Time-lapse of botnet's spread around the world

Marvel at the spread of a botnet around the world in this 44-second time-lapse covering five days' infection activity, as measured by observing new joins to a botmaster's IRC channel. It's really fascinating how geographical our Internet activity really is -- how a bot's jump to another region (seemingly) precipitates more local infections as (presumably) local users communicate with nearby systems.

Flashy Botnet is Flashy (via O'Reilly Radar)

[#1 posted by Chris Tucker , January 7, 2009 10:58 PM]

Botnets, spammer's botnets.
What kind of boxes are on on botnets?

Compaq, HP, Dell and Sony, true!
Gateway, packard Bell, maybe even Asus, too.

Are boxes, found on botnets.
All running Windows. FOO!

[#2 posted by drew3ooo , January 8, 2009 2:10 AM]

I'm more interested in the vast dark areas of the map. Botnet also shows how unequal wealth/technology distribution remains.

[#3 posted by drew3ooo , January 8, 2009 2:12 AM]

I'm more interested in the vast dark areas of the map. Botnet also shows how unequal wealth/technology distribution remains.

[#4 posted by Agent 86 , January 8, 2009 2:29 AM]

Botnet... the New Red Scare!

Also, another virus map
http://www.youtube.com/watch?v=Y59donv179g

[#5 posted by holtt , January 8, 2009 6:47 AM]

Bravo Chris :^)

[#6 posted by RedShirt77 , January 8, 2009 6:54 AM]

Why don't they start with no red and then go until their is lots of red? It just looks like a lot of pulsating pink dots to me.

[#7 posted by gATO , January 8, 2009 6:55 AM]

Drew3000: You're right, but to be fair, some of those dark areas mostly unpopulated (which makes the botnet spread even more alarming).

[#8 posted by nanuq , January 8, 2009 6:59 AM]

The Great Firewall of China doesn't seem to be providing much protection. I guess this botnet isn't subversive enough.

[#9 posted by SamSam , January 8, 2009 7:02 AM]

I'm with #6, but maybe I don't understand the map. Are there any new lights at the end that weren't there on the first day, at 15:00? At seems that the entire spread happened in the first couple hours -- the rest is just unexplained pulsing.

[#10 posted by Anonymous , January 8, 2009 10:55 AM]

Bad informational graphics always leave you wondering what you just saw. Compare Florence Nightingale's 1858 "coxcomb" graphs, or Minard's 1869 graphic presentation of Napoleon's march on Moscow, if you want to see how bad most modern graphics really are. Computers just make composition easier and faster, not better.

Chris, the most powerful botnets have multiple node types; the controller nodes are often linux and the sheep being herded are windows.

When you can't figure out where or what the controllers are, or how they are publishing their commands, you can be pretty sure they are linux.

[#11 posted by Agent 86 , January 8, 2009 11:00 AM]

I could be wrong, but I think the red is the initial infection by the botnet, and the pulsing white is actual participation in / use by the botnet.

[#12 posted by Chris Tucker , January 8, 2009 4:38 PM]

@#10

Humor. Let me attempt to explain it to you.