Know your Enemy:
Tracking Botnets - Spreading

In order to spread and compromise other hosts, Agobot & friends typically use known exploits. Since the vast majority of systems on the Internet run Windows, it is needless to say that bots typically target Windows machines, specifically the well-known ports 445/TCP and 135/TCP. As we have demonstrated, a large percentage of the background noise on the Internet is actually caused by bots spreading. The following table presents the scanning ranges we observed. The table depicts the activity we observed during the last few months. Note: A bot typically tries to spread on all interfaces and thus the table also contains some data for private internet address space (e.g. 10.* or 192.168.*) as defined in RFC 1918. This is caused by bots who try to spread within private networks and infect computers there.