Botnet Statistics [2011-05-30]

detection period: 2011-05-30 00:00-23:59 UTC
total number of suspected botnet IPs: 3340
number of botnet IPs notified to network operators: 2569
number of blocked spams: 46648
recipient count of blocked spams: 1409155

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BSNLNET	549
2	HINET-NET	312
3	CHINANET-GD	133
4	KORNET-KR	98
5	RCOM	90
6	TATACOMM-IN	65
7	002.558.134/0001-58	55
8	AR-TEAR7-LACNIC	47
9	UKRTELNET	45
10	CRTC	44

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	India	869
2	China	535
3	Taiwan	326
4	Russian Federation	272
5	Brazil	234
6	South Korea	141
7	Ukraine	115
8	Argentina	87
9	United States	48
10	Indonesia	45

Botnet Statistics [2011-05-29]

My fake open relay is back to work.

detection period: 2011-05-29 00:00-23:59 UTC
total number of suspected botnet IPs: 2176
number of botnet IPs notified to network operators: 1543
number of blocked spams: 26291
recipient count of blocked spams: 690672

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	129
2	HINET-NET	112
3	BSNLNET	105
4	KORNET-KR	100
5	UKRTELNET	50
6	BY-BELPAK-20091210	40
7	CRTC	38
8	CHINANET-JS	35
9	002.558.134/0001-58	26
10	000.065.376/0002-65	26

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	449
2	Russian Federation	257
3	India	219
4	South Korea	140
5	Taiwan	136
6	Brazil	134
7	Ukraine	115
8	Belarus	47
9	Argentina	46
10	United States	38

Building a botnet detector with Exim and SQLite, a step-by-step procedure wannabe

In this post, I am going to explain how I employ greylisting to collect IP addresses of botnets. Please read "Botnet Detection with Greylisting" first to get familiar with the general idea. I will mostly talk about implementation details here.

To detect botnets in my way of greylisting, you would need:

• A UNIX-like host
  Linux, FreeBSD, NetBSD, or Solaris will all do. You don't need high-end hardware. Doorstop:) with single Pentium-III CPU, 64MB RAM, and 5GB hard disk should be plenty enough. Cheap VPS is even better, because it is easy to install and configure, saves on power and network bills, and are both environment and pocket friendly.
  
  
• Heavily spammed domains with no active mailbox
  We are going to trace back to the origin of spam to find botnets, so you need to possess some domains which regularly get lots of spam (something like 5K spam every day will do). No spam, no bots. To prevent collateral damage to existing mailboxes and simplify the system, my detection is designed for domains no longer in use, which I call them as "trap domains" below. You need to modify the system yourself when applying it to active domains.
  

I myself use a Linux VPS with Debian 5 distribution. The trap domains I use had been expired for some time, so there should be no active mail accounts in them. You are assumed be an experienced network administrator, familiar with setting up MX records, mail system troubleshooting, etc. What my detection system does is really simple:

• Identify bots with greylisting
  Any hosts trying to send mail to trap domains is all a bit problematic, but I want to focus on botnets, which seldom could pass greylisting. Mail servers (or abused open relays) which do retry sending mail will get a response like "no such user" for each recipient, and the corresponding sessions will be eliminated when compiling the resulting IP list of botnets.
  
  
• Log full mail headers for trap domains
  Most abuse contacts want you to include at least full mail headers when reporting mail related abuses, because it is easier for them to explain what happened to their clients. So for every mail destined for trap domains, and not originating from known mail servers, I keep its full mail header in log files for later notifications.

Here come the detailed implementation procedures:

1. Install Exim with SQLite support.
   Exim is the SMTP server I am most familiar with, and its powerful ACL is a tremendous help for my detection. I knew from the start that I would need to query the data collected by greylisting a lot, so I based the greylisting I use on the Simple Greylist for Exim, which gives me the ability to use SQL without maintaining a full blown database server.
   
   If you want to build Exim from source under Debian (like what I did), at least you need to make sure you have the development file for SQLite ready and change the makefile for Exim accordingly. Install the necessary library with the following command:

Botnet Statistics [2011-05-28]

It turned out that I did not notice the SMTP server in my fake open relay died unexpectedly. That is why it had collected nothing for the past few days. I will see whether it can capture anything tomorrow.

detection period: 2011-05-28 00:00-23:59 UTC
total number of suspected botnet IPs: 1188
number of botnet IPs notified to network operators: 816
number of blocked spams: 0
recipient count of blocked spams: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	129
2	BSNLNET	36
3	CRTC	33
4	CHINANET-JS	31
5	KORNET-KR	29
6	AR-TEAR7-LACNIC	24
7	PTCL	16
8	TELKOMNET	12
9	VNPT-VNNIC-VN	11
10	TATACOMM-IN	11

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	357
2	India	95
3	Russian Federation	65
4	Argentina	47
5	Brazil	46
6	South Korea	44
7	Indonesia	37
8	United States	33
9	Poland	30
10	Chile	28

Botnet Statistics [2011-05-27]

detection period: 2011-05-27 00:00-23:59 UTC
total number of suspected botnet IPs: 1518
number of botnet IPs notified to network operators: 1088
number of blocked spams: 0
recipient count of blocked spams: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	127
2	BSNLNET	79
3	CHINANET-JS	53
4	CRTC	38
5	TELKOMNET	30
6	AR-TEAR7-LACNIC	24
7	KORNET-KR	23
8	UNICOM-SD	19
9	RCOM	19
10	CHINANET-SH	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	487
2	India	167
3	Russian Federation	82
4	Indonesia	68
5	Brazil	60
6	Argentina	47
7	South Korea	46
8	Chile	35
9	Colombia	32
10	United States	30

Botnet Statistics [2011-05-26]

My fake open relay catched no spam yesterday. Now only my greylisting is working.

detection period: 2011-05-26 00:00-23:59 UTC
total number of suspected botnet IPs: 988
number of botnet IPs notified to network operators: 686
number of blocked spams: 0
recipient count of blocked spams: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	149
2	BSNLNET	57
3	CRTC	39
4	KORNET-KR	23
5	CTTNET	23
6	CHINANET-JS	18
7	UNICOM-SD	16
8	002.558.134/0001-58	16
9	RCOM	15
10	BHARTI-IN	10

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	395
2	India	117
3	Russian Federation	83
4	Brazil	59
5	South Korea	39
6	United States	31
7	Ukraine	30
8	Taiwan	19
9	Indonesia	14
10	Argentina	13

Botnet Statistics [2011-05-25]

Well, it seems that my fake open relay could not attract spam any more. I don't believe that I have forced those spammers out of business. I guess they beat me this time.

detection period: 2011-05-25 00:00-23:59 UTC
total number of suspected botnet IPs: 1370
number of botnet IPs notified to network operators: 919
number of blocked spams: 123
recipient count of blocked spams: 4331

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	159
2	BSNLNET	61
3	CTTNET	36
4	CRTC	32
5	CHINANET-JS	30
6	VNPT-VNNIC-VN	25
7	KORNET-KR	23
8	TELKOMNET	20
9	UNICOM-SD	19
10	BHARTI-IN	15

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	484
2	India	130
3	Russian Federation	103
4	Brazil	65
5	South Korea	50
6	Indonesia	45
7	United States	44
8	Viet Nam	35
9	Ukraine	31
10	Argentina	27

Botnet Statistics [2011-05-24]

detection period: 2011-05-24 00:00-23:59 UTC
total number of suspected botnet IPs: 2020
number of botnet IPs notified to network operators: 1430
number of blocked spams: 94944
recipient count of blocked spams: 3270685

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	156
2	CHINANET-GD	126
3	BSNLNET	63
4	CHINANET-JS	41
5	UNICOM-GD	39
6	UNICOM-BJ	35
7	CRTC	34
8	CTTNET	29
9	KORNET-KR	26
10	UNICOM-SD	25

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	602
2	Taiwan	178
3	India	145
4	Brazil	145
5	Russian Federation	129
6	South Korea	66
7	United States	61
8	Indonesia	61
9	Viet Nam	38
10	Ukraine	38

Botnet Statistics [2011-05-23]

detection period: 2011-05-23 00:00-23:59 UTC
total number of suspected botnet IPs: 1920
number of botnet IPs notified to network operators: 1344
number of blocked spams: 93611
recipient count of blocked spams: 3228489

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	124
2	CHINANET-GD	122
3	BSNLNET	93
4	UNICOM-GD	43
5	CHINANET-JS	37
6	CRTC	26
7	RCOM	25
8	TELKOMNET	20
9	CHINANET-ZJ	19
10	000.065.376/0002-65	19

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	539
2	India	200
3	Taiwan	146
4	Brazil	136
5	Russian Federation	106
6	South Korea	63
7	United States	60
8	Indonesia	54
9	Poland	44
10	Ukraine	42

Botnet Statistics [2011-05-22]

detection period: 2011-05-22 00:00-23:59 UTC
total number of suspected botnet IPs: 1749
number of botnet IPs notified to network operators: 1223
number of blocked spams: 94320
recipient count of blocked spams: 3254285

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	142
2	CHINANET-GD	127
3	UNICOM-BJ	66
4	UNICOM-GD	51
5	CRTC	37
6	CTTNET	34
7	CHINANET-JS	32
8	BSNLNET	20
9	TELKOMNET	18
10	PTCL	18

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	631
2	Taiwan	156
3	Russian Federation	90
4	Brazil	90
5	India	65
6	United States	63
7	South Korea	47
8	Indonesia	42
9	Ukraine	32
10	Argentina	32

Botnet Statistics [2011-05-21]

detection period: 2011-05-21 00:00-23:59 UTC
total number of suspected botnet IPs: 1867
number of botnet IPs notified to network operators: 1409
number of blocked spams: 41473
recipient count of blocked spams: 1280305

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	190
2	CHINANET-GD	186
3	UNICOM-GD	144
4	CHINANET-JS	44
5	UNICOM-BJ	37
6	CTTNET	34
7	CRTC	32
8	TELKOMNET	28
9	CHINANET-ZJ	24
10	CHINANET-SH	17

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	840
2	Taiwan	208
3	Brazil	73
4	United States	65
5	Russian Federation	59
6	Indonesia	57
7	India	53
8	Viet Nam	30
9	South Korea	30
10	Argentina	29

Botnet Statistics [2011-05-20]

detection period: 2011-05-20 00:00-23:59 UTC
total number of suspected botnet IPs: 1282
number of botnet IPs notified to network operators: 997
number of blocked spams: 20927
recipient count of blocked spams: 469710

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-GD	235
2	HINET-NET	155
3	CHINANET-GD	116
4	BSNLNET	63
5	UNICOM-BJ	36
6	CHINANET-JS	32
7	KORNET-KR	31
8	CRTC	31
9	CTTNET	29
10	RCOM	17

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	591
2	Taiwan	162
3	India	111
4	South Korea	60
5	Brazil	44
6	Russian Federation	36
7	United States	17
8	Ukraine	16
9	Indonesia	16
10	Viet Nam	14

Botnet Statistics [2011-05-19]

detection period: 2011-05-19 00:00-23:59 UTC
total number of suspected botnet IPs: 1819
number of botnet IPs notified to network operators: 1400
number of blocked spams: 16648
recipient count of blocked spams: 272784

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-GD	269
2	HINET-NET	255
3	CHINANET-GD	102
4	BSNLNET	88
5	CTTNET	41
6	VNPT-VNNIC-VN	36
7	CRTC	36
8	UNICOM-BJ	32
9	CHINANET-JS	30
10	RCOM	25

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	639
2	Taiwan	259
3	India	194
4	Brazil	106
5	Russian Federation	76
6	Viet Nam	52
7	South Korea	51
8	Ukraine	48
9	Indonesia	43
10	United States	35

Botnet Statistics [2011-05-18]

detection period: 2011-05-18 00:00-23:59 UTC
total number of suspected botnet IPs: 2067
number of botnet IPs notified to network operators: 1559
number of blocked spams: 14764
recipient count of blocked spams: 248147

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-GD	269
2	HINET-NET	250
3	CHINANET-GD	152
4	BSNLNET	62
5	UNICOM-BJ	58
6	KORNET-KR	46
7	VNPT-VNNIC-VN	44
8	CTTNET	35
9	CRTC	27
10	CHINANET-JS	26

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	706
2	Taiwan	260
3	India	144
4	Brazil	117
5	Russian Federation	92
6	South Korea	85
7	Viet Nam	63
8	Ukraine	48
9	Indonesia	37
10	Argentina	30

Botnet Statistics [2011-05-17]

detection period: 2011-05-17 00:00-23:59 UTC
total number of suspected botnet IPs: 2306
number of botnet IPs notified to network operators: 1677
number of blocked spams: 104773
recipient count of blocked spams: 3376789

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	260
2	UNICOM-GD	215
3	CHINANET-GD	97
4	BSNLNET	73
5	UNICOM-BJ	33
6	CHINANET-JS	33
7	KORNET-KR	31
8	CRTC	27
9	000.065.376/0002-65	27
10	RCOM	25

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	686
2	Taiwan	279
3	India	181
4	Brazil	170
5	Russian Federation	134
6	South Korea	77
7	Ukraine	60
8	United States	51
9	Colombia	40
10	Poland	37

Botnet Statistics [2011-05-16]

detection period: 2011-05-16 00:00-23:59 UTC
total number of suspected botnet IPs: 2951
number of botnet IPs notified to network operators: 2087
number of blocked spams: 164634
recipient count of blocked spams: 5351567

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	320
2	UNICOM-GD	281
3	CHINANET-GD	224
4	UNICOM-BJ	52
5	VNPT-VNNIC-VN	49
6	KORNET-KR	47
7	CRTC	46
8	PTCL	42
9	CHINANET-JS	38
10	BSNLNET	36

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	917
2	Taiwan	340
3	Brazil	164
4	South Korea	150
5	India	149
6	Russian Federation	129
7	Viet Nam	75
8	Ukraine	71
9	United States	60
10	Poland	51

Botnet Statistics [2011-05-15]

detection period: 2011-05-15 00:00-23:59 UTC
total number of suspected botnet IPs: 2629
number of botnet IPs notified to network operators: 2009
number of blocked spams: 101904
recipient count of blocked spams: 3246910

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	328
2	CHINANET-GD	323
3	UNICOM-GD	223
4	UNICOM-BJ	78
5	KORNET-KR	46
6	CRTC	46
7	CHINANET-JS	43
8	000.065.376/0002-65	30
9	VNPT-VNNIC-VN	28
10	BSNLNET	27

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	984
2	Taiwan	350
3	Brazil	138
4	Russian Federation	115
5	South Korea	108
6	India	98
7	United States	61
8	Ukraine	52
9	Viet Nam	40
10	Indonesia	39

Botnet Statistics [2011-05-14]

detection period: 2011-05-14 00:00-23:59 UTC
total number of suspected botnet IPs: 1646
number of botnet IPs notified to network operators: 1365
number of blocked spams: 15988
recipient count of blocked spams: 334595

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	326
2	CHINANET-GD	238
3	UNICOM-GD	208
4	BSNLNET	45
5	CRTC	37
6	CHINANET-ZJ-WZ	28
7	UNICOM-BJ	24
8	RCOM	17
9	TELKOMNET	15
10	CHINANET-JS	15

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	697
2	Taiwan	337
3	India	130
4	Brazil	70
5	Russian Federation	63
6	Poland	26
7	South Korea	25
8	Indonesia	23
9	United States	21
10	Ukraine	19

Botnet Statistics [2011-05-13]

detection period: 2011-05-13 00:00-23:59 UTC
total number of suspected botnet IPs: 2551
number of botnet IPs notified to network operators: 1866
number of blocked spams: 154915
recipient count of blocked spams: 4969946

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	244
2	CHINANET-GD	234
3	UNICOM-GD	222
4	UNICOM-HA	99
5	KORNET-KR	38
6	CRTC	36
7	BSNLNET	32
8	VNPT-VNNIC-VN	30
9	CHINANET-JS	27
10	TELKOMNET	26

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	903
2	Taiwan	265
3	Russian Federation	145
4	Brazil	142
5	India	129
6	Ukraine	89
7	South Korea	84
8	United States	59
9	Indonesia	55
10	Viet Nam	48

Botnet Statistics [2011-05-12]

detection period: 2011-05-12 00:00-23:59 UTC
total number of suspected botnet IPs: 2418
number of botnet IPs notified to network operators: 1807
number of blocked spams: 203714
recipient count of blocked spams: 6733072

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	293
2	UNICOM-GD	231
3	UNICOM-HA	219
4	CHINANET-GD	217
5	BSNLNET	44
6	CHINANET-JS	30
7	CRTC	24
8	PTCL	23
9	002.558.157/0001-62	21
10	VNPT-VNNIC-VN	20

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1001
2	Taiwan	311
3	India	142
4	Brazil	133
5	Russian Federation	100
6	United States	52
7	Ukraine	46
8	South Korea	46
9	Indonesia	45
10	Poland	34

Botnet Statistics [2011-05-11]

detection period: 2011-05-11 00:00-23:59 UTC
total number of suspected botnet IPs: 2504
number of botnet IPs notified to network operators: 1996
number of blocked spams: 210570
recipient count of blocked spams: 6908441

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	363
2	UNICOM-HA	252
3	UNICOM-GD	227
4	CHINANET-GD	224
5	CHINANET-JS	46
6	KORNET-KR	42
7	VNPT-VNNIC-VN	36
8	UNICOM-BJ	26
9	BHARTI-IN	26
10	CHINANET-ZJ-WZ	23

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1041
2	Taiwan	377
3	Brazil	137
4	India	110
5	South Korea	78
6	Russian Federation	74
7	Viet Nam	50
8	Ukraine	45
9	Indonesia	44
10	United States	41

Botnet Statistics for April 2011

detection period: 2011-04-01 00:00 - 2011-04-30 23:59 UTC
total number of suspected botnet IPs: 61430
number of blocked spams: 2406521
recipient count of blocked spams: 65644324

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	15733
2	Taiwan	9383
3	India	5676
4	Russian Federation	4208
5	South Korea	3112
6	Brazil	2219
7	Ukraine	1864
8	Indonesia	1654
9	Viet Nam	1502
10	Pakistan	1089
11	United States	875
12	Colombia	730
13	Belarus	711
14	Argentina	704
15	Poland	651
16	Kazakhstan	528
17	Romania	503
18	Serbia	484
19	Spain	481
20	Peru	417
21	Saudi Arabia	406
22	United Kingdom	356
23	Thailand	336
24	Morocco	318
25	Philippines	312

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	Taiwan	685699
2	China	647688
3	Brazil	180028
4	Russian Federation	95487
5	United States	90492
6	India	59527
7	France	50181
8	Colombia	47077
9	Thailand	43564
10	Poland	39904
11	Indonesia	35200
12	Ukraine	33967
13	Mexico	27650
14	Iran	23989
15	South Korea	23777
16	Germany	21490
17	Chile	18292
18	Kazakhstan	17331
19	Argentina	15830
20	Italy	15668
21	Czech Republic	14611
22	Guatemala	11379
23	Canada	10302
24	Viet Nam	9720
25	European Union	9294

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2011-05-10]

detection period: 2011-05-10 00:00-23:59 UTC
total number of suspected botnet IPs: 2481
number of botnet IPs notified to network operators: 1874
number of blocked spams: 207499
recipient count of blocked spams: 6763296

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	362
2	UNICOM-GD	233
3	CHINANET-GD	219
4	UNICOM-HA	142
5	BSNLNET	31
6	VNPT-VNNIC-VN	26
7	CHINANET-JS	26
8	TELKOMNET	24
9	BHARTI-IN	24
10	002.558.157/0001-62	23

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	895
2	Taiwan	377
3	Brazil	149
4	India	131
5	Russian Federation	104
6	United States	72
7	Indonesia	54
8	South Korea	50
9	Ukraine	44
10	Viet Nam	40

Botnet Statistics [2011-05-09]

detection period: 2011-05-09 00:00-23:59 UTC
total number of suspected botnet IPs: 2773
number of botnet IPs notified to network operators: 2150
number of blocked spams: 89808
recipient count of blocked spams: 2658788

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	371
2	UNICOM-HA	267
3	UNICOM-GD	233
4	CHINANET-GD	221
5	CTTNET	112
6	PTCL	40
7	UNICOM-BJ	38
8	CRTC	35
9	CHINANET-JS	35
10	KORNET-KR	34

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1149
2	Taiwan	385
3	Brazil	140
4	India	121
5	Russian Federation	77
6	South Korea	70
7	United States	61
8	Pakistan	45
9	Viet Nam	41
10	Indonesia	40

Botnet Statistics [2011-05-08]

detection period: 2011-05-08 00:00-23:59 UTC
total number of suspected botnet IPs: 2421
number of botnet IPs notified to network operators: 2093
number of blocked spams: 43971
recipient count of blocked spams: 990736

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-HA	365
2	HINET-NET	362
3	CTTNET	296
4	UNICOM-GD	270
5	CHINANET-GD	195
6	CRTC	41
7	UNICOM-BJ	35
8	CHINANET-JS	30
9	BSNLNET	17
10	UNICOM-SD	15

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1356
2	Taiwan	372
3	India	69
4	Brazil	50
5	Russian Federation	45
6	Indonesia	38
7	Kazakhstan	33
8	Argentina	31
9	Ukraine	27
10	Poland	25

Botnet Statistics [2011-05-07]

detection period: 2011-05-07 00:00-23:59 UTC
total number of suspected botnet IPs: 2736
number of botnet IPs notified to network operators: 2298
number of blocked spams: 43067
recipient count of blocked spams: 979571

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	365
2	CTTNET	315
3	UNICOM-HA	299
4	CHINANET-GD	289
5	UNICOM-GD	276
6	BSNLNET	50
7	CRTC	41
8	VNPT-VNNIC-VN	35
9	PTCL	30
10	KORNET-KR	30

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1412
2	Taiwan	372
3	India	118
4	Brazil	105
5	South Korea	63
6	Argentina	51
7	Viet Nam	47
8	Russian Federation	42
9	Indonesia	39
10	Pakistan	35

Botnet Statistics [2011-05-06]

detection period: 2011-05-06 00:00-23:59 UTC
total number of suspected botnet IPs: 2887
number of botnet IPs notified to network operators: 2551
number of blocked spams: 45051
recipient count of blocked spams: 956227

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	882
2	HINET-NET	361
3	UNICOM-HA	312
4	CTTNET	280
5	UNICOM-GD	176
6	BSNLNET	45
7	CRTC	38
8	UNICOM-BJ	30
9	CHINANET-JS	25
10	PTCL	21

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1891
2	Taiwan	367
3	India	102
4	Brazil	88
5	Russian Federation	41
6	Viet Nam	39
7	Indonesia	34
8	Kazakhstan	29
9	Ukraine	26
10	United States	25

Botnet Statistics [2011-05-05]

detection period: 2011-05-05 00:00-23:59 UTC
total number of suspected botnet IPs: 2778
number of botnet IPs notified to network operators: 2328
number of blocked spams: 37627
recipient count of blocked spams: 858499

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-HA	351
2	CTTNET	344
3	CHINANET-GD	275
4	HINET-NET	193
5	BSNLNET	117
6	UNICOM-GD	116
7	RCOM	41
8	CHINANET-JS	38
9	CRTC	31
10	TELKOMNET	30

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1346
2	India	269
3	Taiwan	204
4	Brazil	148
5	Russian Federation	85
6	Indonesia	65
7	Kazakhstan	45
8	Viet Nam	43
9	Ukraine	40
10	Argentina	35

Botnet Statistics [2011-05-04]

detection period: 2011-05-04 00:00-23:59 UTC
total number of suspected botnet IPs: 2573
number of botnet IPs notified to network operators: 1922
number of blocked spams: 84610
recipient count of blocked spams: 2867322

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-HA	307
2	CTTNET	289
3	BSNLNET	143
4	HINET-NET	119
5	CHINANET-GD	107
6	CHINANET-JS	38
7	PTCL	31
8	RCOM	30
9	KORNET-KR	27
10	UNICOM-SD	26

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1039
2	India	297
3	Brazil	178
4	Taiwan	132
5	Russian Federation	105
6	United States	67
7	Indonesia	50
8	South Korea	47
9	Ukraine	46
10	Kazakhstan	41

Botnet Statistics [2011-05-03]

detection period: 2011-05-03 00:00-23:59 UTC
total number of suspected botnet IPs: 2561
number of botnet IPs notified to network operators: 1933
number of blocked spams: 97289
recipient count of blocked spams: 3332625

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-HA	294
2	CTTNET	288
3	HINET-NET	204
4	CHINANET-GD	102
5	UNICOM-HN	83
6	TELKOMNET	44
7	BSNLNET	44
8	UNICOM-GD	35
9	VNPT-VNNIC-VN	30
10	CHINANET-JS	26

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1080
2	Taiwan	218
3	India	145
4	Brazil	124
5	Indonesia	99
6	Russian Federation	78
7	United States	58
8	Viet Nam	56
9	Argentina	42
10	South Korea	38

Botnet Statistics [2011-05-02]

detection period: 2011-05-02 00:00-23:59 UTC
total number of suspected botnet IPs: 2534
number of botnet IPs notified to network operators: 1783
number of blocked spams: 94329
recipient count of blocked spams: 3248592

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	186
2	UNICOM-HA	155
3	CHINANET-GD	105
4	CTTNET	98
5	UNICOM-HN	97
6	BSNLNET	97
7	UNICOM-GD	72
8	KORNET-KR	52
9	TELKOMNET	44
10	CRTC	43

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	787
2	India	229
3	Taiwan	200
4	Brazil	170
5	South Korea	115
6	Indonesia	82
7	Russian Federation	80
8	United States	53
9	Argentina	50
10	Ukraine	48

Botnet Statistics [2011-05-01]

detection period: 2011-05-01 00:00-23:59 UTC
total number of suspected botnet IPs: 1886
number of botnet IPs notified to network operators: 1277
number of blocked spams: 95851
recipient count of blocked spams: 3282162

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	189
2	CHINANET-GD	170
3	UNICOM-GD	74
4	PTCL	43
5	CRTC	37
6	BSNLNET	35
7	TELKOMNET	30
8	CHINANET-JS	25
9	KORNET-KR	23
10	VNPT-VNNIC-VN	22

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	496
2	Taiwan	201
3	Brazil	130
4	India	101
5	Russian Federation	77
6	United States	61
7	Indonesia	57
8	South Korea	51
9	Pakistan	45
10	Ukraine	44

Botnet Statistics [2011-04-30]

detection period: 2011-04-30 00:00-23:59 UTC
total number of suspected botnet IPs: 2457
number of botnet IPs notified to network operators: 1796
number of blocked spams: 56121
recipient count of blocked spams: 1544889

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	338
2	UNICOM-GD	244
3	CHINANET-GD	111
4	BSNLNET	79
5	PTCL	47
6	CRTC	39
7	CHINANET-JS	34
8	AR-TEAR7-LACNIC	34
9	000.065.376/0002-65	27
10	UNICOM-BJ	25

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	627
2	Taiwan	351
3	India	202
4	Brazil	159
5	Russian Federation	88
6	Indonesia	60
7	Argentina	57
8	Ukraine	55
9	United States	54
10	Pakistan	53