Botnet Tracking

The botnet families we track right now, and where in the world their nodes answer from.

Where the nodes are

Loading the current picture…

Mercator projection · scroll to zoom, drag to pan

Mercator projection · zoom with the + and − buttons, drag sideways to pan

Per family

Addresses, not dots. Every family we track has a row here, including the ones the map draws in grey.

How to read it

A dot is a place

Geolocation resolves to a city, so thousands of addresses in the same city are one dot. A dense region has many places with bots, which is not the same as many bots.

An AS is an owner

An autonomous system is one operator's slice of the internet. A family spread over thousands of them is renting infrastructure everywhere, not running it from one place.

A map is not a census

We plot what we observe. An empty country is one we have not seen nodes in, which is a statement about our visibility as much as about the country.