Introduction
As security professionals we always are asked how large is the population of an infection. Conficker is no different from any other, and it seems that everyone wants to have some value to use for many different purposes. The press for impact, some vendors for FUD, and others to have a number to compare to other infections. The bottom line is that no one can give an exact number on any infection ever. If anyone ever states exact numbers, they either are controlling it, or are not being completely honest to themselves or others on the means of data collection. We can estimate a number based off of certain traffic types, but we make mistakes as often as anyone else. A lot of the malicious traffic can resemble other legitimate or malicious traffic which of course skews the numbers. On top of simple traffic analysis each threat provides its own unique mechanisms for tracking infection statistics. Each of these methods of course come with their own positives and negatives when discussing accuracy of the data. It is what that in mind that we wanted attempt to draw out some of the pro's and con's of our data collection methodology below.
So, it is with a lot of trepidation that we even show any values for conficker knowing that they will most likely be taken out of context and quoted by many.
Population Numbers
What the following tables show are the daily connections and unique IP's that have been connecting to our tracking systems. Many people equate one IP to one system, but that is not usually the case. If the system is behind a NAT gateway, it would represent dozens or hundreds of systems. If a system is mobile it could be reported several times in a single day under different IP's. And in today's world there are a very large number of mobile users which could inflate the number of connections and unique IP's that are tracked.
What does this really mean? The daily numbers should represent the potential maximum level of the infection, but in previous test cases usually prove to be much less than that maximum. So, take the range of 25% to 75% of the values that we display as the possible infection population and you will be close to the real value. And yes, this is a very large range, and you can see why we do not like to quote any numbers for infection populations, and why you will see very high and low numbers get quoted regularly depending on the purpose of the person making the quote.
One last note: we are publishing these numbers to give a better understanding of what we are tracking. We do not believe in shaming anyone related to these values, and is not our purpose in any way.
Data Details
These tables are updated daily from the tracking systems. They are updated only once a day.
Conficker A+B
These tables are specifically for the A+B infections.
Day Date Total HTTP Hits Unique IP's Unique ASN's Unique GEO's
Tuesday 2010-03-09 337,669,175 6,351,531 12,805 226
Monday 2010-03-08 338,155,668 6,284,835 12,478 225
Sunday 2010-03-07 329,896,387 5,729,835 11,775 224
Saturday 2010-03-06 331,981,299 5,995,791 11,894 223
Friday 2010-03-05 354,924,456 6,295,919 12,766 225
Thursday 2010-03-04 373,250,632 6,325,824 12,852 227
Wednesday 2010-03-03 359,794,785 6,313,380 12,813 227
Tuesday 2010-03-02 337,004,936 6,276,509 12,835 226
Monday 2010-03-01 318,658,525 6,166,997 12,800 226
Sunday 2010-02-28 287,961,218 5,645,784 11,833 223
Saturday 2010-02-27 318,692,637 5,930,726 12,065 222
Friday 2010-02-26 78,261,924 4,948,563 12,422 225
Thursday 2010-02-25 76,692,499 4,847,028 12,473 225
Wednesday 2010-02-24 54,544,056 4,766,191 12,469 224
Tuesday 2010-02-23 88,665,841 4,940,868 12,370 225
Monday 2010-02-22 87,870,843 4,883,675 12,329 226
Sunday 2010-02-21 130,762,051 4,999,295 11,726 227
Saturday 2010-02-20 184,069,445 5,141,864 11,836 226
Friday 2010-02-19 165,080,826 4,527,824 12,434 227
Thursday 2010-02-18 2,806,629 8,480 1,232 138
Wednesday 2010-02-17 150,842,074 4,766,975 12,111 226
Tuesday 2010-02-16 184,495,241 5,395,958 12,257 227
Monday 2010-02-15 234,176,809 5,310,922 12,156 225
Sunday 2010-02-14 183,186,698 4,925,235 11,351 224
Saturday 2010-02-13 224,702,821 5,248,969 11,522 223
Friday 2010-02-12 188,748,236 5,765,755 12,256 224
Thursday 2010-02-11 163,057,271 5,997,704 12,324 225
Wednesday 2010-02-10 183,775,873 6,241,341 12,361 226
Tuesday 2010-02-09 159,190,362 6,277,202 12,299 226
Monday 2010-02-08 197,785,792 6,315,079 12,297 225
This chart shows the rate of IP's being seen over time.
90-Day
180-Day
Year
Conficker C
These tables are specifically for the C infections
Day Date Total HTTP Hits Unique IP's Unique ASN's Unique GEO's
Tuesday 2010-03-09 3,305,586 212,497 7,005 187
Monday 2010-03-08 3,376,954 206,531 6,687 184
Sunday 2010-03-07 2,099,921 152,058 6,085 184
Saturday 2010-03-06 3,077,590 174,543 6,280 183
Friday 2010-03-05 6,208,194 223,699 7,007 186
Thursday 2010-03-04 6,302,375 228,208 7,074 185
Wednesday 2010-03-03 6,430,694 229,544 7,101 185
Tuesday 2010-03-02 6,286,371 231,365 7,126 185
Monday 2010-03-01 6,994,897 226,586 7,083 187
Sunday 2010-02-28 4,552,812 168,230 6,273 186
Saturday 2010-02-27 5,081,936 189,037 6,576 186
Friday 2010-02-26 6,781,396 223,848 7,003 187
Thursday 2010-02-25 7,198,867 234,713 7,139 186
Wednesday 2010-02-24 7,281,288 236,547 7,191 185
Tuesday 2010-02-23 7,202,635 233,909 6,995 189
Monday 2010-02-22 7,064,192 232,607 6,994 188
Sunday 2010-02-21 4,805,156 175,667 6,281 187
Saturday 2010-02-20 5,126,878 185,913 6,419 187
Friday 2010-02-19 6,342,144 213,607 7,064 185
Thursday 2010-02-18 6,765,791 216,180 7,160 190
Wednesday 2010-02-17 6,494,725 213,056 7,123 188
Tuesday 2010-02-16 5,961,919 201,678 7,109 188
Monday 2010-02-15 5,532,269 197,637 6,966 187
Sunday 2010-02-14 4,104,768 157,166 6,222 183
Saturday 2010-02-13 4,608,158 173,722 6,384 183
Friday 2010-02-12 6,075,425 218,018 7,072 190
Thursday 2010-02-11 6,962,261 233,233 7,221 190
Wednesday 2010-02-10 7,188,124 241,042 7,238 188
Tuesday 2010-02-09 7,395,736 243,683 7,305 186
Monday 2010-02-08 7,431,433 245,763 7,285 187
This chart shows the rate of IP's being seen over time. Because of the great difference between the daily totals and the hourly, we are using two Y-Axis values. The Y-Axis on the left is for the daily totals, while the one on the right s for both the hourly lines.
90-Day
180-Day
Year
Conficker A+B+C
This data set is the aggregate of all the conficker infections for today.
Day Date Total HTTP Hits Unique IP's Unique ASN's Unique GEO's
Tuesday 2010-03-09 340,974,761 6,499,203 13,154 226
Monday 2010-03-08 341,532,622 6,429,168 12,824 225
Sunday 2010-03-07 335,652,430 5,853,866 12,140 224
Saturday 2010-03-06 335,058,889 6,125,861 12,253 223
Friday 2010-03-05 361,132,650 6,452,710 13,118 225
Thursday 2010-03-04 379,552,985 6,484,564 13,209 227
Wednesday 2010-03-03 366,225,455 6,472,999 13,159 227
Tuesday 2010-03-02 343,291,296 6,437,363 13,204 226
Monday 2010-03-01 325,653,418 6,325,590 13,166 226
Sunday 2010-02-28 301,175,569 5,808,604 12,214 223
Saturday 2010-02-27 323,774,560 6,071,426 12,408 222
Friday 2010-02-26 107,564,394 5,189,542 12,815 225
Thursday 2010-02-25 104,484,532 5,105,390 12,886 225
Wednesday 2010-02-24 79,159,361 5,033,306 12,874 224
Tuesday 2010-02-23 106,652,146 5,134,800 12,762 225
Monday 2010-02-22 113,973,307 5,109,910 12,735 226
Sunday 2010-02-21 146,637,781 5,150,089 12,104 227
Saturday 2010-02-20 199,288,206 5,297,709 12,202 226
Friday 2010-02-19 171,422,970 4,689,146 12,804 227
Thursday 2010-02-18 9,572,420 223,638 7,257 194
Wednesday 2010-02-17 157,336,799 4,929,434 12,602 226
Tuesday 2010-02-16 190,457,160 5,548,791 12,743 227
Monday 2010-02-15 239,709,078 5,460,567 12,622 225
Sunday 2010-02-14 187,291,466 5,050,898 11,820 224
Saturday 2010-02-13 229,310,979 5,385,218 11,983 223
Friday 2010-02-12 194,823,661 5,928,408 12,722 224
Thursday 2010-02-11 170,019,532 6,169,337 12,794 225
Wednesday 2010-02-10 190,963,997 6,417,220 12,830 226
Tuesday 2010-02-09 166,586,098 6,454,011 12,784 226
Monday 2010-02-08 205,217,225 6,493,032 12,786 225
90-Day
180-Day
Year
ASN Statistics
These charts represent how many ASN's are effected during the period of the graph.
90-Day
180-Day
Year
Country Statistics
These charts represent how many countries are effected during the period of the graph.
90-Day
180-Day
Year
HTTP Hit Statistics
These charts show how many daily hits from Conficker systems that we are seeing during the period of the graphs. While this is not really representative of an infection population, it does show the level of work that the Conficker Working Group must do daily in dealing with the level of events from Conficker.
90-Day
180-Day
Year
