Suspected Bot List [2016-06-29]

detection period: 2016-06-29 00:00-23:59 UTC
number of suspected bots' IPs listed here: 96

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2016-06-29]

detection period: 2016-06-29 00:00-23:59 UTC
total number of suspected botnet IPs: 1970
number of botnet IPs notified to network operators: 1874
number of spam blocked: 4510
recipient count of spam blocked: 21194

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	546
2	CNCITYNET	150
3	HINET-NET	140
4	SONET-NET	131
5	UNICOM-ZJ	107
6	RingLink	76
7	VNPT-VNNIC-VN	48
8	CHINANET-JS	38
9	WASU-BB	32
10	UNICOM-JS	26

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	1157
2	Taiwan	275
3	Viet Nam	88
4	India	70
5	Brazil	37
6	Mexico	36
7	United States	28
8	South Korea	20
9	Turkey	16
10	Iran	16

Suspected Bot List [2016-06-28]

detection period: 2016-06-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 98

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2016-06-28]

detection period: 2016-06-28 00:00-23:59 UTC
total number of suspected botnet IPs: 1717
number of botnet IPs notified to network operators: 1619
number of spam blocked: 1950
recipient count of spam blocked: 19714

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	397
2	SONET-NET	191
3	UNICOM-ZJ	99
4	HINET-NET	94
5	CNCITYNET	92
6	WASU-BB	51
7	VNPT-VNNIC-VN	41
8	UNICOM-JS	36
9	RingLink	35
10	CHINANET-JS	34

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	876
2	Taiwan	288
3	India	78
4	Viet Nam	69
5	Mexico	42
6	Iran	30
7	Turkey	28
8	Brazil	24
9	United States	23
10	Peru	23

Suspected Bot List [2016-06-27]

detection period: 2016-06-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 82

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2016-06-27]

detection period: 2016-06-27 00:00-23:59 UTC
total number of suspected botnet IPs: 2312
number of botnet IPs notified to network operators: 2230
number of spam blocked: 3402
recipient count of spam blocked: 12252

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	426
2	SONET-NET	344
3	HINET-NET	289
4	CNCITYNET	168
5	UNICOM-ZJ	100
6	RingLink	63
7	WASU-BB	49
8	VNPT-VNNIC-VN	34
9	CHINANET-JS	33
10	UNICOM-JS	31

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	1036
2	Taiwan	635
3	India	100
4	Viet Nam	62
5	Mexico	46
6	Brazil	38
7	Turkey	30
8	South Korea	25
9	United States	24
10	Iran	22

Suspected Bot List [2016-06-26]

detection period: 2016-06-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 57

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
GB	163.172.143.102	United Kingdom

List from greylisting:

Botnet Statistics [2016-06-26]

detection period: 2016-06-26 00:00-23:59 UTC
total number of suspected botnet IPs: 1451
number of botnet IPs notified to network operators: 1395
number of spam blocked: 2149
recipient count of spam blocked: 8239

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	349
2	CNCITYNET	128
3	SONET-NET	126
4	HINET-NET	111
5	UNICOM-ZJ	95
6	RingLink	53
7	WASU-BB	48
8	VNPT-VNNIC-VN	36
9	UNICOM-JS	18
10	CHINANET-GD	18

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	826
2	Taiwan	240
3	Viet Nam	69
4	India	36
5	United States	27
6	Iran	23
7	South Korea	17
8	Mexico	15
9	Turkey	14
10	Brazil	12

Suspected Bot List [2016-06-25]

detection period: 2016-06-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 60

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2016-06-25]

detection period: 2016-06-25 00:00-23:59 UTC
total number of suspected botnet IPs: 1021
number of botnet IPs notified to network operators: 961
number of spam blocked: 518
recipient count of spam blocked: 14117

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CNCITYNET	192
2	RingLink	78
3	UNICOM-ZJ	34
4	TencentCloud	25
5	VNPT-VNNIC-VN	24
6	KORNET-KR	22
7	UNICOM-BJ	21
8	ALISOFT	21
9	CHINANET-GD	20
10	MX-USCV4-LACNIC	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	530
2	Viet Nam	56
3	India	50
4	Mexico	33
5	South Korea	28
6	Iran	28
7	Brazil	27
8	United States	19
9	Turkey	19
10	Peru	16

Suspected Bot List [2016-06-24]

detection period: 2016-06-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 43

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2016-06-24]

detection period: 2016-06-24 00:00-23:59 UTC
total number of suspected botnet IPs: 787
number of botnet IPs notified to network operators: 744
number of spam blocked: 4
recipient count of spam blocked: 4

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CNCITYNET	113
2	WASU	95
3	RingLink	54
4	UNICOM-ZJ	30
5	CHINANET-JS	26
6	UNICOM-JS	24
7	MX-USCV4-LACNIC	19
8	TencentCloud	16
9	UNICOM-BJ	13
10	WASU-BB	12

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	462
2	India	37
3	Brazil	32
4	Mexico	31
5	Viet Nam	19
6	United States	17
7	Colombia	17
8	Peru	14
9	South Korea	14
10	Iran	12

Suspected Bot List [2016-06-23]

detection period: 2016-06-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 73

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2016-06-23]

detection period: 2016-06-23 00:00-23:59 UTC
total number of suspected botnet IPs: 1290
number of botnet IPs notified to network operators: 1217
number of spam blocked: 5724
recipient count of spam blocked: 5753

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	424
2	CNCITYNET	110
3	UNICOM-ZJ	102
4	CHINANET-JS	54
5	RingLink	46
6	WASU-BB	42
7	UNICOM-JS	32
8	UNICOM-BJ	22
9	VNPT-VNNIC-VN	19
10	CMNET	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	951
2	Viet Nam	38
3	India	37
4	Mexico	25
5	Turkey	20
6	Brazil	20
7	United States	15
8	South Korea	14
9	Iran	11
10	Colombia	10

Botnet Statistics [2016-06-22]

detection period: 2016-06-22 00:00-23:59 UTC
total number of suspected botnet IPs: 1448
number of botnet IPs notified to network operators: 1406
number of spam blocked: 2156
recipient count of spam blocked: 42467

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	405
2	CNCITYNET	157
3	UNICOM-ZJ	95
4	RingLink	69
5	VNPT-VNNIC-VN	61
6	WASU-BB	45
7	CHINANET-JS	44
8	UNICOM-JS	34
9	TencentCloud	31
10	UNICOM-BJ	21

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	1046
2	Viet Nam	107
3	India	48
4	Brazil	23
5	Mexico	21
6	South Korea	18
7	Iran	18
8	United States	14
9	Thailand	13
10	Russian Federation	12

Suspected Bot List [2016-06-21]

detection period: 2016-06-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 29

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2016-06-21]

detection period: 2016-06-21 00:00-23:59 UTC
total number of suspected botnet IPs: 1095
number of botnet IPs notified to network operators: 1066
number of spam blocked: 3148
recipient count of spam blocked: 3148

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	313
2	CNCITYNET	121
3	UNICOM-ZJ	86
4	RingLink	51
5	VNPT-VNNIC-VN	46
6	UNICOM-JS	34
7	CHINANET-JS	34
8	WASU-BB	27
9	CMNET	20
10	TencentCloud	18

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	796
2	Viet Nam	75
3	India	35
4	Mexico	17
5	South Korea	17
6	Brazil	15
7	United States	14
8	Germany	13
9	Russian Federation	11
10	Turkey	10

Suspected Bot List [2016-06-20]

detection period: 2016-06-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 12

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2016-06-20]

detection period: 2016-06-20 00:00-23:59 UTC
total number of suspected botnet IPs: 1003
number of botnet IPs notified to network operators: 991
number of spam blocked: 1453
recipient count of spam blocked: 1453

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	522
2	UNICOM-ZJ	91
3	CNCITYNET	52
4	WASU-BB	39
5	CHINANET-JS	37
6	UNICOM-JS	35
7	RingLink	22
8	UNICOM-BJ	16
9	CHINANET-GD	16
10	CHINANET-HN	9

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	891
2	Viet Nam	14
3	India	11
4	Brazil	10
5	Mexico	9
6	Russian Federation	6
7	Peru	5
8	Colombia	5
9	Iran	4
10	Indonesia	4

Suspected Bot List [2016-06-19]

detection period: 2016-06-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 17

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2016-06-19]

detection period: 2016-06-19 00:00-23:59 UTC
total number of suspected botnet IPs: 796
number of botnet IPs notified to network operators: 779
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	265
2	CNCITYNET	96
3	UNICOM-ZJ	86
4	RingLink	49
5	WASU-BB	42
6	CHINANET-JS	28
7	UNICOM-JS	22
8	CMNET	9
9	TencentCloud	8
10	UNICOM-BJ	7

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	666
2	Viet Nam	13
3	India	13
4	Brazil	13
5	Mexico	10
6	Russian Federation	8
7	South Korea	8
8	United States	5
9	Iran	5
10	United Kingdom	4

Suspected Bot List [2016-06-18]

detection period: 2016-06-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 25

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
RS	178.148.117.154	Serbia

List from greylisting:

Botnet Statistics [2016-06-18]

detection period: 2016-06-18 00:00-23:59 UTC
total number of suspected botnet IPs: 540
number of botnet IPs notified to network operators: 515
number of spam blocked: 489
recipient count of spam blocked: 14185

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CNCITYNET	165
2	RingLink	91
3	TencentCloud	20
4	KORNET-KR	16
5	CMNET	16
6	VNPT-VNNIC-VN	11
7	UNICOM-BJ	11
8	CHINANET-GD	8
9	HICHINA	7
10	CHINANET-ZJ	7

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	379
2	South Korea	17
3	Viet Nam	16
4	Taiwan	10
5	Brazil	9
6	United States	8
7	Russian Federation	8
8	Mexico	8
9	Turkey	7
10	Japan	7

Suspected Bot List [2016-06-17]

detection period: 2016-06-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 29

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.108.35.2	Argentina
CA	45.62.242.80	Canada
CZ	109.238.208.242	Czech Republic
ID	202.61.126.62	Indonesia
IN	203.192.212.52	India
IN	223.196.86.210	India
IN	223.196.86.215	India
IN	223.196.87.19	India
RS	89.216.118.10	Serbia
TR	78.186.4.165	Turkey
TR	78.186.10.224	Turkey
TR	78.189.128.103	Turkey
TR	78.189.231.24	Turkey
TR	85.105.14.48	Turkey
TR	85.105.33.188	Turkey
TR	88.225.216.167	Turkey
TR	88.247.23.135	Turkey
TR	88.247.56.225	Turkey
TW	211.78.82.186	Taiwan
ZA	196.46.23.122	South Africa

List from greylisting:

Botnet Statistics [2016-06-17]

detection period: 2016-06-17 00:00-23:59 UTC
total number of suspected botnet IPs: 1523
number of botnet IPs notified to network operators: 1495
number of spam blocked: 6518
recipient count of spam blocked: 153258

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CNCITYNET	366
2	WASU	294
3	RingLink	162
4	TencentCloud	70
5	UNICOM-ZJ	59
6	CHINANET-JS	37
7	KORNET-KR	31
8	VNPT-VNNIC-VN	29
9	UNICOM-GX	28
10	CHINANET-GD	20

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	1239
2	Viet Nam	39
3	South Korea	36
4	Brazil	24
5	United States	21
6	Russian Federation	18
7	Turkey	12
8	India	10
9	Taiwan	9
10	United Kingdom	8

Suspected Bot List [2016-06-16]

detection period: 2016-06-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 29

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	181.30.11.71	Argentina
AR	190.108.35.2	Argentina
AR	209.13.156.2	Argentina
BO	186.27.126.130	Bolivia
ID	202.61.126.62	Indonesia
IN	114.79.160.30	India
IN	203.192.212.52	India
RS	89.216.118.10	Serbia
RU	95.71.48.188	Russian Federation
TR	78.186.4.165	Turkey
TR	78.186.10.224	Turkey
TR	78.189.128.103	Turkey
TR	78.189.231.24	Turkey
TR	85.105.14.48	Turkey
TR	85.105.33.188	Turkey
TR	88.225.216.167	Turkey
TR	88.247.23.135	Turkey
TR	88.247.56.225	Turkey
TW	211.78.82.186	Taiwan
ZA	196.46.23.122	South Africa

List from greylisting:

Botnet Statistics [2016-06-16]

detection period: 2016-06-16 00:00-23:59 UTC
total number of suspected botnet IPs: 2094
number of botnet IPs notified to network operators: 2066
number of spam blocked: 6458
recipient count of spam blocked: 175495

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	496
2	CNCITYNET	416
3	RingLink	165
4	CHINANET-JS	111
5	UNICOM-ZJ	94
6	UNICOM-JS	79
7	TencentCloud	72
8	WASU-BB	41
9	CHINANET-GD	34
10	KORNET-KR	33

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	1824
2	South Korea	38
3	Brazil	27
4	United States	16
5	Russian Federation	16
6	India	15
7	Taiwan	14
8	Turkey	14
9	Iran	13
10	Indonesia	9

Suspected Bot List [2016-06-15]

detection period: 2016-06-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 24

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	170.51.72.177	Argentina
AR	190.108.35.2	Argentina
AR	209.13.156.2	Argentina
BO	186.27.126.130	Bolivia
ID	202.61.126.62	Indonesia
IN	203.192.212.52	India
RS	89.216.118.10	Serbia
TR	78.186.4.165	Turkey
TR	78.189.128.103	Turkey
TR	78.189.231.24	Turkey
TR	85.105.14.48	Turkey
TR	85.105.33.188	Turkey
TR	88.225.216.167	Turkey
TR	88.247.23.135	Turkey
TR	88.247.56.225	Turkey
TW	106.1.5.95	Taiwan
TW	211.78.82.186	Taiwan
US	71.95.169.126	United States
UZ	89.236.217.169	Uzbekistan

List from greylisting:

Botnet Statistics [2016-06-15]

detection period: 2016-06-15 00:00-23:59 UTC
total number of suspected botnet IPs: 1636
number of botnet IPs notified to network operators: 1612
number of spam blocked: 7278
recipient count of spam blocked: 128057

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CNCITYNET	377
2	WASU	346
3	RingLink	147
4	CHINANET-JS	101
5	UNICOM-ZJ	72
6	UNICOM-JS	57
7	TencentCloud	50
8	WASU-BB	39
9	CHINANET-GD	29
10	KORNET-KR	28

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	1429
2	South Korea	34
3	Brazil	19
4	Taiwan	16
5	United States	15
6	Turkey	11
7	Russian Federation	9
8	Iran	8
9	United Kingdom	8
10	India	7

Suspected Bot List [2016-06-14]

detection period: 2016-06-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 13

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	209.13.156.2	Argentina
BO	186.27.126.130	Bolivia
ID	202.61.126.62	Indonesia
IN	114.79.160.30	India
IN	203.192.212.52	India
IN	223.196.86.210	India
IN	223.196.86.215	India
IN	223.196.87.19	India
RS	89.216.118.10	Serbia
RU	95.71.48.188	Russian Federation
ZA	196.46.23.122	South Africa

List from greylisting:

Botnet Statistics [2016-06-14]

detection period: 2016-06-14 00:00-23:59 UTC
total number of suspected botnet IPs: 1994
number of botnet IPs notified to network operators: 1981
number of spam blocked: 6938
recipient count of spam blocked: 181587

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	466
2	CNCITYNET	428
3	RingLink	175
4	UNICOM-ZJ	102
5	CHINANET-JS	74
6	UNICOM-JS	73
7	HINET-NET	71
8	TencentCloud	67
9	WASU-BB	36
10	CHINANET-GD	34

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	1670
2	Taiwan	110
3	South Korea	37
4	United States	18
5	Russian Federation	16
6	Brazil	14
7	India	12
8	Turkey	11
9	Indonesia	8
10	Iran	7

Suspected Bot List [2016-06-13]

detection period: 2016-06-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 25

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	181.30.11.71	Argentina
AR	190.108.35.2	Argentina
AR	209.13.156.2	Argentina
ID	202.61.126.62	Indonesia
IN	203.192.212.52	India
PH	122.53.178.100	Philippines
RS	89.216.118.10	Serbia
RU	95.71.48.188	Russian Federation
TR	78.186.4.165	Turkey
TR	78.189.128.103	Turkey
TR	78.189.231.24	Turkey
TR	81.213.108.83	Turkey
TR	85.105.14.48	Turkey
TR	85.105.33.188	Turkey
TR	88.225.216.167	Turkey
TR	88.247.23.135	Turkey
TR	88.247.56.225	Turkey
TR	88.247.61.50	Turkey
US	24.196.69.180	United States
ZA	196.46.23.122	South Africa
ZW	41.220.28.138	Zimbabwe

List from greylisting:

Botnet Statistics [2016-06-13]

detection period: 2016-06-13 00:00-23:59 UTC
total number of suspected botnet IPs: 2336
number of botnet IPs notified to network operators: 2311
number of spam blocked: 12955
recipient count of spam blocked: 299156

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CNCITYNET	463
2	WASU	450
3	HINET-NET	251
4	RingLink	173
5	CHINANET-JS	104
6	UNICOM-JS	88
7	UNICOM-ZJ	81
8	TencentCloud	65
9	WASU-BB	38
10	SONET-NET	38

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	1725
2	Taiwan	325
3	South Korea	40
4	United States	25
5	Brazil	23
6	Viet Nam	18
7	Russian Federation	18
8	Turkey	14
9	Indonesia	13
10	United Kingdom	11

Suspected Bot List [2016-06-12]

detection period: 2016-06-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 5

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
IN	203.192.212.52	India
PK	39.32.184.239	Pakistan
TR	78.189.128.103	Turkey

List from greylisting:

Botnet Statistics [2016-06-12]

detection period: 2016-06-12 00:00-23:59 UTC
total number of suspected botnet IPs: 1397
number of botnet IPs notified to network operators: 1392
number of spam blocked: 1249
recipient count of spam blocked: 12994

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	507
2	HINET-NET	285
3	UNICOM-ZJ	104
4	UNICOM-JS	98
5	CHINANET-JS	68
6	CNCITYNET	52
7	SONET-NET	48
8	WASU-BB	40
9	CHINANET-GD	20
10	HINET	19

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	992
2	Taiwan	356
3	United States	7
4	Russian Federation	6
5	South Korea	6
6	United Kingdom	5
7	Brazil	3
8	Turkey	2
9	India	2
10	Germany	2

Suspected Bots' IP List for May 2016

To encourage cyber security information sharing (as some form of open data) while still giving victims enough time to clean up their computers, the IP list of suspected infected computers will be released here (as shown below). You are free to use them to create more effective defenses, discover latest trends in cyber attacks, etc.

Suspected Bots IP [2016-05-01]
Suspected Bots IP [2016-05-02]
Suspected Bots IP [2016-05-03]
Suspected Bots IP [2016-05-04]
Suspected Bots IP [2016-05-05]
Suspected Bots IP [2016-05-06]
Suspected Bots IP [2016-05-07]
Suspected Bots IP [2016-05-08]
Suspected Bots IP [2016-05-09]
Suspected Bots IP [2016-05-10]
Suspected Bots IP [2016-05-11]
Suspected Bots IP [2016-05-12]
Suspected Bots IP [2016-05-13]
Suspected Bots IP [2016-05-14]
Suspected Bots IP [2016-05-15]
Suspected Bots IP [2016-05-16]
Suspected Bots IP [2016-05-17]
Suspected Bots IP [2016-05-18]
Suspected Bots IP [2016-05-19]
Suspected Bots IP [2016-05-20]
Suspected Bots IP [2016-05-21]
Suspected Bots IP [2016-05-22]
Suspected Bots IP [2016-05-23]
Suspected Bots IP [2016-05-24]
Suspected Bots IP [2016-05-25]
Suspected Bots IP [2016-05-26]
Suspected Bots IP [2016-05-27]
Suspected Bots IP [2016-05-28]
Suspected Bots IP [2016-05-29]
Suspected Bots IP [2016-05-30]
Suspected Bots IP [2016-05-31]

Suspected Bot List [2016-06-11]

detection period: 2016-06-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 8

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	200.55.243.116	Argentina
TR	85.105.33.188	Turkey
UZ	89.236.217.169	Uzbekistan

List from greylisting:

Botnet Statistics [2016-06-11]

detection period: 2016-06-11 00:00-23:59 UTC
total number of suspected botnet IPs: 1228
number of botnet IPs notified to network operators: 1220
number of spam blocked: 2805
recipient count of spam blocked: 21846

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	381
2	WASU	268
3	SONET-NET	74
4	CNCITYNET	69
5	UNICOM-JS	60
6	UNICOM-ZJ	44
7	WASU-BB	32
8	HINET	28
9	CHINANET-GD	28
10	CHINANET-JS	20

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	629
2	Taiwan	487
3	Viet Nam	37
4	India	17
5	Thailand	6
6	South Korea	6
7	Brazil	5
8	United States	4
9	Indonesia	4
10	Germany	3

Botnet Statistics for May 2016

Due to a failed vps, I lost the data needed for calculating blocked spam and the associated recipient count before May 23. Please keep that in mind when interpreting the information below.

detection period: 2016-05-01 00:00 - 2016-05-31 23:59 UTC
total number of suspected botnet IPs: 58317
number of blocked spams: 32818
recipient count of blocked spams: 243103

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	15517
2	Mexico	6470
3	India	5026
4	Viet Nam	4705
5	Taiwan	3536
6	Iran	2072
7	Colombia	1654
8	Brazil	1412
9	Pakistan	1144
10	Turkey	1116
11	Indonesia	944
12	Peru	792
13	Tunisia	749
14	Ecuador	548
15	United States	546
16	Bangladesh	525
17	Bolivia	511
18	Romania	503
19	Italy	463
20	Poland	438
21	Arab Emirates	438
22	Venezuela	412
23	Macedonia	389
24	Argentina	378
25	Serbia	338

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	Brazil	14022
2	Poland	11794
3	Taiwan	3571
4	China	1408
5	Germany	1049
6	Canada	233
7	Thailand	156
8	United States	128
9	Colombia	114
10	Turkey	76
11	Russian Federation	57
12	Mexico	45
13	Occupied Palestinian Territory	44
14	Argentina	38
15	Bolivia	33
16	Arab Emirates	17
17	Romania	8
18	Israel	8
19	France	5
20	Portugal	3
21	Viet Nam	2
22	Macedonia	2
23	Hong Kong	2
24	Malaysia	1
25	Italy	1

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Suspected Bot List [2016-06-10]

detection period: 2016-06-10 00:00-23:59 UTC
number of suspected bots' IPs listed here: 4

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2016-06-10]

detection period: 2016-06-10 00:00-23:59 UTC
total number of suspected botnet IPs: 839
number of botnet IPs notified to network operators: 835
number of spam blocked: 2946
recipient count of spam blocked: 9730

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	450
2	SONET-NET	92
3	CNCITYNET	58
4	HINET	49
5	RingLink	24
6	CHINANET-GD	14
7	UNICOM-GD	9
8	TencentCloud	9
9	KORNET-KR	6
10	CMNET	6

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	Taiwan	597
2	China	177
3	United States	13
4	South Korea	7
5	Viet Nam	4
6	Thailand	3
7	Russian Federation	3
8	Netherlands	3
9	Indonesia	3
10	Brazil	3

Suspected Bot List [2016-06-09]

detection period: 2016-06-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 9

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2016-06-09]

detection period: 2016-06-09 00:00-23:59 UTC
total number of suspected botnet IPs: 622
number of botnet IPs notified to network operators: 613
number of spam blocked: 3189
recipient count of spam blocked: 24762

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	266
2	SONET-NET	56
3	HINET	26
4	CHINANET-GD	26
5	CNCITYNET	25
6	VNPT-VNNIC-VN	18
7	RingLink	17
8	DATANOC	10
9	UNICOM-BJ	9
10	CMNET	7

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	Taiwan	352
2	China	143
3	Viet Nam	30
4	United States	24
5	Russian Federation	8
6	Brazil	8
7	Thailand	6
8	South Korea	6
9	India	6
10	Mexico	5

Suspected Bot List [2016-06-08]

detection period: 2016-06-08 00:00-23:59 UTC
number of suspected bots' IPs listed here: 5

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2016-06-08]

detection period: 2016-06-08 00:00-23:59 UTC
total number of suspected botnet IPs: 862
number of botnet IPs notified to network operators: 857
number of spam blocked: 7079
recipient count of spam blocked: 28555

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	357
2	UNICOM-ZJ	106
3	HINET-NET	81
4	WASU-BB	39
5	CHINANET-JS	32
6	CHINANET-GD	30
7	UNICOM-JS	26
8	CMNET	17
9	SONET-NET	15
10	UNICOM-BJ	13

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	695
2	Taiwan	108
3	United States	7
4	Thailand	5
5	Brazil	5
6	Viet Nam	3
7	Russian Federation	3
8	South Korea	3
9	Indonesia	3
10	Italy	2

Suspected Bot List [2016-06-07]

detection period: 2016-06-07 00:00-23:59 UTC
number of suspected bots' IPs listed here: 6

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
TW	118.232.43.159	Taiwan
UZ	213.230.75.255	Uzbekistan

List from greylisting:

Botnet Statistics [2016-06-07]

detection period: 2016-06-07 00:00-23:59 UTC
total number of suspected botnet IPs: 936
number of botnet IPs notified to network operators: 930
number of spam blocked: 4143
recipient count of spam blocked: 27035

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	339
2	CHINANET-JS	98
3	UNICOM-JS	72
4	CNCITYNET	58
5	UNICOM-ZJ	44
6	CHINANET-GD	35
7	RingLink	20
8	WASU-BB	17
9	UNICOM-GD	12
10	CMNET	11

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	815
2	Viet Nam	18
3	Brazil	13
4	South Korea	11
5	Taiwan	8
6	Thailand	7
7	Japan	7
8	Turkey	6
9	Ukraine	5
10	United States	3

Suspected Bot List [2016-06-06]

detection period: 2016-06-06 00:00-23:59 UTC
number of suspected bots' IPs listed here: 13

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.228.161.218	Argentina
CA	192.243.119.137	Canada
PL	155.133.38.43	Poland
RO	81.89.9.171	Romania
ZA	196.46.23.122	South Africa

List from greylisting:

Botnet Statistics [2016-06-06]

detection period: 2016-06-06 00:00-23:59 UTC
total number of suspected botnet IPs: 1108
number of botnet IPs notified to network operators: 1095
number of spam blocked: 2784
recipient count of spam blocked: 9804

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	378
2	CHINANET-JS	180
3	UNICOM-JS	63
4	CNCITYNET	34
5	CHINANET-GD	34
6	CHINANET-HA	32
7	HINET-NET	31
8	CHINANET-SD	30
9	VNPT-VNNIC-VN	27
10	CHINANET-AH	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	954
2	Viet Nam	45
3	Taiwan	37
4	United States	10
5	India	7
6	Russian Federation	5
7	South Korea	4
8	France	4
9	Thailand	3
10	Romania	3

Suspected Bot List [2016-06-05]

detection period: 2016-06-05 00:00-23:59 UTC
number of suspected bots' IPs listed here: 18

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AZ	185.36.200.62	Azerbaijan
CO	190.7.146.126	Colombia
DE	213.252.158.9	Germany
IN	223.196.86.215	India
PK	39.54.69.73	Pakistan
UA	91.247.226.140	Ukraine
US	173.245.67.81	United States

List from greylisting:

Botnet Statistics [2016-06-05]

detection period: 2016-06-05 00:00-23:59 UTC
total number of suspected botnet IPs: 1124
number of botnet IPs notified to network operators: 1106
number of spam blocked: 1539
recipient count of spam blocked: 21024

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	254
2	CHINANET-JS	118
3	VNPT-VNNIC-VN	83
4	CNCITYNET	67
5	CHINANET-GD	49
6	CHINANET-HA	40
7	UNICOM-JS	38
8	HINET-NET	36
9	CHINANET-SD	31
10	CHINANET-QH	28

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	805
2	Viet Nam	137
3	Taiwan	45
4	India	17
5	Brazil	17
6	United States	11
7	Ukraine	9
8	Thailand	8
9	Russian Federation	8
10	Romania	5

Suspected Bot List [2016-06-04]

detection period: 2016-06-04 00:00-23:59 UTC
number of suspected bots' IPs listed here: 11

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
CO	190.7.146.126	Colombia
TW	123.110.238.132	Taiwan

List from greylisting:

Botnet Statistics [2016-06-04]

detection period: 2016-06-04 00:00-23:59 UTC
total number of suspected botnet IPs: 532
number of botnet IPs notified to network operators: 521
number of spam blocked: 3050
recipient count of spam blocked: 26766

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-JS	81
2	CHINANET-HA	42
3	UNICOM-JS	40
4	CNCITYNET	40
5	CHINANET-JX	36
6	CHINANET-QH	35
7	CHINANET-SD	29
8	CHINANET-GD	29
9	CHINANET-AH	20
10	CMNET	15

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	456
2	United States	17
3	Taiwan	10
4	Viet Nam	5
5	Thailand	5
6	Germany	4
7	Turkey	3
8	South Korea	3
9	Indonesia	3
10	Colombia	3

Suspected Bot List [2016-06-03]

detection period: 2016-06-03 00:00-23:59 UTC
number of suspected bots' IPs listed here: 13

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
CO	190.7.146.126	Colombia
IN	49.205.141.7	India
RO	89.121.206.8	Romania
TR	85.98.33.84	Turkey

List from greylisting:

Botnet Statistics [2016-06-03]

detection period: 2016-06-03 00:00-23:59 UTC
total number of suspected botnet IPs: 520
number of botnet IPs notified to network operators: 507
number of spam blocked: 7033
recipient count of spam blocked: 23786

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-JS	87
2	CNCITYNET	49
3	UNICOM-JS	43
4	CHINANET-GD	29
5	CHINANET-AH	28
6	UNICOM-BJ	16
7	CHINANET-JX	16
8	CMNET	15
9	RingLink	12
10	DATANOC	12

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	395
2	United States	39
3	Viet Nam	22
4	Taiwan	12
5	Thailand	6
6	Turkey	4
7	South Korea	4
8	Romania	3
9	Mexico	3
10	Indonesia	3

Suspected Bot List [2016-06-02]

detection period: 2016-06-02 00:00-23:59 UTC
number of suspected bots' IPs listed here: 18

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
IN	59.88.162.59	India
IN	117.196.160.81	India
IN	117.206.132.66	India
IN	117.212.242.252	India
IN	117.221.94.9	India
MO	202.175.189.2	Macau
VN	220.231.127.15	Viet Nam

List from greylisting:

Botnet Statistics [2016-06-02]

detection period: 2016-06-02 00:00-23:59 UTC
total number of suspected botnet IPs: 977
number of botnet IPs notified to network operators: 960
number of spam blocked: 3044
recipient count of spam blocked: 10034

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	259
2	CHINANET-JS	124
3	UNICOM-JS	65
4	CNCITYNET	51
5	DATANOC	46
6	UNICOM-ZJ	38
7	VNPT-VNNIC-VN	37
8	MSFT	37
9	WASU-BB	35
10	CHINANET-GD	27

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	777
2	United States	87
3	Viet Nam	56
4	India	17
5	Brazil	5
6	Japan	3
7	Taiwan	2
8	Turkey	2
9	Netherlands	2
10	Mexico	2

Suspected Bot List [2016-06-01]

detection period: 2016-06-01 00:00-23:59 UTC
number of suspected bots' IPs listed here: 8

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
TW	122.254.32.111	Taiwan
UY	200.58.149.178	Uruguay

List from greylisting:

Botnet Statistics [2016-06-01]

detection period: 2016-06-01 00:00-23:59 UTC
total number of suspected botnet IPs: 1013
number of botnet IPs notified to network operators: 1005
number of spam blocked: 2571
recipient count of spam blocked: 9591

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	391
2	CHINANET-JS	145
3	UNICOM-ZJ	77
4	WASU-BB	34
5	UNICOM-JS	31
6	CHINANET-JX	27
7	VNPT-VNNIC-VN	25
8	DATANOC	24
9	CHINANET-SD	23
10	CNCITYNET	17

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	879
2	Viet Nam	43
3	United States	40
4	Taiwan	8
5	Poland	3
6	Mexico	3
7	Japan	3
8	Arab Emirates	3
9	Thailand	2
10	Russian Federation	2

Suspected Bot List [2016-05-31]

detection period: 2016-05-31 00:00-23:59 UTC
number of suspected bots' IPs listed here: 142

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.178.157.68	Argentina
BO	190.129.78.100	Bolivia
CO	190.7.146.126	Colombia
MX	148.244.112.66	Mexico
TR	78.188.24.246	Turkey

List from greylisting:

Botnet Statistics [2016-05-31]

detection period: 2016-05-31 00:00-23:59 UTC
total number of suspected botnet IPs: 1053
number of botnet IPs notified to network operators: 911
number of spam blocked: 960
recipient count of spam blocked: 22624

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	129
2	CHINANET-JS	59
3	UNICOM-JS	40
4	DATANOC	34
5	VNPT-VNNIC-VN	29
6	CHINANET-GD	27
7	MSFT	23
8	UNICOM-ZJ	20
9	MX-USCV4-LACNIC	17
10	PTCLBB-PK	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	350
2	India	76
3	United States	65
4	Viet Nam	59
5	Iran	46
6	Mexico	42
7	Turkey	34
8	Indonesia	28
9	Pakistan	25
10	Brazil	22