Botnet Statistics for December 2011

I forgot to save some log files from Dec 18, 2011 to Jan 04, 2012, so this month's statistics is kind of incomplete. Mistakes do happen. After all, I am only human.

detection period: 2011-12-01 00:00 - 2011-12-31 23:59 UTC
total number of suspected botnet IPs: 29628
number of blocked spams: 1609196
recipient count of blocked spams: 55690089

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	6619
2	China	6216
3	India	2434
4	Indonesia	1476
5	Viet Nam	1262
6	Russian Federation	1108
7	Brazil	792
8	South Korea	770
9	United States	764
10	Pakistan	530
11	Ukraine	452
12	Poland	452
13	Argentina	396
14	Romania	371
15	Belarus	311
16	Spain	257
17	Chile	249
18	Mexico	229
19	Serbia	227
20	Kazakhstan	209
21	Colombia	207
22	Germany	202
23	Saudi Arabia	163
24	European Union	160
25	Italy	158

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	420426
2	Brazil	180973
3	United States	159506
4	Taiwan	68411
5	Russian Federation	64009
6	France	48081
7	Indonesia	46467
8	India	43579
9	Germany	39113
10	Ukraine	37006
11	Canada	32144
12	Poland	26639
13	Thailand	23328
14	Czech Republic	22464
15	South Korea	22278
16	Hong Kong	19588
17	United Kingdom	18291
18	Viet Nam	18263
19	Chile	15286
20	European Union	15157
21	Iran	14723
22	Mexico	14073
23	Netherlands	12816
24	Italy	11775
25	Ecuador	11342

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Rank	Country	recipient count of blocked spams
1	China	14404351
2	Brazil	6324544
3	United States	5573238
4	Russian Federation	2235844
5	Taiwan	2134412
6	France	1682933
7	Indonesia	1623755
8	India	1522083
9	Germany	1367085
10	Ukraine	1293330
11	Canada	1122564
12	Poland	930794
13	Thailand	815237
14	Czech Republic	786383
15	South Korea	778743
16	Hong Kong	685167
17	United Kingdom	639577
18	Viet Nam	637016
19	Chile	533122
20	European Union	529439
21	Iran	515128
22	Mexico	491993
23	Netherlands	448101
24	Italy	409747
25	Ecuador	396945

The top 25 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	6436
2	CHINANET-GD	1367
3	CTTNET	1355
4	BSNLNET	976
5	VNPT-VNNIC-VN	705
6	PTCL	443
7	CRTC	434
8	TELKOMNET	378
9	KORNET-KR	357
10	CHINANET-JS	356
11	CHINANET-FJ	336
12	RCOM	232
13	BY-BELPAK-20091210	232
14	UNICOM-BJ	210
15	BHARTI-IN	209
16	AR-TEAR7-LACNIC	179
17	TATACOMM-IN	157
18	MTNLISP	136
19	RO-ARTELECOM-20070815	126
20	000.065.376/0002-65	125
21	CHINANET-ZJ-WZ	124
22	002.558.134/0001-58	121
23	CHINANET-SH	107
24	002.558.157/0001-62	106
25	VIETEL-VN	104

The top 25 networks (as found in WHOIS), ordered by number of blocked spams are:

Rank	Network	# of blocked spams
1	HINET-NET	59555
2	CHINANET-JS	39624
3	033.530.486/0001-29	38681
4	000.065.376/0002-65	36925
5	CHINANET-ZJ	35617
6	003.420.926/0002-05	34643
7	CHINANET-GX	31877
8	CHINANET-GD	25988
9	OVH	24529
10	UNICOM-JL	21222
11	CHINANET-SN	15930
12	002.558.157/0001-62	15418
13	CHINANET-GS	14822
14	UNICOM-LN	14154
15	CMNET	13732
16	CHINANET-ZJ-WZ	13035
17	UNICOM-SD	12963
18	SCTV-VN	12813
19	CHINANET-AH	11382
20	DACONET-CDT-NET	10450
21	TELKOMNET	10164
22	XOXO-BLK-14	9077
23	MX-USCV4-LACNIC	8876
24	IWEB-BLK-07	7970
25	VPLSNET	7914

The top 25 networks (as found in WHOIS), ordered by recipient count of blocked spams are:

Rank	Network	recipient count of blocked spams
1	HINET-NET	1824237
2	CHINANET-JS	1386299
3	033.530.486/0001-29	1353167
4	000.065.376/0002-65	1291215
5	003.420.926/0002-05	1209803
6	CHINANET-ZJ	1206943
7	CHINANET-GX	1114920
8	CHINANET-GD	909451
9	OVH	858542
10	UNICOM-JL	742699
11	CHINANET-SN	556433
12	002.558.157/0001-62	539259
13	CHINANET-GS	518764
14	UNICOM-LN	495418
15	CMNET	480854
16	UNICOM-SD	453265
17	SCTV-VN	447554
18	CHINANET-AH	397552
19	DACONET-CDT-NET	365992
20	TELKOMNET	355528
21	XOXO-BLK-14	317503
22	MX-USCV4-LACNIC	310501
23	VPLSNET	277465
24	IWEB-BLK-07	277459
25	002.558.134/0001-58	275022