-VNNIC-VN	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	628
2	Taiwan	329
3	Brazil	144
4	India	122
5	Russian Federation	102
6	United States	89
7	South Korea	53
8	Ukraine	48
9	Kazakhstan	46
10	Indonesia	44

Botnet Statistics [2011-03-18]

detection period: 2011-03-18 00:00-23:59 UTC
total number of suspected botnet IPs: 2383
number of botnet IPs notified to network operators: 1722
number of blocked spams: 128723
recipient count of blocked spams: 4004834

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	336
2	UNICOM-HA	148
3	CHINANET-GD	115
4	BSNLNET	68
5	CHINANET-JS	38
6	RCOM	29
7	UNICOM-SD	28
8	002.558.134/0001-58	27
9	TELKOMNET	25
10	CTTNET	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	593
2	Taiwan	352
3	Brazil	181
4	India	178
5	Russian Federation	119
6	United States	116
7	Indonesia	66
8	Kazakhstan	55
9	Ukraine	46
10	Colombia	41

Botnet Statistics [2011-03-17]

detection period: 2011-03-17 00:00-23:59 UTC
total number of suspected botnet IPs: 2485
number of botnet IPs notified to network operators: 1760
number of blocked spams: 122650
recipient count of blocked spams: 3922234

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	173
2	UNICOM-HA	147
3	HINET-NET	126
4	BSNLNET	88
5	CHINANET-JS	44
6	RCOM	31
7	CRTC	29
8	002.558.134/0001-58	29
9	UNICOM-SD	27
10	033.530.486/0001-29	25

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	690
2	India	203
3	Brazil	201
4	Russian Federation	153
5	Taiwan	144
6	United States	131
7	Indonesia	59
8	Kazakhstan	58
9	Ukraine	55
10	Germany	52

Botnet Statistics [2011-03-16]

detection period: 2011-03-16 00:00-23:59 UTC
total number of suspected botnet IPs: 2348
number of botnet IPs notified to network operators: 1696
number of blocked spams: 167417
recipient count of blocked spams: 5468050

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	157
2	HINET-NET	129
3	UNICOM-HA	126
4	UNICOM-GD	101
5	CTTNET	58
6	BSNLNET	57
7	CHINANET-JS	39
8	CRTC	31
9	VNPT-VNNIC-VN	28
10	076.535.764/0326-90	27

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	760
2	Brazil	199
3	India	148
4	Taiwan	144
5	Russian Federation	130
6	United States	102
7	Kazakhstan	55
8	South Korea	53
9	Indonesia	53
10	Ukraine	45

Botnet Statistics [2011-03-15]

detection period: 2011-03-15 00:00-23:59 UTC
total number of suspected botnet IPs: 2561
number of botnet IPs notified to network operators: 1829
number of blocked spams: 202522
recipient count of blocked spams: 6550482

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	196
2	UNICOM-HA	158
3	CHINANET-GD	145
4	UNICOM-GD	78
5	BSNLNET	69
6	CHINANET-JS	54
7	NTHAIRNET	41
8	TELKOMNET	32
9	CHINANET-ZJ-WZ	31
10	000.065.376/0002-65	30

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	713
2	Brazil	217
3	Taiwan	207
4	India	175
5	United States	133
6	Russian Federation	118
7	Indonesia	64
8	South Korea	59
9	Kazakhstan	57
10	Ukraine	53

Botnet Statistics [2011-03-14]

detection period: 2011-03-14 00:00-23:59 UTC
total number of suspected botnet IPs: 2903
number of botnet IPs notified to network operators: 2268
number of blocked spams: 153965
recipient count of blocked spams: 4779543

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	590
2	HINET-NET	302
3	UNICOM-GD	179
4	UNICOM-HA	149
5	CHINANET-JS	47
6	BSNLNET	46
7	NTHAIRNET	41
8	CRTC	27
9	000.065.376/0002-65	24
10	CTTNET	22

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1244
2	Taiwan	318
3	Brazil	170
4	United States	129
5	India	126
6	Russian Federation	102
7	Colombia	49
8	South Korea	48
9	Indonesia	46
10	Thailand	45

Botnet Statistics [2011-03-13]

detection period: 2011-03-13 00:00-23:59 UTC
total number of suspected botnet IPs: 2534
number of botnet IPs notified to network operators: 2020
number of blocked spams: 135737
recipient count of blocked spams: 4032164

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	522
2	UNICOM-GD	266
3	HINET-NET	258
4	UNICOM-HA	91
5	CTTNET	34
6	CRTC	33
7	UNICOM-SD	22
8	CAT-BB-NET	22
9	BSNLNET	21
10	CHINANET-JS	20

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1167
2	Taiwan	272
3	Brazil	144
4	United States	102
5	Russian Federation	94
6	Thailand	65
7	India	60
8	Kazakhstan	42
9	South Korea	41
10	Indonesia	39

Botnet Statistics [2011-03-12]

detection period: 2011-03-12 00:00-23:59 UTC
total number of suspected botnet IPs: 3140
number of botnet IPs notified to network operators: 2495
number of blocked spams: 148611
recipient count of blocked spams: 4449931

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	627
2	UNICOM-GD	277
3	HINET-NET	203
4	BSNLNET	92
5	UNICOM-HA	64
6	CTTNET	46
7	002.558.134/0001-58	37
8	NTHAIRNET	28
9	CRTC	28
10	RCOM	27

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1293
2	Brazil	220
3	Taiwan	214
4	India	198
5	Russian Federation	134
6	United States	123
7	Thailand	80
8	Ukraine	56
9	South Korea	54
10	Indonesia	52

Botnet Statistics for February 2011

Now I detect botnets with both fake open relays and greylisting. I could only detect about 14000 bots in February if greylisting is not used. After all, some spammers might have been driven out of business by my fake open relays, which have been operating for one and a half years now. But the numbers for blocked spams and recipients do not include the number from greylisting, as it gets much less spam mail than fake open relays.

detection period: 2011-02-01 00:00 - 2011-02-28 23:59 UTC
total number of suspected botnet IPs: 39902
number of blocked spams: 5971039
recipient count of blocked spams: 156118318

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	11731
2	Taiwan	5627
3	India	2838
4	Brazil	1995
5	Viet Nam	1698
6	Indonesia	1684
7	Russian Federation	1607
8	South Korea	1059
9	Pakistan	936
10	Ukraine	871
11	Thailand	732
12	Belarus	697
13	Argentina	481
14	Colombia	460
15	Kazakhstan	450
16	United States	409
17	Peru	338
18	Poland	310
19	Germany	283
20	Romania	277
21	Saudi Arabia	243
22	Iran	223
23	Chile	195
24	Israel	186
25	France	184

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	1652622
2	Brazil	652219
3	Taiwan	356441
4	India	339544
5	United States	339027
6	Russian Federation	261236
7	Colombia	206402
8	Indonesia	177712
9	Poland	140927
10	South Korea	124034
11	Thailand	120969
12	Ukraine	88984
13	Philippines	88518
14	France	87309
15	Germany	68682
16	Viet Nam	66843
17	Italy	59903
18	Spain	58577
19	Argentina	55247
20	Mexico	50735
21	Japan	48374
22	United Kingdom	43967
23	Netherlands	37509
24	Turkey	37489
25	European Union	36650

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2011-03-11]

detection period: 2011-03-11 00:00-23:59 UTC
total number of suspected botnet IPs: 3822
number of botnet IPs notified to network operators: 3059
number of blocked spams: 178006
recipient count of blocked spams: 4145645

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	955
2	UNICOM-GD	262
3	HINET-NET	221
4	BSNLNET	90
5	UNICOM-HA	78
6	CTTNET	46
7	RCOM	42
8	MTNLISP	35
9	002.558.157/0001-62	34
10	CHINANET-JS	32

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1686
2	Brazil	253
3	India	252
4	Taiwan	237
5	Russian Federation	162
6	United States	122
7	Colombia	67
8	South Korea	66
9	Ukraine	63
10	Thailand	63

Botnet Statistics [2011-03-10]

detection period: 2011-03-10 00:00-23:59 UTC
total number of suspected botnet IPs: 4430
number of botnet IPs notified to network operators: 3655
number of blocked spams: 184203
recipient count of blocked spams: 4290730

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	1515
2	UNICOM-GD	253
3	HINET-NET	228
4	UNICOM-HA	140
5	BSNLNET	77
6	UNICOM-HN	54
7	CTTNET	46
8	CHINANET-JS	41
9	KORNET-KR	38
10	002.558.134/0001-58	37

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	2352
2	Brazil	246
3	Taiwan	239
4	India	201
5	Russian Federation	138
6	United States	106
7	Indonesia	69
8	South Korea	68
9	Colombia	57
10	Kazakhstan	55

Botnet Statistics [2011-03-09]

I have no idea of what happened, but the botnet outburst in China continues. More than 1700 bots are located in the Guangdong province.

detection period: 2011-03-09 00:00-23:59 UTC
total number of suspected botnet IPs: 4791
number of botnet IPs notified to network operators: 3905
number of blocked spams: 159926
recipient count of blocked spams: 4180459

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	1454
2	UNICOM-GD	260
3	HINET-NET	243
4	UNICOM-HA	148
5	BSNLNET	115
6	VNPT-VNNIC-VN	81
7	PTCL	64
8	TELKOMNET	58
9	KORNET-KR	51
10	CTTNET	47

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	2300
2	India	265
3	Taiwan	259
4	Brazil	200
5	Indonesia	153
6	Russian Federation	141
7	United States	118
8	Viet Nam	112
9	South Korea	104
10	Pakistan	71

Botnet Statistics [2011-03-08]

detection period: 2011-03-08 00:00-23:59 UTC
total number of suspected botnet IPs: 4922
number of botnet IPs notified to network operators: 3964
number of blocked spams: 163075
recipient count of blocked spams: 4484551

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	1452
2	HINET-NET	270
3	UNICOM-GD	240
4	UNICOM-HA	170
5	TELKOMNET	110
6	PTCL	107
7	VNPT-VNNIC-VN	105
8	BSNLNET	88
9	CTTNET	58
10	CRTC	43

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	2329
2	Taiwan	287
3	India	250
4	Indonesia	235
5	Brazil	167
6	Viet Nam	142
7	Pakistan	122
8	Russian Federation	120
9	United States	117
10	South Korea	112

Botnet Statistics [2011-03-07]

China seemed to have a botnet outburst, and more than 2000 bots there were detected.

detection period: 2011-03-07 00:00-23:59 UTC
total number of suspected botnet IPs: 4869
number of botnet IPs notified to network operators: 3883
number of blocked spams: 162050
recipient count of blocked spams: 4625068

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	1350
2	HINET-NET	265
3	UNICOM-GD	262
4	UNICOM-HA	181
5	VNPT-VNNIC-VN	101
6	PTCL	99
7	BSNLNET	99
8	TELKOMNET	66
9	KORNET-KR	51
10	NTHAIRNET	41

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	2211
2	Taiwan	283
3	India	261
4	Brazil	181
5	Indonesia	174
6	United States	161
7	Viet Nam	136
8	Russian Federation	128
9	Pakistan	117
10	South Korea	107

Botnet Statistics [2011-03-06]

detection period: 2011-03-06 00:00-23:59 UTC
total number of suspected botnet IPs: 3149
number of botnet IPs notified to network operators: 2470
number of blocked spams: 206087
recipient count of blocked spams: 6033378

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	519
2	UNICOM-GD	265
3	HINET-NET	263
4	UNICOM-HA	98
5	CHINANET-HN	47
6	CTTNET	42
7	UNICOM-HN	41
8	VNPT-VNNIC-VN	33
9	CRTC	32
10	CHINANET-JS	30

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1299
2	Taiwan	276
3	United States	234
4	Brazil	153
5	Russian Federation	115
6	Indonesia	83
7	India	74
8	Ukraine	65
9	South Korea	57
10	Kazakhstan	56

Botnet Statistics [2011-03-05]

Pakistan jumps to number 4. And it is rare that the country at number 10 has more than 100 bots.

detection period: 2011-03-05 00:00-23:59 UTC
total number of suspected botnet IPs: 4388
number of botnet IPs notified to network operators: 3318
number of blocked spams: 274180
recipient count of blocked spams: 8351998

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	665
2	HINET-NET	274
3	UNICOM-GD	198
4	PTCL	182
5	VNPT-VNNIC-VN	130
6	BSNLNET	128
7	TELKOMNET	72
8	UNICOM-HA	61
9	RCOM	47
10	KORNET-KR	47

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1392
2	India	323
3	Taiwan	292
4	Pakistan	201
5	Brazil	199
6	Indonesia	190
7	Viet Nam	180
8	United States	171
9	Russian Federation	150
10	South Korea	128

Botnet Statistics [2011-03-04]

detection period: 2011-03-04 00:00-23:59 UTC
total number of suspected botnet IPs: 2831
number of botnet IPs notified to network operators: 2046
number of blocked spams: 299417
recipient count of blocked spams: 9178705

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	254
2	CHINANET-GD	151
3	VNPT-VNNIC-VN	95
4	BSNLNET	91
5	TELKOMNET	62
6	RCOM	40
7	KORNET-KR	40
8	CHINANET-JS	38
9	NTHAIRNET	33
10	CRTC	30

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	548
2	Taiwan	265
3	India	251
4	Brazil	193
5	Indonesia	172
6	Viet Nam	135
7	Russian Federation	116
8	United States	111
9	South Korea	94
10	Kazakhstan	70

How could China cut spam so effectively?

This week I have read many articles talking about one thing: spam from China has greatly reduced. Regularly in the top five just two years ago, China is now ranked at number 18 on IronPort's list of spam-producing countries, and at number 20 according to Sophos. For China, a country with internet population bigger than population of the United States, this is no simple feat. In comparison, the U.S. is still the top-spamming country, according to Sophos.

In fact, IronPort's "finding" has lagged by more than a year. Other groups already pointed out similiar facts long ago, for example:

• ICSA Labs reported that "spam originating in China plummeted 65%" (Jan 04, 2010)
• Sophos reported that "China dramatically disappears from list of worse spam-relaying nations for the first time" (Apr 28, 2010)

But most people have no idea how China achieved that. Some refered to an anti-spam initiative in 2006, but it was not until the second half of 2009 when spam from China started to drop off dramatically. Other mentioned the stricter control China put on ".cn" domain registration, but forgot that when talking about spam source, we are only concerned about their IP addresses, which have nothing to do with their domain names. Everyone seems to be a bit clueless, so I might as well give my two cents.

What has caused spam from China to drop did not set out to do so.

Botnet Statistics [2011-03-03]

detection period: 2011-03-03 00:00-23:59 UTC
total number of suspected botnet IPs: 2877
number of botnet IPs notified to network operators: 2026
number of blocked spams: 288739
recipient count of blocked spams: 9025867

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	219
2	CHINANET-GD	158
3	VNPT-VNNIC-VN	95
4	BSNLNET	95
5	CTTNET	59
6	TELKOMNET	47
7	KORNET-KR	47
8	NTHAIRNET	41
9	RCOM	34
10	076.535.764/0326-90	32

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	597
2	India	239
3	Taiwan	235
4	Brazil	222
5	United States	128
6	Indonesia	125
7	Viet Nam	120
8	South Korea	103
9	Russian Federation	99
10	Colombia	64

Botnet Statistics [2011-03-02]

detection period: 2011-03-02 00:00-23:59 UTC
total number of suspected botnet IPs: 3101
number of botnet IPs notified to network operators: 2260
number of blocked spams: 320500
recipient count of blocked spams: 10450527

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	220
2	CHINANET-GD	146
3	VNPT-VNNIC-VN	123
4	TELKOMNET	87
5	BSNLNET	74
6	KORNET-KR	66
7	CRTC	36
8	RCOM	33
9	PTCL	30
10	CTTNET	29

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	563
2	Taiwan	235
3	Brazil	230
4	India	227
5	Indonesia	212
6	Viet Nam	165
7	South Korea	154
8	Russian Federation	140
9	United States	108
10	Ukraine	89

Botnet Statistics [2011-03-01]

detection period: 2011-03-01 00:00-23:59 UTC
total number of suspected botnet IPs: 2144
number of botnet IPs notified to network operators: 1520
number of blocked spams: 326387
recipient count of blocked spams: 11001458

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	214
2	CHINANET-GD	101
3	BSNLNET	68
4	VNPT-VNNIC-VN	48
5	TELKOMNET	42
6	UNICOM-BJ	37
7	KORNET-KR	36
8	CHINANET-JS	27
9	CRTC	25
10	003.420.926/0002-05	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	473
2	Taiwan	228
3	India	173
4	Brazil	163
5	Indonesia	99
6	United States	88
7	Russian Federation	87
8	South Korea	68
9	Viet Nam	61
10	Kazakhstan	47

Botnet Statistics [2011-02-28]

detection period: 2011-02-28 00:00-23:59 UTC
total number of suspected botnet IPs: 2469
number of botnet IPs notified to network operators: 1811
number of blocked spams: 326980
recipient count of blocked spams: 11094111

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	217
2	UNICOM-BJ	164
3	CHINANET-GD	143
4	BSNLNET	68
5	VNPT-VNNIC-VN	47
6	CRTC	35
7	TELKOMNET	34
8	KORNET-KR	26
9	RCOM	24
10	CTTNET	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	617
2	Taiwan	231
3	Brazil	195
4	India	162
5	Russian Federation	132
6	United States	104
7	Indonesia	97
8	Viet Nam	66
9	Ukraine	65
10	South Korea	60