Botnet Statistics for March 2013

The number of infected computers detected went from 65K in February to 114K in March, an increase of 75%. It seems to me that bot herders have the upper hand now.

detection period: 2013-03-01 00:00 - 2013-03-31 23:59 UTC
total number of suspected botnet IPs: 114436
number of blocked spams: 2526693
recipient count of blocked spams: 91790675

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	46623
2	Belarus	18180
3	Kazakhstan	6141
4	United States	4304
5	Ukraine	4030
6	Viet Nam	3197
7	Taiwan	2508
8	Russian Federation	2113
9	India	1872
10	Argentina	1742
11	Poland	1726
12	Spain	1693
13	Peru	1322
14	Colombia	1249
15	Mexico	1060
16	Iran	1044
17	Italy	939
18	Brazil	896
19	Germany	871
20	United Kingdom	688
21	Saudi Arabia	681
22	Romania	664
23	Chile	632
24	Turkey	601
25	Canada	559

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	424656
2	United States	378148
3	Brazil	313538
4	Russian Federation	185284
5	United Kingdom	85273
6	South Korea	76228
7	India	69159
8	Taiwan	61442
9	France	60860
10	Ukraine	60064
11	Iran	49243
12	Spain	47505
13	Germany	46499
14	Indonesia	43788
15	Colombia	40143
16	Argentina	39196
17	Thailand	35764
18	Peru	26969
19	Poland	26597
20	Romania	21003
21	Mexico	19807
22	Netherlands	18880
23	Chile	18419
24	Kuwait	17622
25	Canada	16287

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Rank	Country	recipient count of blocked spams
1	China	14248262
2	United States	14006973
3	Brazil	11608477
4	Russian Federation	6871532
5	United Kingdom	3027674
6	South Korea	2826552
7	India	2566409
8	France	2259341
9	Taiwan	2232037
10	Ukraine	2218316
11	Iran	1823643
12	Spain	1761114
13	Indonesia	1620599
14	Germany	1563631
15	Colombia	1490878
16	Argentina	1451724
17	Thailand	1324332
18	Peru	999740
19	Poland	986583
20	Romania	778505
21	Mexico	734420
22	Netherlands	701652
23	Chile	685713
24	Kuwait	651650
25	Canada	604027

The top 25 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	BY-BELPAK-20091210	9649
2	CHINANET-HB	9552
3	CHINANET-JS	5721
4	CRTC	4649
5	CHINANET-HE	4182
6	CHINANET-GD	3405
7	BY-BELPAK-20120330	3177
8	CTTNET	3005
9	UNICOM-LN	2287
10	BY-BELPAK-20080213	2186
11	VNPT-VNNIC-VN	1963
12	HINET-NET	1936
13	BY-BELPAK-20120106	1788
14	KZ-KAZAKTELECOM-20080923	1536
15	KZ-KAZAKTELECOM-20091126	1307
16	UNICOM-SD	1051
17	CHINANET-FJ	1016
18	UNICOM-GD	748
19	UNICOM-HL	725
20	AR-TEAR7-LACNIC	725
21	UNICOM-HE	604
22	GWBN-WUHAN	552
23	UNICOM-NM	533
24	PE-TPSA-LACNIC	529
25	BSNLNET	509

The top 25 networks (as found in WHOIS), ordered by number of blocked spams are:

Rank	Network	# of blocked spams
1	MSFT-EP	85848
2	HINET-NET	52381
3	002.558.157/0001-62	48386
4	003.420.926/0002-05	47099
5	UNICOM-LN	44854
6	KORNET-KR	36744
7	033.530.486/0001-29	32500
8	UNICOM-GD	28510
9	CHINANET-GD	28046
10	004.027.547/0001-31	24763
11	BHARTI-IN	24588
12	CMNET	24285
13	002.558.134/0001-58	24166
14	CO-ACSA-LACNIC	22464
15	HICHINA	20726
16	ES-ONO-20040415	19941
17	CHINANET-SH	19256
18	GBLX-11C	18780
19	JIAOJIANG-DONGGANG-LTD	18523
20	GULFNET-MOI	17443
21	CCS-DGI	17217
22	UNICOM-HE	14519
23	VAUGHAN-LIMITED-24684-LAN	13402
24	FR-OVH-20060920	13265
25	AR-IYTS-LACNIC	13022

The top 25 networks (as found in WHOIS), ordered by recipient count of blocked spams are:

Rank	Network	recipient count of blocked spams
1	MSFT-EP	3188883
2	HINET-NET	1894649
3	002.558.157/0001-62	1792222
4	003.420.926/0002-05	1748333
5	UNICOM-LN	1662466
6	KORNET-KR	1363536
7	033.530.486/0001-29	1201565
8	CHINANET-GD	1016762
9	004.027.547/0001-31	916021
10	BHARTI-IN	915593
11	CMNET	899295
12	002.558.134/0001-58	895372
13	CO-ACSA-LACNIC	837041
14	HICHINA	768611
15	ES-ONO-20040415	739266
16	CHINANET-SH	714041
17	GBLX-11C	697018
18	JIAOJIANG-DONGGANG-LTD	687221
19	GULFNET-MOI	645168
20	CCS-DGI	637671
21	UNICOM-HE	538106
22	VAUGHAN-LIMITED-24684-LAN	495488
23	FR-OVH-20060920	493198
24	AR-IYTS-LACNIC	483273
25	IR-DCC-20010403	469601