Home / Blogs

How Frequently Do Botnets Reuse IP Addresses?

Terry Zink

I wonder how much botnets reuse IP addresses. Do they infect a system and spam, get blocked, discard the IP and move onto the next (new) one? This means that they have a nearly unlimited supply of IP addresses. Or do they infect a system and spam, get blocked, and then let it go dormant only to awaken it some time later?

I decided to take a look. To do this, I made a list of all the IPs that sent us mail that I could identify as part of a botnet (excluding unknown ones) since July 2011, a time span of 7.5 months. I then took all of the IPs that sent us mail today (or rather, the past 24 hours), and ran them against this list. The IPs that were on the botnet list were eventually blocked as spam. If IPs that sent us mail today appear on this list of botnet IPs, that means that botnets do reuse their IPs.

The question is what is the average time displacement of time-to-block vs time-to-resurrect, and do some bots do it more than others? Here are the results:

Top 10 Botnets that Reuse IP addresses

  1. cutwail [14.5]
  2. darkmailer [7.3]
  3. maazben [4.0]
  4. asprox [3.2]
  5. sendsafe [2.4]
  6. lethic [2.3]
  7. grum [1.7]
  8. fivetoone [1.2]
  9. festi [1.0]
  10. spamsalot [1.0]

The numbers in square brackets are relative values compared to the lowest one. This means that if spamsalot reused 20 distinct IP addresses, then cutwail reused 14.5 x 20 = 290 distinct IPs. Or, to put it another way, an IP that sent us mail today was also used by cutwail once in the past 7.5 months. By contrast, 14.5 IPs that sent us mail today were used cutwail in the past 7.5 months.

In other words, cutwail reuses its IPs much more than any other botnet.

Digging deeper, and explaining it better because the above paragraph makes no sense, I took a look at where the biggest amount of reuse occurred. Of all the IPs that sent us mail today, that at one time sent mail for cutwail, 28% of them were on Oct 27. The next largest value, Dec 17, only comprises 3%. Thus, for cutwail, there is a lag of around 3.5 months before it tries to reuse the same IPs. Asprox shows a similar reuse pattern for Oct 27.

Thus, while botnets do reuse IPs to send spam after they have been blocked, they don't do it a lot. Of the ones that do resend, they don't use very many of them again.

Clearly, spammers know when they have been blocked and keep bringing up new troops.

By Terry Zink, Program Manager. More blog posts from Terry Zink can also be read here.

Related topics: Cyberattack, Cybercrime, Malware, Security, Spam

WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

Interesting analysis John Levine  –  Feb 13, 2012 9:02 AM PST

Did you look and see whether listings on botnet BLs, notably the CBL, affect botnet reuse? I've always assumed that botnets look and see where they're blocked, so they can sell "fresh" bots for more money, but never had enough data to check.

CBL Terry Zink  –  Feb 13, 2012 9:23 AM PST

My data mapping of IPs does come from the CBL.

I haven't managed to do a fuller analysis yet because the CBL data is extremely large.  But that would be interesting.

We lose data of IPs once they end up on a blocklist.  One day we'll get it and I'll be able to do an analysis but my initial guess is that the patterns would be similar to the above.

To post comments, please login or create an account.

Related Blogs

Related News

Topics

Industry Updates – Sponsored Posts

Q3 2014 DDoS Trends: Attacks Exceeding 10 Gbps on the Rise

3 Questions to Ask Your DNS Host About DDoS

Afilias Partners With Internet Society to Sponsor Deploy360 ION Conference Series Through 2016

Neustar to Build Multiple Tbps DDoS Mitigation Platform

The Latest Internet Plague: Random Subdomain Attacks

Digging Deep Into DNS Data Discloses Damaging Domains

New gTLDs and Best Practices for Domain Management Policies (Video)

Nominum Announces Future Ready DNS

New from Verisign Labs - Measuring Privacy Disclosures in URL Query Strings

DotConnectAfrica Delegates Attend the Kenya Internet Governance Forum

3 Questions to Ask Your DNS Host about Lowering DDoS Risks

Continuing to Work in the Public Interest

Verisign Named to the OTA's 2014 Online Trust Honor Roll

4 Minutes Vs. 4 Hours: A Responder Explains Emergency DDoS Mitigation

Dyn Acquires Internet Intelligence Company, Renesys

Tips to Address New FFIEC DDoS Requirements

Smokescreening: Data Theft Makes DDoS More Dangerous

dotStrategy Selects Neustar's Registry Threat Mitigation Services for .BUZZ Registry

24 Million Home Routers Expose ISPs to Massive DNS-Based DDoS Attacks

What Does a DDoS Attack Look Like? (Watch First 3 Minutes of an Actual Attack)

Sponsored Topics

Minds + Machines

Top-Level Domains

Sponsored by
Minds + Machines
Verisign

Security

Sponsored by
Verisign
dotMobi

Mobile

Sponsored by
dotMobi
Afilias

DNSSEC

Sponsored by
Afilias