The term botnet refers to a group of compromised host computers (bots) that are controlled by a small number of commander hosts generally referred to as Command and Control (C&C) servers. Botnets have been widely used for sending large quantities of spam emails. By programming a large number of distributed bots, where each bot sends only a few emails, spammers can effectively transmit thousands of spam emails in a short duration. To date, detecting and blacklisting individual bots is difficult due to the transient nature of the attack and because each bot may send only a few spam emails. Furthermore, despite the increasing awareness of botnet infections and associated control processes, there is little understanding of the aggregated behavior of botnets from the perspective of email servers that have been targets of large scale botnet spamming attacks.