Introduction

As security professionals we always are asked how large is the population of an infection. Conficker is no different from any other, and it seems that everyone wants to have some value to use for many different purposes. The press for impact, some vendors for FUD, and others to have a number to compare to other infections. The bottom line is that no one can give an exact number on any infection ever. If anyone ever states exact numbers, they either are controlling it, or are not being completely honest to themselves or others on the means of data collection. We can estimate a number based off of certain traffic types, but we make mistakes as often as anyone else. A lot of the malicious traffic can resemble other legitimate or malicious traffic which of course skews the numbers. On top of simple traffic analysis each threat provides its own unique mechanisms for tracking infection statistics. Each of these methods of course come with their own positives and negatives when discussing accuracy of the data. It is what that in mind that we wanted attempt to draw out some of the pro's and con's of our data collection methodology below.

So, it is with a lot of trepidation that we even show any values for conficker knowing that they will most likely be taken out of context and quoted by many.

Population Numbers

What the following tables show are the daily connections and unique IP's that have been connecting to our tracking systems. Many people equate one IP to one system, but that is not usually the case. If the system is behind a NAT gateway, it would represent dozens or hundreds of systems. If a system is mobile it could be reported several times in a single day under different IP's. And in today's world there are a very large number of mobile users which could inflate the number of connections and unique IP's that are tracked.

What does this really mean? The daily numbers should represent the potential maximum level of the infection, but in previous test cases usually prove to be much less than that maximum. So, take the range of 25% to 75% of the values that we display as the possible infection population and you will be close to the real value. And yes, this is a very large range, and you can see why we do not like to quote any numbers for infection populations, and why you will see very high and low numbers get quoted regularly depending on the purpose of the person making the quote.

One last note: we are publishing these numbers to give a better understanding of what we are tracking. We do not believe in shaming anyone related to these values, and is not our purpose in any way.

Data Details

These tables are updated daily from the tracking systems. They are updated only once a day.

Conficker A+B

These tables are specifically for the A+B infections.

Day        Date        Total HTTP Hits  Unique IP's  Unique ASN's  Unique GEO's
Sunday     2010-02-07      189,528,839    5,746,563        11,393           224
Saturday   2010-02-06      202,950,933    5,932,684        11,567           224
Friday     2010-02-05      215,797,326    6,303,488        12,344           225
Thursday   2010-02-04      180,032,514    6,401,667        12,372           226
Wednesday  2010-02-03      195,284,537    6,437,549        12,424           226
Tuesday    2010-02-02      224,752,416    6,481,744        12,478           225
Monday     2010-02-01      218,208,857    6,442,754        12,460           225
Sunday     2010-01-31      252,981,154    5,860,443        11,509           225
Saturday   2010-01-30      173,448,101    5,979,885        11,531           224
Friday     2010-01-29      210,415,317    6,370,528        12,240           224
Thursday   2010-01-28      187,947,791    6,432,046        12,312           225
Wednesday  2010-01-27      209,602,792    6,432,341        12,316           225
Tuesday    2010-01-26      170,424,512    6,360,726        12,294           225
Monday     2010-01-25      232,763,003    6,428,136        12,301           226
Sunday     2010-01-24      216,104,158    5,850,591        11,369           226
Saturday   2010-01-23      194,122,118    5,995,442        11,478           224
Friday     2010-01-22      107,163,848    5,649,227        12,112           224
Thursday   2010-01-21      202,242,310    6,457,756        12,318           225
Wednesday  2010-01-20      185,553,880    6,427,100        12,330           224
Tuesday    2010-01-19      139,240,612    6,106,586        12,237           224
Monday     2010-01-18      207,554,395    6,353,620        12,193           225
Sunday     2010-01-17      183,971,014    5,774,985        11,351           224
Saturday   2010-01-16      160,725,234    5,907,815        11,442           222
Friday     2010-01-15      120,299,420    6,112,745        12,103           225
Thursday   2010-01-14      143,893,472    6,216,641        12,238           225
Wednesday  2010-01-13      176,486,241    6,307,930        12,243           223
Tuesday    2010-01-12      156,073,856    6,307,301        12,226           225
Monday     2010-01-11      194,895,442    6,349,917        12,206           224
Sunday     2010-01-10      149,478,770    5,731,874        11,244           224
Saturday   2010-01-09      137,304,360    5,195,683        11,126           223

This chart shows the rate of IP's being seen over time.

90-Day

180-Day

Year

Conficker C

These tables are specifically for the C infections

Day        Date        Total HTTP Hits  Unique IP's  Unique ASN's  Unique GEO's
Sunday     2010-02-07        4,487,475      180,609         6,385           183
Saturday   2010-02-06        5,317,899      200,432         6,542           184
Friday     2010-02-05        6,672,786      241,916         7,179           188
Thursday   2010-02-04        7,834,908      251,654         7,307           190
Wednesday  2010-02-03        7,576,118      252,847         7,292           190
Tuesday    2010-02-02        7,777,638      255,320         7,338           188
Monday     2010-02-01        7,580,065      254,156         7,308           189
Sunday     2010-01-31        5,689,892      190,820         6,456           184
Saturday   2010-01-30        6,579,423      209,365         6,586           184
Friday     2010-01-29        8,709,350      255,019         7,226           189
Thursday   2010-01-28        9,115,563      262,003         7,365           190
Wednesday  2010-01-27        9,503,087      264,461         7,394           188
Tuesday    2010-01-26        9,040,892      263,040         7,401           191
Monday     2010-01-25        9,560,839      266,811         7,384           192
Sunday     2010-01-24        5,455,935      195,064         6,509           187
Saturday   2010-01-23        6,404,381      215,871         6,642           187
Friday     2010-01-22        9,083,240      264,497         7,332           192
Thursday   2010-01-21        9,093,034      270,908         7,426           191
Wednesday  2010-01-20        9,278,173      272,697         7,446           192
Tuesday    2010-01-19        9,427,316      275,175         7,420           190
Monday     2010-01-18        9,787,625      275,267         7,416           188
Sunday     2010-01-17        6,113,784      202,995         6,560           186
Saturday   2010-01-16        7,023,842      222,711         6,742           187
Friday     2010-01-15        7,656,289      267,452         7,337           194
Thursday   2010-01-14       10,190,356      275,366         7,409           191
Wednesday  2010-01-13       10,058,717      279,221         7,430           192
Tuesday    2010-01-12        9,712,084      282,194         7,460           192
Monday     2010-01-11       10,007,071      282,641         7,451           193
Sunday     2010-01-10        5,627,839      207,203         6,572           186
Saturday   2010-01-09        5,406,225      224,001         6,637           188

This chart shows the rate of IP's being seen over time. Because of the great difference between the daily totals and the hourly, we are using two Y-Axis values. The Y-Axis on the left is for the daily totals, while the one on the right s for both the hourly lines.

90-Day

180-Day

Year

Conficker A+B+C

This data set is the aggregate of all the conficker infections for today.

Day        Date        Total HTTP Hits  Unique IP's  Unique ASN's  Unique GEO's
Sunday     2010-02-07      194,016,314    5,888,451        11,871           224
Saturday   2010-02-06      208,268,832    6,086,334        12,033           224
Friday     2010-02-05      222,470,112    6,478,685        12,804           225
Thursday   2010-02-04      187,867,422    6,583,118        12,869           227
Wednesday  2010-02-03      202,860,655    6,619,983        12,897           226
Tuesday    2010-02-02      232,530,054    6,665,584        12,941           226
Monday     2010-02-01      225,788,922    6,626,014        12,941           225
Sunday     2010-01-31      258,671,046    6,010,018        11,990           225
Saturday   2010-01-30      180,027,524    6,139,780        12,025           224
Friday     2010-01-29      219,124,667    6,554,637        12,745           224
Thursday   2010-01-28      197,063,354    6,620,913        12,822           225
Wednesday  2010-01-27      219,105,879    6,622,034        12,826           225
Tuesday    2010-01-26      179,465,404    6,550,094        12,814           225
Monday     2010-01-25      242,323,842    6,619,711        12,823           226
Sunday     2010-01-24      221,560,093    6,002,433        11,881           226
Saturday   2010-01-23      200,526,499    6,159,950        11,991           224
Friday     2010-01-22      116,247,088    5,843,020        12,642           224
Thursday   2010-01-21      211,335,344    6,651,769        12,826           225
Wednesday  2010-01-20      197,698,102    6,626,952        12,843           224
Tuesday    2010-01-19      148,778,048    6,305,709        12,770           224
Monday     2010-01-18      217,342,020    6,550,972        12,715           225
Sunday     2010-01-17      190,084,798    5,933,311        11,878           224
Saturday   2010-01-16      167,749,076    6,077,089        11,968           223
Friday     2010-01-15      127,955,709    6,305,727        12,638           225
Thursday   2010-01-14      154,083,828    6,414,723        12,745           225
Wednesday  2010-01-13      186,544,958    6,508,478        12,762           224
Tuesday    2010-01-12      165,785,940    6,510,048        12,745           225
Monday     2010-01-11      204,902,513    6,552,360        12,738           224
Sunday     2010-01-10      155,106,609    5,893,535        11,749           224
Saturday   2010-01-09      147,410,734    5,437,814        11,660           224

90-Day

180-Day

Year

ASN Statistics

These charts represent how many ASN's are effected during the period of the graph.

90-Day

180-Day

Year

Country Statistics

These charts represent how many countries are effected during the period of the graph.

90-Day

180-Day

Year

HTTP Hit Statistics

These charts show how many daily hits from Conficker systems that we are seeing during the period of the graphs. While this is not really representative of an infection population, it does show the level of work that the Conficker Working Group must do daily in dealing with the level of events from Conficker.

90-Day

180-Day

Year