Suspected Bot List [2013-11-29]

detection period: 2013-11-29 00:00-23:59 UTC
number of suspected bots' IPs listed here: 87

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AO	196.223.13.230	Angola
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BO	190.129.12.162	Bolivia
DO	190.94.63.166	Dominican Republic
ES	83.34.21.83	Spain
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
GQ	41.222.115.225	Equatorial Guinea
HN	190.107.140.76	Honduras
IN	117.240.239.120	India
IN	122.160.239.39	India
IN	202.63.105.226	India
IR	91.98.117.30	Iran
IT	217.133.6.218	Italy
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PH	124.107.158.30	Philippines
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
US	50.201.42.106	United States

List from greylisting:

Botnet Statistics [2013-11-29]

detection period: 2013-11-29 00:00-23:59 UTC
total number of suspected botnet IPs: 906
number of botnet IPs notified to network operators: 819
number of spam blocked: 124684
recipient count of spam blocked: 4247405

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	108
2	CHINANET-GD	70
3	UNICOM-GD	69
4	CRTC	56
5	CTTNET	51
6	UNICOM-LN	24
7	CHINANET-ZJ-NB	22
8	SHARKTECH	18
9	CHINANET-FJ	15
10	CHINANET-SH	13

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	437
2	Taiwan	115
3	United States	54
4	Brazil	26
5	France	20
6	Russian Federation	17
7	India	17
8	Hong Kong	14
9	Italy	11
10	United Kingdom	11

Suspected Bot List [2013-11-28]

detection period: 2013-11-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 116

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BO	190.129.12.162	Bolivia
DO	190.94.63.166	Dominican Republic
ES	83.34.21.83	Spain
ES	88.12.35.87	Spain
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
HN	190.107.140.76	Honduras
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	122.160.239.39	India
IN	202.63.105.226	India
IR	91.98.117.30	Iran
IT	217.133.6.218	Italy
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PH	124.107.158.30	Philippines
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
US	50.201.42.106	United States

List from greylisting:

Botnet Statistics [2013-11-28]

detection period: 2013-11-28 00:00-23:59 UTC
total number of suspected botnet IPs: 937
number of botnet IPs notified to network operators: 821
number of spam blocked: 125944
recipient count of spam blocked: 4272314

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CRTC	84
2	HINET-NET	79
3	CHINANET-GD	74
4	CTTNET	27
5	UNICOM-LN	24
6	UNICOM-GD	19
7	IP2000-ADSL-BAS	18
8	CHINANET-FJ	14
9	UNICOM-HE	12
10	VNPT-VNNIC-VN	11

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	358
2	Taiwan	91
3	United States	49
4	France	42
5	India	30
6	Hong Kong	29
7	Brazil	28
8	Russian Federation	21
9	Philippines	17
10	Iran	16

Suspected Bot List [2013-11-27]

detection period: 2013-11-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 107

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.185.200.12	Argentina
BO	190.129.12.162	Bolivia
DO	190.94.63.166	Dominican Republic
ES	83.34.21.83	Spain
ES	88.12.35.87	Spain
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
GQ	41.222.115.225	Equatorial Guinea
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	122.160.239.39	India
IN	202.63.105.226	India
IR	91.98.117.30	Iran
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PH	124.107.158.30	Philippines
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	93.184.71.66	Slovakia
US	50.201.42.106	United States

List from greylisting:

Botnet Statistics [2013-11-27]

detection period: 2013-11-27 00:00-23:59 UTC
total number of suspected botnet IPs: 1040
number of botnet IPs notified to network operators: 933
number of spam blocked: 145617
recipient count of spam blocked: 4555695

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-GD	183
2	CHINANET-GD	82
3	HINET-NET	70
4	CRTC	68
5	CTTNET	30
6	ZTWL	27
7	UNICOM-LN	24
8	SHARKTECH	18
9	CHINANET-JS	12
10	CHINANET-FJ	12

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	540
2	United States	80
3	Taiwan	75
4	Brazil	26
5	France	24
6	Russian Federation	17
7	Iran	15
8	India	14
9	Hong Kong	13
10	United Kingdom	13

Suspected Bot List [2013-11-26]

detection period: 2013-11-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 202

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BO	190.129.12.162	Bolivia
CA	70.38.64.167	Canada
DO	190.94.63.166	Dominican Republic
ES	83.34.21.83	Spain
ES	88.12.35.87	Spain
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
GQ	41.222.115.225	Equatorial Guinea
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	122.160.239.39	India
IN	202.63.105.226	India
IR	91.98.117.30	Iran
IT	217.133.6.218	Italy
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PH	124.107.158.30	Philippines
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	93.184.71.66	Slovakia
US	50.201.42.106	United States

List from greylisting:

Botnet Statistics [2013-11-26]

detection period: 2013-11-26 00:00-23:59 UTC
total number of suspected botnet IPs: 1664
number of botnet IPs notified to network operators: 1462
number of spam blocked: 181096
recipient count of spam blocked: 5196395

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-GD	131
2	HINET-NET	104
3	CRTC	82
4	CHINANET-GD	76
5	CTTNET	43
6	IP2000-ADSL-BAS	41
7	SHARKTECH	32
8	UNICOM-LN	28
9	SINGNET-SG	18
10	NETVIGATOR	17

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	507
2	United States	187
3	Taiwan	118
4	France	113
5	India	52
6	Hong Kong	50
7	Japan	48
8	Australia	40
9	Russian Federation	34
10	South Korea	30

Suspected Bot List [2013-11-25]

detection period: 2013-11-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 128

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BO	190.129.12.162	Bolivia
CA	70.38.64.167	Canada
DO	190.94.63.166	Dominican Republic
ES	83.34.21.83	Spain
ES	88.12.35.87	Spain
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
HN	190.107.140.76	Honduras
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	122.160.239.39	India
IN	202.63.105.226	India
IT	195.45.129.94	Italy
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PH	124.107.158.30	Philippines
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	93.184.71.66	Slovakia
US	50.201.42.106	United States

List from greylisting:

Botnet Statistics [2013-11-25]

detection period: 2013-11-25 00:00-23:59 UTC
total number of suspected botnet IPs: 1262
number of botnet IPs notified to network operators: 1135
number of spam blocked: 153808
recipient count of spam blocked: 5075777

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-GD	180
2	CHINANET-ZJ-NB	113
3	HINET-NET	72
4	CHINANET-GD	69
5	CRTC	49
6	UNICOM-LN	28
7	CMNET	22
8	ZTWL	21
9	SHARKTECH	18
10	IP2000-ADSL-BAS	17

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	670
2	United States	81
3	Taiwan	78
4	France	39
5	Japan	27
6	Brazil	26
7	United Kingdom	22
8	Australia	18
9	South Korea	17
10	India	17

Suspected Bot List [2013-11-24]

detection period: 2013-11-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 178

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.185.200.12	Argentina
BO	190.129.12.162	Bolivia
DO	190.94.63.166	Dominican Republic
ES	83.34.21.83	Spain
ES	88.12.35.87	Spain
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
HN	190.107.140.76	Honduras
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	202.63.105.226	India
IT	195.45.129.94	Italy
KZ	109.229.189.175	Kazakhstan
MO	60.246.65.180	Macau
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
TW	61.64.4.180	Taiwan
US	50.201.42.106	United States
US	174.139.57.234	United States

List from greylisting:

Botnet Statistics [2013-11-24]

detection period: 2013-11-24 00:00-23:59 UTC
total number of suspected botnet IPs: 1082
number of botnet IPs notified to network operators: 904
number of spam blocked: 143293
recipient count of spam blocked: 4829881

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-ZJ-NB	103
2	CHINANET-GD	78
3	HINET-NET	72
4	UNICOM-GD	59
5	CMNET	37
6	UNICOM-LN	26
7	CHINANET-JS	19
8	CTTNET	17
9	CRTC	14
10	ZTWL	12

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	523
2	Taiwan	79
3	United States	51
4	Spain	38
5	Brazil	30
6	Argentina	27
7	Colombia	26
8	Peru	20
9	Iran	20
10	India	19

Suspected Bot List [2013-11-23]

detection period: 2013-11-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 161

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.185.200.12	Argentina
BO	190.129.12.162	Bolivia
DO	190.94.63.166	Dominican Republic
ES	83.34.21.83	Spain
ES	88.12.35.87	Spain
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
HN	190.107.140.76	Honduras
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	202.63.105.226	India
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
TW	119.77.164.120	Taiwan
TW	211.76.82.122	Taiwan
US	50.201.42.106	United States
US	174.139.57.234	United States

List from greylisting:

Botnet Statistics [2013-11-23]

detection period: 2013-11-23 00:00-23:59 UTC
total number of suspected botnet IPs: 1119
number of botnet IPs notified to network operators: 958
number of spam blocked: 198319
recipient count of spam blocked: 6744645

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-GD	169
2	CHINANET-ZJ-NB	75
3	CHINANET-GD	73
4	HINET-NET	65
5	UNICOM-LN	29
6	CMNET	24
7	CRTC	22
8	ZTWL	17
9	UNICOM-HE	16
10	UNICOM-SD	13

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	608
2	Taiwan	73
3	United States	47
4	Brazil	30
5	Spain	27
6	Colombia	22
7	Peru	20
8	Argentina	20
9	United Kingdom	18
10	Russian Federation	17

Suspected Bot List [2013-11-22]

detection period: 2013-11-22 00:00-23:59 UTC
number of suspected bots' IPs listed here: 62

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BO	190.129.12.162	Bolivia
CN	150.255.141.98	China
DO	190.94.63.166	Dominican Republic
ES	80.33.132.173	Spain
ES	83.34.21.83	Spain
ES	88.12.35.87	Spain
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
HN	190.107.140.76	Honduras
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	202.63.105.226	India
IT	195.45.129.94	Italy
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
SK	93.184.71.66	Slovakia
US	50.201.42.106	United States

List from greylisting:

Botnet Statistics [2013-11-22]

detection period: 2013-11-22 00:00-23:59 UTC
total number of suspected botnet IPs: 1140
number of botnet IPs notified to network operators: 1078
number of spam blocked: 238147
recipient count of spam blocked: 8260122

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-GD	172
2	CHINANET-ZJ-NB	95
3	CHINANET-GD	85
4	HINET-NET	70
5	CRTC	39
6	CMNET	29
7	UNICOM-LN	28
8	CTTNET	28
9	CHINANET-ZJ	17
10	ZTWL	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	738
2	Taiwan	76
3	United States	73
4	Brazil	26
5	Russian Federation	17
6	South Korea	15
7	India	15
8	United Kingdom	11
9	Indonesia	9
10	Germany	9

Suspected Bot List [2013-11-21]

detection period: 2013-11-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 100

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AO	196.223.13.230	Angola
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BO	190.129.12.162	Bolivia
DO	190.94.63.166	Dominican Republic
ES	80.33.132.173	Spain
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	202.63.105.226	India
IT	95.253.67.148	Italy
IT	195.45.129.94	Italy
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
SK	93.184.71.66	Slovakia
US	50.201.42.106	United States
US	74.222.3.249	United States

List from greylisting:

Botnet Statistics [2013-11-21]

detection period: 2013-11-21 00:00-23:59 UTC
total number of suspected botnet IPs: 1918
number of botnet IPs notified to network operators: 1819
number of spam blocked: 155020
recipient count of spam blocked: 5285723

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	678
2	CHINANET-GD	105
3	UNICOM-GD	104
4	CHINANET-ZJ-NB	79
5	CRTC	52
6	CTTNET	41
7	CMNET	35
8	UNICOM-LN	31
9	CHINANET-JS	26
10	CHINANET-SH	17

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	690
2	Taiwan	687
3	United States	103
4	Australia	45
5	South Korea	32
6	Hong Kong	32
7	Brazil	27
8	Japan	21
9	Russian Federation	20
10	United Kingdom	18

Suspected Bot List [2013-11-20]

detection period: 2013-11-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 64

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AO	196.223.13.230	Angola
BO	190.129.12.162	Bolivia
DO	190.94.63.166	Dominican Republic
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
IN	117.240.239.120	India
IN	202.63.105.226	India
IT	95.253.67.148	Italy
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
SK	93.184.71.66	Slovakia
US	50.201.42.106	United States
US	74.222.3.249	United States

List from greylisting:

Botnet Statistics [2013-11-20]

detection period: 2013-11-20 00:00-23:59 UTC
total number of suspected botnet IPs: 2137
number of botnet IPs notified to network operators: 2074
number of spam blocked: 101410
recipient count of spam blocked: 3302999

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	918
2	UNICOM-GD	147
3	CHINANET-ZJ-NB	102
4	CHINANET-GD	76
5	CMNET	39
6	CRTC	26
7	UNICOM-LN	24
8	CHINANET-JS	24
9	CHINANET-FJ	18
10	CTTNET	17

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	927
2	China	686
3	United States	106
4	Australia	35
5	Brazil	28
6	United Kingdom	27
7	Hong Kong	25
8	South Korea	24
9	Russian Federation	18
10	Japan	17

Suspected Bot List [2013-11-19]

detection period: 2013-11-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 167

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AO	196.223.13.230	Angola
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
BO	190.129.12.162	Bolivia
DO	190.94.63.166	Dominican Republic
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
HN	190.107.140.76	Honduras
IN	112.133.201.70	India
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	202.63.105.226	India
IR	91.98.117.30	Iran
IT	95.253.67.148	Italy
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PH	124.107.158.30	Philippines
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
US	50.201.42.106	United States
US	74.222.3.249	United States

List from greylisting:

Botnet Statistics [2013-11-19]

detection period: 2013-11-19 00:00-23:59 UTC
total number of suspected botnet IPs: 2420
number of botnet IPs notified to network operators: 2253
number of spam blocked: 82999
recipient count of spam blocked: 2846685

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	737
2	UNICOM-GD	165
3	CHINANET-GD	83
4	CMNET	45
5	SINGNET-SG	34
6	UNICOM-LN	27
7	CHINANET-ZJ-NB	21
8	CHINANET-FJ	20
9	ZTWL	19
10	CHINANET-SH	18

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	753
2	China	627
3	United States	221
4	Australia	89
5	India	51
6	Hong Kong	45
7	Japan	44
8	United Kingdom	44
9	Singapore	41
10	South Korea	38

Suspected Bot List [2013-11-18]

detection period: 2013-11-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 72

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BO	190.129.12.162	Bolivia
DO	190.94.63.166	Dominican Republic
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
HN	190.107.140.76	Honduras
IN	112.133.201.70	India
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	202.63.105.226	India
IR	91.98.117.30	Iran
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
NL	94.102.63.245	Netherlands
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PH	124.107.158.30	Philippines
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
US	50.201.42.106	United States
US	74.222.3.249	United States

List from greylisting:

Botnet Statistics [2013-11-18]

detection period: 2013-11-18 00:00-23:59 UTC
total number of suspected botnet IPs: 1871
number of botnet IPs notified to network operators: 1799
number of spam blocked: 82364
recipient count of spam blocked: 2751040

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	832
2	UNICOM-GD	189
3	CHINANET-GD	73
4	CMNET	31
5	UNICOM-LN	30
6	CHINANET-ZJ-NB	25
7	ZTWL	21
8	UNICOM-HE	19
9	CHINANET-JS	17
10	CHINANET-GX	15

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	840
2	China	634
3	United States	83
4	Brazil	25
5	United Kingdom	18
6	Russian Federation	17
7	India	14
8	Israel	13
9	Japan	11
10	Italy	11

Suspected Bot List [2013-11-17]

detection period: 2013-11-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 33

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BO	190.129.12.162	Bolivia
CA	70.38.64.167	Canada
DO	190.94.63.166	Dominican Republic
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
IN	112.133.201.70	India
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	122.160.239.39	India
IN	202.63.105.226	India
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
NL	94.102.63.245	Netherlands
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
SK	93.184.71.66	Slovakia
US	50.201.42.106	United States
US	74.222.3.249	United States

List from greylisting:

Botnet Statistics [2013-11-17]

detection period: 2013-11-17 00:00-23:59 UTC
total number of suspected botnet IPs: 1618
number of botnet IPs notified to network operators: 1585
number of spam blocked: 92491
recipient count of spam blocked: 3042856

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	831
2	UNICOM-GD	170
3	CHINANET-GD	78
4	CMNET	30
5	UNICOM-LN	26
6	CHINANET-ZJ-NB	22
7	ZTWL	20
8	UNICOM-HE	16
9	CTTNET	15
10	CHINANET-JS	15

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	837
2	China	570
3	United States	36
4	Brazil	25
5	Russian Federation	15
6	Iran	9
7	South Korea	8
8	United Kingdom	8
9	India	7
10	Israel	7

Suspected Bot List [2013-11-16]

detection period: 2013-11-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 134

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BO	190.129.12.162	Bolivia
CA	70.38.64.167	Canada
DO	190.94.63.166	Dominican Republic
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
IN	112.133.201.70	India
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	122.160.239.39	India
IN	202.63.105.226	India
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
NL	94.102.63.245	Netherlands
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	93.184.71.66	Slovakia
TW	119.77.200.235	Taiwan
US	50.201.42.106	United States

List from greylisting:

Botnet Statistics [2013-11-16]

detection period: 2013-11-16 00:00-23:59 UTC
total number of suspected botnet IPs: 2216
number of botnet IPs notified to network operators: 2082
number of spam blocked: 97804
recipient count of spam blocked: 3075237

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	905
2	UNICOM-GD	180
3	CHINANET-GD	78
4	CHINANET-ZJ-NB	54
5	CMNET	29
6	CTTNET	27
7	UNICOM-LN	26
8	ZTWL	22
9	CRTC	19
10	SHARKTECH	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	928
2	China	619
3	United States	104
4	India	57
5	Kazakhstan	35
6	Russian Federation	29
7	Brazil	26
8	Turkey	25
9	United Kingdom	21
10	Poland	20

Suspected Bot List [2013-11-15]

detection period: 2013-11-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 103

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BG	93.183.155.80	Bulgaria
BO	190.129.12.162	Bolivia
CA	70.38.64.167	Canada
DO	190.94.63.166	Dominican Republic
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
HN	190.107.140.76	Honduras
IN	117.240.239.120	India
IN	122.160.239.39	India
IN	202.63.105.226	India
IR	91.98.117.30	Iran
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
NL	94.102.63.245	Netherlands
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
US	50.201.42.106	United States

List from greylisting:

Botnet Statistics [2013-11-15]

detection period: 2013-11-15 00:00-23:59 UTC
total number of suspected botnet IPs: 2161
number of botnet IPs notified to network operators: 2058
number of spam blocked: 92377
recipient count of spam blocked: 2913686

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	891
2	UNICOM-GD	134
3	CHINANET-GD	92
4	CTTNET	70
5	CRTC	55
6	CHINANET-ZJ-NB	53
7	SHARKTECH	37
8	UNICOM-LN	31
9	CMNET	23
10	CHINANET-FJ	20

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	901
2	China	710
3	United States	155
4	Brazil	29
5	Australia	29
6	United Kingdom	28
7	Russian Federation	19
8	South Korea	18
9	Hong Kong	14
10	Iran	13

Suspected Bot List [2013-11-14]

detection period: 2013-11-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 168

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BG	93.183.155.80	Bulgaria
BO	190.129.12.162	Bolivia
CA	70.38.64.167	Canada
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
HN	190.107.140.76	Honduras
IN	117.240.239.120	India
IN	202.63.105.226	India
IR	91.98.117.30	Iran
KZ	109.229.189.175	Kazakhstan
MX	189.204.49.66	Mexico
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PH	124.107.158.30	Philippines
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
US	50.201.42.106	United States
US	74.222.3.249	United States

List from greylisting:

Botnet Statistics [2013-11-14]

detection period: 2013-11-14 00:00-23:59 UTC
total number of suspected botnet IPs: 2454
number of botnet IPs notified to network operators: 2286
number of spam blocked: 107862
recipient count of spam blocked: 3390560

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	904
2	UNICOM-GD	183
3	CHINANET-GD	87
4	CRTC	81
5	CMNET	61
6	CTTNET	44
7	ZTWL	25
8	UNICOM-LN	24
9	CHINANET-FJ	21
10	CHINANET-SH	17

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	919
2	China	746
3	United States	185
4	Australia	47
5	Hong Kong	32
6	Japan	31
7	Brazil	31
8	United Kingdom	30
9	Mexico	26
10	Russian Federation	24

Suspected Bot List [2013-11-13]

detection period: 2013-11-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 152

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BG	93.183.155.80	Bulgaria
BO	190.129.12.162	Bolivia
CA	70.38.64.167	Canada
CN	202.100.111.147	China
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
HN	190.107.140.76	Honduras
IN	117.240.239.120	India
IN	202.63.105.226	India
IR	91.98.117.30	Iran
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PH	124.107.158.30	Philippines
PK	115.186.59.70	Pakistan
RU	109.167.143.14	Russian Federation
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
US	50.201.42.106	United States
US	74.222.3.249	United States

List from greylisting:

Botnet Statistics [2013-11-13]

detection period: 2013-11-13 00:00-23:59 UTC
total number of suspected botnet IPs: 2280
number of botnet IPs notified to network operators: 2128
number of spam blocked: 96493
recipient count of spam blocked: 3193851

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	774
2	UNICOM-GD	164
3	CHINANET-GD	78
4	CMNET	46
5	UNICOM-LN	30
6	CTTNET	25
7	CHINANET-JS	21
8	UNICOM-HE	18
9	ZTWL	16
10	CHINANET-FJ	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	787
2	China	625
3	United States	286
4	United Kingdom	52
5	Brazil	35
6	Canada	28
7	India	25
8	Australia	25
9	Russian Federation	19
10	Mexico	19

Suspected Bot List [2013-11-12]

detection period: 2013-11-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 213

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BG	93.183.155.80	Bulgaria
CA	70.38.64.167	Canada
ES	80.33.132.173	Spain
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
IN	117.240.239.120	India
IN	202.63.105.226	India
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PH	124.107.158.30	Philippines
PK	115.186.59.70	Pakistan
RU	109.167.143.14	Russian Federation
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
SK	93.184.71.66	Slovakia
US	50.201.42.106	United States
US	74.222.3.249	United States

List from greylisting:

Botnet Statistics [2013-11-12]

detection period: 2013-11-12 00:00-23:59 UTC
total number of suspected botnet IPs: 2874
number of botnet IPs notified to network operators: 2661
number of spam blocked: 91671
recipient count of spam blocked: 3202114

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	852
2	UNICOM-GD	115
3	CHINANET-GD	105
4	CTTNET	72
5	CRTC	69
6	CMNET	59
7	SINGNET-SG	33
8	UNICOM-LN	30
9	UNICOM-HE	27
10	CHINANET-JS	23

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	880
2	China	801
3	United States	282
4	United Kingdom	71
5	India	69
6	Hong Kong	57
7	Singapore	41
8	Russian Federation	37
9	Japan	35
10	Italy	32

Suspected Bots' IP List for November 2013

To encourage cyber security information sharing (as some form of open data) while still giving victims enough time to clean up their computers, the IP list of suspected infected computers will be released here (as shown below) 10 days after its respective botnet statistics gets published.

You are free to use them to create more effective defenses, discover latest trends in cyber attacks, etc.

Suspected Bots IP [2013-11-01]
Suspected Bots IP [2013-11-02]
Suspected Bots IP [2013-11-03]
Suspected Bots IP [2013-11-04]
Suspected Bots IP [2013-11-05]
Suspected Bots IP [2013-11-06]
Suspected Bots IP [2013-11-07]
Suspected Bots IP [2013-11-08]
Suspected Bots IP [2013-11-09]
Suspected Bots IP [2013-11-10]
Suspected Bots IP [2013-11-11]
Suspected Bots IP [2013-11-12]
Suspected Bots IP [2013-11-13]
Suspected Bots IP [2013-11-14]
Suspected Bots IP [2013-11-15]
Suspected Bots IP [2013-11-16]
Suspected Bots IP [2013-11-17]
Suspected Bots IP [2013-11-18]
Suspected Bots IP [2013-11-19]
Suspected Bots IP [2013-11-20]
Suspected Bots IP [2013-11-21]
Suspected Bots IP [2013-11-22]
Suspected Bots IP [2013-11-23]
Suspected Bots IP [2013-11-24]
Suspected Bots IP [2013-11-25]
Suspected Bots IP [2013-11-26]
Suspected Bots IP [2013-11-27]
Suspected Bots IP [2013-11-28]
Suspected Bots IP [2013-11-29]
Suspected Bots IP [2013-11-30]

Suspected Bot List [2013-11-11]

detection period: 2013-11-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 543

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.3.14.59	Argentina
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
BG	93.183.155.80	Bulgaria
CA	70.38.64.167	Canada
CN	150.255.38.25	China
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
IN	117.240.239.120	India
IN	202.63.105.226	India
KZ	109.229.189.175	Kazakhstan
MO	60.246.187.141	Macau
MX	187.174.173.18	Mexico
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PK	115.186.59.70	Pakistan
RU	109.167.143.14	Russian Federation
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
SK	93.184.71.66	Slovakia
TW	119.77.148.68	Taiwan
TW	119.77.200.235	Taiwan
US	50.201.42.106	United States
US	74.222.3.249	United States

List from greylisting:

Botnet Statistics [2013-11-11]

detection period: 2013-11-11 00:00-23:59 UTC
total number of suspected botnet IPs: 4078
number of botnet IPs notified to network operators: 3535
number of spam blocked: 102095
recipient count of spam blocked: 3324956

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	858
2	CMNET	419
3	CRTC	317
4	UNICOM-GD	155
5	CTTNET	134
6	CHINANET-GD	95
7	UNICOM-SD	83
8	RIMA	73
9	UNICOM-HE	67
10	UNICOM-LN	60

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	2144
2	Taiwan	878
3	Spain	196
4	Brazil	192
5	Italy	126
6	United States	83
7	Argentina	43
8	India	28
9	Turkey	26
10	Russian Federation	25

Suspected Bot List [2013-11-10]

detection period: 2013-11-10 00:00-23:59 UTC
number of suspected bots' IPs listed here: 123

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.15.201.202	Argentina
AR	200.55.57.214	Argentina
CA	70.38.64.167	Canada
CN	150.255.120.138	China
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
IN	117.240.239.120	India
IN	202.63.105.226	India
IR	82.99.246.10	Iran
IR	91.98.117.30	Iran
MO	60.246.189.11	Macau
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	190.187.168.186	Peru
PE	190.236.89.34	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PE	200.110.35.150	Peru
PH	124.107.158.30	Philippines
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
SK	93.184.71.66	Slovakia
US	24.101.120.44	United States
US	74.222.3.249	United States

List from greylisting:

Botnet Statistics [2013-11-10]

detection period: 2013-11-10 00:00-23:59 UTC
total number of suspected botnet IPs: 3737
number of botnet IPs notified to network operators: 3614
number of spam blocked: 106721
recipient count of spam blocked: 3650512

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	895
2	CMNET	459
3	CRTC	221
4	UNICOM-GD	143
5	CTTNET	112
6	CHINANET-GD	98
7	UNICOM-LN	84
8	UNICOM-HE	84
9	UNICOM-SD	75
10	UNICOM-HA	53

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	2153
2	Taiwan	915
3	Ukraine	68
4	Russian Federation	65
5	United States	55
6	Belarus	49
7	Kazakhstan	47
8	Brazil	34
9	Iran	27
10	Peru	24

Suspected Bot List [2013-11-09]

detection period: 2013-11-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 656

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
AR	190.221.48.188	Argentina
AR	200.55.57.214	Argentina
CA	70.38.64.167	Canada
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
IN	117.240.239.120	India
IN	202.63.105.226	India
IR	82.99.246.10	Iran
IR	91.98.117.30	Iran
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PE	200.110.35.150	Peru
PH	124.107.158.30	Philippines
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
SK	93.184.71.66	Slovakia
US	24.101.120.44	United States
US	74.222.3.249	United States

List from greylisting:

Botnet Statistics [2013-11-09]

detection period: 2013-11-09 00:00-23:59 UTC
total number of suspected botnet IPs: 2982
number of botnet IPs notified to network operators: 2326
number of spam blocked: 82984
recipient count of spam blocked: 2870553

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	797
2	UNICOM-GD	131
3	CHINANET-GD	115
4	RIMA	86
5	BY-BELPAK-20091210	48
6	IT-TIWS-20090115	31
7	UNICOM-LN	28
8	003.420.926/0002-05	27
9	CHINANET-FJ	26
10	CTTNET	25

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	808
2	China	558
3	Spain	206
4	Brazil	158
5	Ukraine	145
6	Italy	136
7	Russian Federation	130
8	Belarus	90
9	United States	67
10	Kazakhstan	57

Suspected Bot List [2013-11-08]

detection period: 2013-11-08 00:00-23:59 UTC
number of suspected bots' IPs listed here: 642

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.15.201.202	Argentina
AR	190.221.48.188	Argentina
AR	200.55.57.214	Argentina
CA	70.38.64.167	Canada
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
HN	190.107.140.77	Honduras
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	182.73.111.162	India
IN	202.63.105.226	India
IR	82.99.246.10	Iran
IR	91.98.117.30	Iran
IT	88.41.204.171	Italy
KZ	109.229.189.175	Kazakhstan
MO	60.246.72.94	Macau
MO	60.246.179.209	Macau
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
SK	93.184.71.66	Slovakia
US	24.101.120.44	United States
US	74.222.3.249	United States

List from greylisting:

Botnet Statistics [2013-11-08]

detection period: 2013-11-08 00:00-23:59 UTC
total number of suspected botnet IPs: 4452
number of botnet IPs notified to network operators: 3810
number of spam blocked: 92412
recipient count of spam blocked: 3111256

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	895
2	CMNET	423
3	CRTC	200
4	UNICOM-GD	145
5	CTTNET	137
6	CHINANET-GD	124
7	RIMA	81
8	UNICOM-SD	70
9	UNICOM-LN	59
10	UNICOM-HE	40

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1848
2	Taiwan	924
3	Spain	219
4	United States	218
5	Italy	125
6	Brazil	123
7	United Kingdom	85
8	Argentina	65
9	India	63
10	Russian Federation	42

Suspected Bot List [2013-11-07]

detection period: 2013-11-07 00:00-23:59 UTC
number of suspected bots' IPs listed here: 682

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.15.201.202	Argentina
AR	190.185.200.12	Argentina
AR	190.221.48.188	Argentina
AR	200.55.57.214	Argentina
CA	70.38.64.167	Canada
CN	150.255.26.103	China
CN	150.255.126.129	China
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
HN	190.107.140.77	Honduras
IN	117.240.239.120	India
IN	182.73.111.162	India
IN	202.63.105.226	India
IR	82.99.246.10	Iran
IR	91.98.117.30	Iran
IR	94.183.223.16	Iran
IT	88.41.204.171	Italy
KZ	109.229.189.175	Kazakhstan
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PK	115.186.59.70	Pakistan
SA	94.77.199.148	Saudi Arabia
SK	62.197.209.93	Slovakia
SK	93.184.71.66	Slovakia
US	24.101.120.44	United States
US	74.222.3.249	United States

List from greylisting: