We successfully found hundreds of botnets by examin- ing a subset of the spam email messages received by Hot- mail Web mail service. The sizes of the botnets we found range from tens of hosts to more than ten thousand hosts. Our measurement results will be useful in several ways. First, knowing the size and membership gives us a bet- ter understanding on the threat posed by botnets. Second, the membership and geographic locations are useful infor- mation for deployment of countermeasurement infrastruc- tures, such as rewall placement, traf c ltering policies, etc. Third, characterizing botnets behavior in monetiz- ing activities may help in ghting against botnets in these businesses, perhaps reduce their.
