Spamming Botnets: Are we losing the war? ∗

In this work, we examine the spamming activity of the IP space over time, and observe a worrisome phenomenon: spam- ming botnets are more widely and thinly spread in the IP space over the last four years. We find that (a), a previously- unreported IP space (113.* - 126.*) has become a major source of spamming activity, and (b), the spamming activ- ity is more equally distributed among IP addresses. This spreading has grave significance and implications: (1) IP- based filtering for bots and spam will become less effective and more challenging, and (2) system administrators need to improve their mitigation techniques in order to win the war against botmasters.