Introduction

As security professionals we always are asked how large is the population of an infection. Conficker is no different from any other, and it seems that everyone wants to have some value to use for many different purposes. The press for impact, some vendors for FUD, and others to have a number to compare to other infections. The bottom line is that no one can give an exact number on any infection ever. If anyone ever states exact numbers, they either are controlling it, or are not being completely honest to themselves or others on the means of data collection. We can estimate a number based off of certain traffic types, but we make mistakes as often as anyone else. A lot of the malicious traffic can resemble other legitimate or malicious traffic which of course skews the numbers. On top of simple traffic analysis each threat provides its own unique mechanisms for tracking infection statistics. Each of these methods of course come with their own positives and negatives when discussing accuracy of the data. It is what that in mind that we wanted attempt to draw out some of the pro's and con's of our data collection methodology below.

So, it is with a lot of trepidation that we even show any values for conficker knowing that they will most likely be taken out of context and quoted by many.

Population Numbers

What the following tables show are the daily connections and unique IP's that have been connecting to our tracking systems. Many people equate one IP to one system, but that is not usually the case. If the system is behind a NAT gateway, it would represent dozens or hundreds of systems. If a system is mobile it could be reported several times in a single day under different IP's. And in today's world there are a very large number of mobile users which could inflate the number of connections and unique IP's that are tracked.

What does this really mean? The daily numbers should represent the potential maximum level of the infection, but in previous test cases usually prove to be much less than that maximum. So, take the range of 25% to 75% of the values that we display as the possible infection population and you will be close to the real value. And yes, this is a very large range, and you can see why we do not like to quote any numbers for infection populations, and why you will see very high and low numbers get quoted regularly depending on the purpose of the person making the quote.

One last note: we are publishing these numbers to give a better understanding of what we are tracking. We do not believe in shaming anyone related to these values, and is not our purpose in any way.

Data Details

These tables are updated daily from the tracking systems. They are updated only once a day.

Conficker A+B

These tables are specifically for the A+B infections.

Day        Date        Total HTTP Hits  Unique IP's  Unique ASN's  Unique GEO's
Thursday   2016-01-07           84,513      617,441        11,823           222
Wednesday  2016-01-06          112,810      613,383        11,850           221
Tuesday    2016-01-05          151,548      630,260        11,990           221
Monday     2016-01-04          122,022      628,302        11,927           223
Sunday     2016-01-03          227,351      466,705        10,746           220
Saturday   2016-01-02          227,373      489,060        10,944           219
Friday     2016-01-01          333,633      425,262        10,380           218
Thursday   2015-12-31          220,622      568,428        11,482           218
Wednesday  2015-12-30          253,210      621,588        12,039           219
Tuesday    2015-12-29          226,549      619,760        12,055           219
Monday     2015-12-28          248,939      624,242        12,081           217
Sunday     2015-12-27          268,497      462,667        10,842           216
Saturday   2015-12-26          269,078      512,579        11,147           217
Friday     2015-12-25          302,842      499,192        11,045           215
Thursday   2015-12-24          220,651      575,166        11,733           219
Wednesday  2015-12-23          205,994      638,873        12,189           220
Tuesday    2015-12-22          218,468      651,033        12,319           220
Monday     2015-12-21          295,625      236,149         9,448           218
Sunday     2015-12-20        1,281,230       13,495         1,707           144
Saturday   2015-12-19        1,338,389       16,437         1,826           143
Friday     2015-12-18        1,103,555       20,845         2,065           154
Thursday   2015-12-17          742,699       36,629         3,295           170
Wednesday  2015-12-16          257,339      663,624        12,512           221
Tuesday    2015-12-15          159,966      669,445        12,510           221
Monday     2015-12-14          186,810      667,051        12,484           222
Sunday     2015-12-13          176,331      493,371        11,102           219
Saturday   2015-12-12           60,918      522,347        11,394           222
Friday     2015-12-11          200,946      655,247        12,395           221
Thursday   2015-12-10           61,231      620,359        12,320           221
Wednesday  2015-12-09          189,267      669,256        12,548           222

This chart shows the rate of IP's being seen over time.

90-Day

180-Day

Year

Conficker C

These tables are specifically for the C infections

Day        Date        Total HTTP Hits  Unique IP's  Unique ASN's  Unique GEO's
Thursday   2016-01-07                                                          
Wednesday  2016-01-06                                                          
Tuesday    2016-01-05                                                          
Monday     2016-01-04                                                          
Sunday     2016-01-03                                                          
Saturday   2016-01-02                                                          
Friday     2016-01-01                                                          
Thursday   2015-12-31                                                          
Wednesday  2015-12-30                                                          
Tuesday    2015-12-29                                                          
Monday     2015-12-28                                                          
Sunday     2015-12-27                                                          
Saturday   2015-12-26                                                          
Friday     2015-12-25                                                          
Thursday   2015-12-24                                                          
Wednesday  2015-12-23                                                          
Tuesday    2015-12-22                                                          
Monday     2015-12-21                                                          
Sunday     2015-12-20                                                          
Saturday   2015-12-19                                                          
Friday     2015-12-18                                                          
Thursday   2015-12-17                                                          
Wednesday  2015-12-16                                                          
Tuesday    2015-12-15                                                          
Monday     2015-12-14                                                          
Sunday     2015-12-13                                                          
Saturday   2015-12-12                                                          
Friday     2015-12-11                                                          
Thursday   2015-12-10                                                          
Wednesday  2015-12-09                                                          

This chart shows the rate of IP's being seen over time. Because of the great difference between the daily totals and the hourly, we are using two Y-Axis values. The Y-Axis on the left is for the daily totals, while the one on the right s for both the hourly lines.

90-Day

180-Day

Year

Conficker A+B+C

This data set is the aggregate of all the conficker infections for today.

Day        Date        Total HTTP Hits  Unique IP's  Unique ASN's  Unique GEO's
Thursday   2016-01-07           84,513      617,441        11,823           222
Wednesday  2016-01-06          112,810      613,383        11,850           221
Tuesday    2016-01-05          151,548      630,260        11,990           221
Monday     2016-01-04          122,022      628,302        11,927           223
Sunday     2016-01-03          227,351      466,705        10,746           220
Saturday   2016-01-02          227,373      489,060        10,944           219
Friday     2016-01-01          333,633      425,262        10,380           218
Thursday   2015-12-31          220,622      568,428        11,482           218
Wednesday  2015-12-30          253,210      621,588        12,039           219
Tuesday    2015-12-29          226,549      619,760        12,055           219
Monday     2015-12-28          248,939      624,242        12,081           217
Sunday     2015-12-27          268,497      462,667        10,842           216
Saturday   2015-12-26          269,078      512,579        11,147           217
Friday     2015-12-25          302,842      499,192        11,045           215
Thursday   2015-12-24          220,651      575,166        11,733           219
Wednesday  2015-12-23          205,994      638,873        12,189           220
Tuesday    2015-12-22          218,468      651,033        12,319           220
Monday     2015-12-21          295,625      236,149         9,448           218
Sunday     2015-12-20        1,281,230       13,495         1,707           144
Saturday   2015-12-19        1,338,389       16,437         1,826           143
Friday     2015-12-18        1,103,555       20,845         2,065           154
Thursday   2015-12-17          742,699       36,629         3,295           170
Wednesday  2015-12-16          257,339      663,624        12,512           221
Tuesday    2015-12-15          159,966      669,445        12,510           221
Monday     2015-12-14          186,810      667,051        12,484           222
Sunday     2015-12-13          176,331      493,371        11,102           219
Saturday   2015-12-12           60,918      522,347        11,394           222
Friday     2015-12-11          200,946      655,247        12,395           221
Thursday   2015-12-10           61,231      620,359        12,320           221
Wednesday  2015-12-09          189,267      669,256        12,548           222

90-Day

180-Day

Year

ASN Statistics

These charts represent how many ASN's are effected during the period of the graph.

90-Day

180-Day

Year

Country Statistics

These charts represent how many countries are effected during the period of the graph.

90-Day

180-Day

Year

HTTP Hit Statistics

These charts show how many daily hits from Conficker systems that we are seeing during the period of the graphs. While this is not really representative of an infection population, it does show the level of work that the Conficker Working Group must do daily in dealing with the level of events from Conficker.

90-Day

180-Day

Year