Botnet Statistics [2012-07-15]

I built another greylisting system yesterday. As data collected from its first day of operation was incomplete, I did not use them.

detection period: 2012-07-15 00:00-23:59 UTC
total number of suspected botnet IPs: 2430
number of botnet IPs notified to network operators: 2187
number of spam blocked: 130677
recipient count of spam blocked: 4113692

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	939
2	UNICOM-GD	598
3	HINET-NET	300
4	003.420.926/0002-05	16
5	CHINANET-JS	14
6	002.558.157/0001-62	13
7	000.065.376/0002-65	12
8	TELEHOUSE	10
9	NETBLK-SOFTLAYER-RIPE-CUST-AR10282-RIPE	8
10	KORNET-KR	8

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1638
2	Taiwan	304
3	Brazil	88
4	Russian Federation	62
5	United States	36
6	India	21
7	Netherlands	20
8	France	18
9	South Korea	17
10	Germany	15