Botnet Statistics for May 2012

The most notable number for May 2012 is the number of bots in China. It was around 15K in April, while in May it rose to 35K.

detection period: 2012-05-01 00:00 - 2012-05-31 23:59 UTC
total number of suspected botnet IPs: 70827
number of blocked spams: 4787051
recipient count of blocked spams: 162742325

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	35178
2	India	4848
3	Taiwan	4674
4	Viet Nam	2787
5	United States	1782
6	South Korea	1699
7	Brazil	1669
8	Pakistan	1438
9	Russian Federation	1274
10	Argentina	783
11	Poland	736
12	Iran	701
13	Kazakhstan	685
14	Peru	681
15	Indonesia	656
16	Romania	531
17	Colombia	515
18	Ukraine	497
19	Belarus	480
20	Saudi Arabia	476
21	Turkey	392
22	Spain	389
23	Chile	370
24	Germany	368
25	Mexico	349

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	1190640
2	Brazil	601363
3	United States	388496
4	Russian Federation	264689
5	India	242710
6	South Korea	182054
7	Taiwan	141587
8	Indonesia	116117
9	Ukraine	86526
10	France	80072
11	Hong Kong	74955
12	United Kingdom	74033
13	Iran	69602
14	Germany	68474
15	Viet Nam	61960
16	Netherlands	60289
17	Canada	60060
18	Colombia	57623
19	Mexico	53862
20	Philippines	53290
21	Poland	45940
22	Thailand	38479
23	Czech Republic	36444
24	Sweden	35381
25	Italy	34829

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Rank	Country	recipient count of blocked spams
1	China	37522562
2	Brazil	21014319
3	United States	13571792
4	Russian Federation	9247015
5	India	8480726
6	South Korea	6362839
7	Taiwan	4533887
8	Indonesia	4054786
9	Ukraine	3025572
10	France	2796609
11	Hong Kong	2615644
12	United Kingdom	2588974
13	Iran	2431849
14	Germany	2391009
15	Viet Nam	2160500
16	Netherlands	2106900
17	Canada	2097958
18	Colombia	2014206
19	Mexico	1882582
20	Philippines	1864537
21	Poland	1604806
22	Thailand	1341954
23	Czech Republic	1272907
24	Sweden	1238168
25	Italy	1217491

The top 25 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	13522
2	UNICOM-GD	4752
3	HINET-NET	4429
4	MAINT-CHINANET-HA	4077
5	UNICOM-HN	2523
6	CHINANET-HA	2454
7	VNPT-VNNIC-VN	1666
8	BSNLNET	1631
9	CHINANET-FJ	1069
10	PTCL	1049
11	CRTC	863
12	UNICOM-LN	779
13	KORNET-KR	589
14	BHARTI-IN	533
15	UNICOM-HB	513
16	CHINANET-HB	488
17	ZTWL	462
18	MTNLISP	420
19	CHINANET-JS	417
20	RCOM	367
21	Xpeed-KR	333
22	PHN-67-221-46-0-23	322
23	002.558.134/0001-58	309
24	AR-TEAR7-LACNIC	297
25	VIETEL-VNNIC-VN	295

The top 25 networks (as found in WHOIS), ordered by number of blocked spams are:

Rank	Network	# of blocked spams
1	CHINANET-GD	175603
2	HINET-NET	117603
3	003.420.926/0002-05	104355
4	CHINANET-JS	101428
5	002.558.157/0001-62	97393
6	KRNIC-KR	79747
7	000.065.376/0002-65	76368
8	033.530.486/0001-29	67978
9	UNICOM-SD	59012
10	CHINANET-ZJ	53454
11	TATACOMM-IN	52342
12	002.558.134/0001-58	51965
13	UNICOM-GD	46693
14	KORNET-KR	45932
15	004.027.547/0001-31	43453
16	CHINANET-GX	41153
17	CHINANET-SH	40847
18	071.208.516/0001-74	36699
19	CHINANET-GZ	34750
20	UNICOM-LN	34504
21	TELKOMNET	34244
22	CHINANET-SC	30858
23	CHINANET-FJ	29046
24	BSNLNET	28231
25	VE-CSVE-LACNIC	27695

The top 25 networks (as found in WHOIS), ordered by recipient count of blocked spams are:

Rank	Network	recipient count of blocked spams
1	HINET-NET	3696471
2	003.420.926/0002-05	3650979
3	CHINANET-JS	3542424
4	002.558.157/0001-62	3404559
5	CHINANET-GD	2925918
6	KRNIC-KR	2789282
7	000.065.376/0002-65	2672037
8	033.530.486/0001-29	2376316
9	UNICOM-SD	2055845
10	CHINANET-ZJ	1868818
11	TATACOMM-IN	1828497
12	002.558.134/0001-58	1813074
13	KORNET-KR	1605625
14	004.027.547/0001-31	1516703
15	CHINANET-GX	1440981
16	CHINANET-SH	1426689
17	071.208.516/0001-74	1281122
18	CHINANET-GZ	1214926
19	UNICOM-LN	1206233
20	TELKOMNET	1195822
21	CHINANET-SC	1077800
22	CHINANET-FJ	1017435
23	BSNLNET	987238
24	VE-CSVE-LACNIC	968313
25	IPG	959635