Posted on Tuesday, March 3rd, 2009 | Bookmark on del.icio.us

Has Conficker Growth Slowed?

by Jose Nazario

Or is it too early to tell?

I suspect that things like this are always best determined long after they’ve happened. The bottom of a recession or the top of the bubble, the end or even just the beginning. But we’ve seen Conficker numbers host steady at ~3 million unique IPs a day for the past week, so maybe it’s just topping out. Look at the graph below and, if you’re feeling daring, make a prediction: Conficker’s topped out, it’s going to keep on growing, or something else.

conficker_3wks.png

Data for the above graphic came from the sinkhole sharing data stream at the SIE.

We recently fixed some memory usage errors on our end and have been setting up alert feeds for ISPs of Conficker hosts using sinkhole data. Many thanks to the sinkhole managers and the Conficker Cabal for all of their help and their generous support of a community effort.

2 Responses | Add your own



Comment Post by: Il worm Conficker chiede istruzioni e ottiene un aggiornamento | Sir Arthur's Den — March 15th, 2009 @ 7:15 pm EST  Reply

[...] Conficker abbia raggiunto il suo picco e il numero di indirizzi IP unici infetti si sia fermato a circa 3 milioni al giorno. La botnet non cresce più, ma questo stato di cose non impedisce ai suoi burattinai di provare a [...]

Comment Post by: Conficker worm asks for instructions and gets an update | Sir Arthur's Den — March 15th, 2009 @ 7:16 pm EST  Reply

[...] proliferation have reached its peak and the number of unique infected IP addresses have halted at about 3 millions per day. The botnet does not grow anymore, but this state of things doesn’t prevent its puppeteers to [...]

Leave a Comment