Sometimes I read articles about the size of botnets. For example, this article on Krebs on Security is called “Who’s Behind the World’s Largest Spam Botnet?” Krebs names grum as the biggest botnet.
How is the size of the botnet measured? There are multiple ways, here are three:
I collect statistics on (1) and (2), but not (3). Microsoft does collect malware statistics through its Microsoft Security Essentials A/V software, as well as the Malicious Software Removal Tool, but I can’t correlate its data with my own (we use two different sources to identify them).
But using this, which are the top 10 botnets by distinct number of IP addresses since Jan 1, 2012 (that have sent mail to our services, YMMV)?
Top Botnets by IP since Jan 1, 2012
The numbers in square brackets are the normalized values of number of IPs. For example, cutwail contains 95.7 times as many distinct IPs as s_torpig.
Top Botnets by # emails since Jan 1, 2012
Going by these numbers, grum is the second largest by IP address and the third largest by volume of mail, but it is significantly smaller when it comes to volume of mail. It deserves the name of “one of the largest botnets” but by our data it is not the largest one that sends spam to us.
The biggest one is either cutwail or lethic. I’d list grum third.