Botnet Statistics for the year of 2016

detection period: 2016-01-01 00:00 - 2016-12-31 23:59 UTC
total number of suspected botnet IPs: 277464
number of blocked spams: 4349886
recipient count of blocked spams: 55283278
detection methods: fake open relay + greylisting

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	95112
2	Taiwan	47932
3	Viet Nam	26200
4	India	22097
5	Mexico	12547
6	Iran	6308
7	Brazil	5402
8	Colombia	3633
9	Turkey	3611
10	Indonesia	3423
11	Pakistan	3408
12	United States	3315
13	Peru	2773
14	Tunisia	1720
15	Thailand	1498
16	Bangladesh	1477
17	Argentina	1452
18	Romania	1391
19	Russian Federation	1354
20	Italy	1310
21	Venezuela	1269
22	Arab Emirates	1267
23	Philippines	1210
24	Poland	1135
25	Bolivia	1090

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	Taiwan	1448316
2	China	1168680
3	United States	665790
4	Poland	499047
5	Brazil	210130
6	Mexico	65594
7	Germany	40658
8	Thailand	21382
9	India	20017
10	Romania	18195
11	Hong Kong	13715
12	Turkey	12433
13	Italy	11855
14	Russian Federation	11528
15	Slovenia	10707
16	Colombia	10418
17	France	9188
18	Viet Nam	9010
19	South Korea	8593
20	Bolivia	5335
21	Argentina	4944
22	United Kingdom	4870
23	Sweden	4663
24	Spain	4642
25	Philippines	4093

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Rank	Country	recipient count of blocked spams
1	Taiwan	41628126
2	China	4751495
3	Brazil	1908303
4	United States	1116403
5	Mexico	853017
6	Thailand	573116
7	Poland	526836
8	Hong Kong	351305
9	Turkey	330321
10	India	288781
11	Colombia	236474
12	Viet Nam	223105
13	Russian Federation	219477
14	France	189753
15	South Korea	176202
16	Bolivia	143425
17	Italy	132573
18	Argentina	132450
19	Sweden	119473
20	Spain	115111
21	Macau	107459
22	Germany	101681
23	Uruguay	84545
24	Indonesia	84400
25	Chile	73088

The top 25 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	41761
2	VNPT-VNNIC-VN	13139
3	CHINANET-JS	11873
4	CHINANET-AH	9867
5	WASU	9370
6	MX-USCV4-LACNIC	6230
7	CNCITYNET	5662
8	CHINANET-HB	5330
9	WASU-BB	5132
10	UNICOM-ZJ	4977
11	CHINANET-HN	4544
12	BSNLNET	4270
13	CHINANET-ZJ-JH	3611
14	UNICOM-JS	3439
15	SONET-NET	3428
16	CHINANET-GD	3280
17	CHINANET-SD	3038
18	UNICOM-AH	3019
19	BHARTI-IN	2992
20	CHINANET-ZJ	2941
21	CMNET	2887
22	VIETEL-VNNIC-VN	2736
23	FPT-VN	2576
24	VIETEL-VN	2509
25	PTCLBB-PK	2477

The top 25 networks (as found in WHOIS), ordered by number of blocked spams are:

Rank	Network	# of blocked spams
1	HINET-NET	1371683
2	CHINANET-HN	951366
3	MSFT	578292
4	PL-FUFO-7	266294
5	PL-ZFIX-20151105	173416
6	005.200.140/0001-27	159307
7	MX-MSCV17-LACNIC	51196
8	CHINANET-JS	42139
9	060.316.817/0001-03	39988
10	SCHLUND-CUSTOMERS	37431
11	EURONET-ISP	35202
12	ALISOFT	27467
13	SEEDNET-NET	26156
14	PL-FUFO-5	23024
15	SONET-NET	16982
16	ROMTELECOM	15844
17	CNCITYNET	15129
18	MICROSOFT-1BLK	13740
19	CC-17	13351
20	NCICNET-NET	12707
21	OGTIPS1-129-121	11490
22	SI-T-2	10707
23	RingLink	9903
24	CAT	9858
25	ASO-239164-20	9022

The top 25 networks (as found in WHOIS), ordered by recipient count of blocked spams are:

Rank	Network	recipient count of blocked spams
1	HINET-NET	40033886
2	005.200.140/0001-27	1591642
3	CHINANET-HN	1218615
4	ALISOFT	723848
5	SEEDNET-NET	712620
6	MSFT	580629
7	MX-MSCV17-LACNIC	554667
8	CNCITYNET	445420
9	NCICNET-NET	307393
10	RingLink	293695
11	CAT	267032
12	PL-FUFO-7	266294
13	TencentCloud	206295
14	TANET-BNETA	187089
15	MX-USCV4-LACNIC	176571
16	PL-ZFIX-20151105	173416
17	CTIHK	162546
18	HICHINA	149883
19	tonghnetwork	148762
20	CHINANET-JS	130753
21	TR-TELEKOM-20051027	129335
22	CHINANET-GD	127735
23	KORNET-KR	127317
24	VIKINGTECH	113568
25	EPLUS-BROADBAND	104695