Custom Search

Tuesday, July 31, 2018

Botnet Statistics [2018-07-30]

detection period: 2018-07-30 00:00-23:59 UTC
total number of suspected botnet IPs: 315
number of botnet IPs notified to network operators: 285
number of spam blocked: 8776
recipient count of spam blocked: 249511

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud14
2KORNET-KR10
3TELKOMNET5
4HO-25
5HINET-NET5
6CHINANET-GD5
7VNPT-VNNIC-VN4
8TENCENT-CN4
9MSFT4
10CHINANET-JS4

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China62
2United States38
3France20
4South Korea19
5Canada16
6Netherlands13
7Viet Nam11
8Russian Federation11
9India11
10Brazil11

Suspected Bot List [2018-07-30]

detection period: 2018-07-30 00:00-23:59 UTC
number of suspected bots' IPs listed here: 30

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Monday, July 30, 2018

Botnet Statistics [2018-07-29]

detection period: 2018-07-29 00:00-23:59 UTC
total number of suspected botnet IPs: 231
number of botnet IPs notified to network operators: 203
number of spam blocked: 8477
recipient count of spam blocked: 253877

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud13
2KORNET-KR7
3Baidu5
4TELKOMNET4
5CHINANET-ZJ4
6CABLE-14
7VNPT-VNNIC-VN3
8UNICOM-JS3
9TEDATA-200911053
10HOSTWAY-053

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China73
2United States26
3France13
4South Korea11
5India7
6United Kingdom7
7Brazil7
8Indonesia6
9Viet Nam5
10Italy5

Suspected Bot List [2018-07-29]

detection period: 2018-07-29 00:00-23:59 UTC
number of suspected bots' IPs listed here: 28

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Sunday, July 29, 2018

Botnet Statistics [2018-07-28]

detection period: 2018-07-28 00:00-23:59 UTC
total number of suspected botnet IPs: 427
number of botnet IPs notified to network operators: 384
number of spam blocked: 8140
recipient count of spam blocked: 243881

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud21
2KORNET-KR20
3broadNnet-KR7
4TENCENT-CN7
5AT-88-Z7
6VNPT-VNNIC-VN6
7GO-DADDY-COM-LLC6
8Baidu6
9HINET-NET5
10CO-ACSA-LACNIC5

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China92
2United States55
3South Korea36
4France34
5India21
6Brazil18
7Viet Nam15
8Italy14
9Indonesia14
10Russian Federation10

Suspected Bot List [2018-07-28]

detection period: 2018-07-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 43

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Saturday, July 28, 2018

Botnet Statistics [2018-07-27]

detection period: 2018-07-27 00:00-23:59 UTC
total number of suspected botnet IPs: 372
number of botnet IPs notified to network operators: 335
number of spam blocked: 8390
recipient count of spam blocked: 250831

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1KORNET-KR14
2TencentCloud9
3TENCENT-CN7
4CMNET6
5CHINANET-JS5
6VNPT-VNNIC-VN4
7CHINANET-JX4
8broadNnet-KR3
9UNICOM-JS3
10TELKOMNET3

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China90
2United States48
3France29
4South Korea23
5Indonesia15
6India13
7Viet Nam12
8Italy11
9Russian Federation10
10United Kingdom9

Suspected Bot List [2018-07-27]

detection period: 2018-07-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 40

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
ES81.45.136.229Spain
KR125.141.200.3South Korea
NL37.49.224.85Netherlands
US107.151.149.45United States

List from greylisting:

Friday, July 27, 2018

Botnet Statistics [2018-07-26]

detection period: 2018-07-26 00:00-23:59 UTC
total number of suspected botnet IPs: 477
number of botnet IPs notified to network operators: 433
number of spam blocked: 7621
recipient count of spam blocked: 228340

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1KORNET-KR16
2TencentCloud12
3TENCENT-CN7
4HO-27
5FR-OVH-200609206
6CMNET6
7HINET-NET5
8FR-OVH-201505225
9DIGITALOCEAN-AP5
10CHINANET-ZJ5

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China76
2United States67
3France43
4South Korea28
5India26
6Brazil21
7Russian Federation19
8Italy19
9Canada15
10Indonesia13

Suspected Bot List [2018-07-26]

detection period: 2018-07-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 44

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Botnet Statistics [2018-07-25]

detection period: 2018-07-25 00:00-23:59 UTC
total number of suspected botnet IPs: 412
number of botnet IPs notified to network operators: 371
number of spam blocked: 12513
recipient count of spam blocked: 256647

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1KORNET-KR13
2TencentCloud12
3VNPT-VNNIC-VN6
4TELKOMNET6
5LLU-POOL-KLN5
6HO-25
7FR-OVH-201505225
8CO-ACSA-LACNIC5
9CHINANET-SH5
10TENCENT-CN4

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China80
2United States48
3France35
4Russian Federation25
5South Korea23
6Brazil17
7India16
8Netherlands15
9Italy11
10Indonesia11

Thursday, July 26, 2018

Suspected Bot List [2018-07-25]

detection period: 2018-07-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 41

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
SA37.216.248.54Saudi Arabia

List from greylisting:

Botnet Statistics [2018-07-24]

detection period: 2018-07-24 00:00-23:59 UTC
total number of suspected botnet IPs: 481
number of botnet IPs notified to network operators: 444
number of spam blocked: 8320
recipient count of spam blocked: 249339

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1KORNET-KR21
2TencentCloud16
3broadNnet-KR6
4VNPT-VNNIC-VN6
5UNKNOWN5
6TENCENT-CN5
7HO-25
8GO-DADDY-COM-LLC5
9FR-OVH-201505225
10FR-OVH-200609205

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China96
2United States52
3France44
4South Korea37
5Brazil29
6India21
7Italy18
8Indonesia13
9Russian Federation12
10Netherlands12

Suspected Bot List [2018-07-24]

detection period: 2018-07-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 37

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Tuesday, July 24, 2018

Botnet Statistics [2018-07-23]

detection period: 2018-07-23 00:00-23:59 UTC
total number of suspected botnet IPs: 352
number of botnet IPs notified to network operators: 331
number of spam blocked: 7976
recipient count of spam blocked: 239037

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud16
2KORNET-KR14
3TENCENT-CN6
4CHINANET-JS6
5BSNLNET6
6broadNnet-KR5
7HO-25
8002.558.157/0001-624
9VIETEL-VN3
10UCLOUD-NET3

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China84
2United States33
3France29
4South Korea27
5Brazil15
6India14
7Russian Federation12
8Italy11
9United Kingdom10
10Viet Nam8

Suspected Bot List [2018-07-23]

detection period: 2018-07-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 21

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
AR190.220.129.85Argentina

List from greylisting:

Monday, July 23, 2018

Botnet Statistics [2018-07-22]

detection period: 2018-07-22 00:00-23:59 UTC
total number of suspected botnet IPs: 308
number of botnet IPs notified to network operators: 283
number of spam blocked: 8769
recipient count of spam blocked: 279170

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud22
2KORNET-KR8
3UNICOM-JS5
4Baidu5
5CHINANET-ZJ4
6CHINANET-GD4
7AT-88-Z4
8VNPT-VNNIC-VN3
9TENCENT-CN3
10SELECTEL-NET3

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China81
2United States33
3France32
4South Korea15
5Russian Federation14
6Italy13
7India13
8United Kingdom10
9Indonesia8
10Brazil6

Suspected Bot List [2018-07-22]

detection period: 2018-07-22 00:00-23:59 UTC
number of suspected bots' IPs listed here: 25

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Sunday, July 22, 2018

Botnet Statistics for June 2018

detection period: 2018-06-01 00:00 - 2018-06-30 23:59 UTC
total number of suspected botnet IPs: 4163
number of blocked spams: 652347
recipient count of blocked spams: 15476893

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1China851
2United States525
3France278
4Brazil204
5South Korea171
6Russian Federation151
7Germany151
8Viet Nam144
9India130
10Italy119
11Ecuador116
12Indonesia78
13United Kingdom78
14Canada77
15Thailand68
16Egypt54
17Taiwan53
18Netherlands51
19Colombia48
20Mexico42
21Argentina38
22South Africa35
23Poland33
24Spain30
25Singapore29

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

RankCountry# of blocked spams
1China461225
2Italy85908
3Canada50854
4Venezuela16079
5United States13800
6Tunisia6919
7Poland6414
8Romania5950
9Netherlands1542
10ZZ1429
11South Korea836
12Colombia548
13Brazil261
14India224
15United Kingdom200
16Viet Nam114
17Indonesia14
18Lebanon5
19Antigua And Barbuda4
20Taiwan3
21Hong Kong3
22France3
23Spain3
24South Africa1
25Singapore1

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2018-07-21]

detection period: 2018-07-21 00:00-23:59 UTC
total number of suspected botnet IPs: 477
number of botnet IPs notified to network operators: 441
number of spam blocked: 30735
recipient count of spam blocked: 808067

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud23
2KORNET-KR15
3FR-OVH-200609209
4CHINANET-JS8
5HO-26
6Baidu6
7AT-88-Z6
8TENCENT-CN5
9TELKOMNET5
10NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK5

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China104
2United States58
3France39
4South Korea29
5Brazil25
6Italy21
7Indonesia20
8India17
9United Kingdom15
10Canada13

Suspected Bot List [2018-07-21]

detection period: 2018-07-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 36

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Saturday, July 21, 2018

Botnet Statistics [2018-07-20]

detection period: 2018-07-20 00:00-23:59 UTC
total number of suspected botnet IPs: 356
number of botnet IPs notified to network operators: 311
number of spam blocked: 30983
recipient count of spam blocked: 854467

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1KORNET-KR12
2CHINANET-JS9
3AT-88-Z6
4TELKOMNET5
5CHINANET-GD5
6VNPT-VNNIC-VN4
7TencentCloud4
8HO-24
9UNKNOWN3
10THAINET-TH3

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China57
2United States46
3France25
4South Korea21
5Brazil18
6India15
7Indonesia15
8Italy14
9Russian Federation10
10United Kingdom10

Suspected Bot List [2018-07-20]

detection period: 2018-07-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 46

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Friday, July 20, 2018

Botnet Statistics [2018-07-19]

detection period: 2018-07-19 00:00-23:59 UTC
total number of suspected botnet IPs: 303
number of botnet IPs notified to network operators: 273
number of spam blocked: 32273
recipient count of spam blocked: 908711

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1CHINANET-JS11
2KORNET-KR10
3TencentCloud8
4FR-OVH-200609207
5VNPT-VNNIC-VN6
6IUNET46
7CHINANET-GD6
8HO-24
9FR-OVH-201203204
10SINGNET-SG3

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China67
2France37
3United States25
4South Korea16
5Russian Federation15
6India11
7Italy10
8Brazil10
9Canada9
10Viet Nam8

Suspected Bot List [2018-07-19]

detection period: 2018-07-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 30

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Thursday, July 19, 2018

Botnet Statistics [2018-07-18]

detection period: 2018-07-18 00:00-23:59 UTC
total number of suspected botnet IPs: 363
number of botnet IPs notified to network operators: 331
number of spam blocked: 31835
recipient count of spam blocked: 898400

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud18
2KORNET-KR13
3CHINANET-JS13
4VNPT-VNNIC-VN5
5TENCENT-CN5
6IPG4
7GO-DADDY-COM-LLC4
8CHINANET-GD4
9Baidu4
10NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK3

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China102
2United States44
3France26
4South Korea20
5Brazil14
6Russian Federation12
7Italy10
8Indonesia10
9India8
10Viet Nam7

Suspected Bot List [2018-07-18]

detection period: 2018-07-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 32

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Wednesday, July 18, 2018

Botnet Statistics [2018-07-17]

detection period: 2018-07-17 00:00-23:59 UTC
total number of suspected botnet IPs: 441
number of botnet IPs notified to network operators: 399
number of spam blocked: 31525
recipient count of spam blocked: 818353

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud16
2CHINANET-JS12
3KORNET-KR9
4CMNET7
5TENCENT-CN5
6HINET-NET5
7VNPT-VNNIC-VN4
8HO-24
9CHINANET-ZJ4
10CHINANET-JX4

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China98
2United States51
3France35
4India22
5Brazil20
6South Korea17
7Italy15
8Indonesia13
9Viet Nam12
10Russian Federation11

Suspected Bot List [2018-07-17]

detection period: 2018-07-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 42

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Tuesday, July 17, 2018

Botnet Statistics [2018-07-16]

detection period: 2018-07-16 00:00-23:59 UTC
total number of suspected botnet IPs: 401
number of botnet IPs notified to network operators: 371
number of spam blocked: 27989
recipient count of spam blocked: 793647

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1KORNET-KR14
2TencentCloud13
3CHINANET-JS10
4VNPT-VNNIC-VN5
5TENCENT-CN5
6CMNET5
7CHINANET-GD5
8002.558.157/0001-625
9GO-DADDY-COM-LLC4
10CO-ACSA-LACNIC4

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China106
2United States41
3South Korea24
4Brazil23
5India20
6France18
7Italy17
8Russian Federation13
9Colombia10
10Viet Nam8

Suspected Bot List [2018-07-16]

detection period: 2018-07-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 30

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
NL185.22.192.120Netherlands

List from greylisting:

Monday, July 16, 2018

Botnet Statistics [2018-07-15]

detection period: 2018-07-15 00:00-23:59 UTC
total number of suspected botnet IPs: 345
number of botnet IPs notified to network operators: 316
number of spam blocked: 25229
recipient count of spam blocked: 755623

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud11
2KORNET-KR11
3HINET-NET7
4CHINANET-JS7
5Baidu6
6CMNET5
7CHINANET-ZJ5
8TENCENT-CN4
9CHINANET-GD4
10BORANET-KR4

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China80
2United States37
3France23
4South Korea22
5Russian Federation20
6Brazil16
7India15
8Taiwan11
9Germany11
10Italy8

Suspected Bot List [2018-07-15]

detection period: 2018-07-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 29

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Sunday, July 15, 2018

Botnet Statistics [2018-07-14]

detection period: 2018-07-14 00:00-23:59 UTC
total number of suspected botnet IPs: 433
number of botnet IPs notified to network operators: 397
number of spam blocked: 28245
recipient count of spam blocked: 715980

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud16
2KORNET-KR8
3CHINANET-JS8
4Baidu6
5BT-INFRA6
6AT-88-Z6
7CABLE-15
8broadNnet-KR4
9HO-24
10HINET-NET4

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China75
2United States58
3France37
4South Korea19
5India19
6Italy17
7Brazil17
8Germany13
9Russian Federation12
10United Kingdom12

Suspected Bot List [2018-07-14]

detection period: 2018-07-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 39

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Saturday, July 14, 2018

Botnet Statistics [2018-07-13]

detection period: 2018-07-13 00:00-23:59 UTC
total number of suspected botnet IPs: 398
number of botnet IPs notified to network operators: 370
number of spam blocked: 24851
recipient count of spam blocked: 806101

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud20
2KORNET-KR11
3VNPT-VNNIC-VN8
4HO-27
5CHINANET-JS7
6AT-88-Z7
7TENCENT-CN6
8UNICOM-JS5
9CMNET5
10broadNnet-KR4

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China85
2United States51
3France32
4South Korea24
5India18
6Italy16
7Viet Nam15
8Russian Federation13
9United Kingdom11
10Canada11

Suspected Bot List [2018-07-13]

detection period: 2018-07-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 28

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
ZA197.149.160.59South Africa

List from greylisting:

Friday, July 13, 2018

Botnet Statistics [2018-07-12]

detection period: 2018-07-12 00:00-23:59 UTC
total number of suspected botnet IPs: 242
number of botnet IPs notified to network operators: 225
number of spam blocked: 26961
recipient count of spam blocked: 719256

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud11
2CHINANET-JS9
3KORNET-KR6
4CHINANET-GD5
5Baidu5
6CMNET4
7BSNLNET4
8VNPT-VNNIC-VN3
9UNICOM-JS3
10IUNET43

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China68
2United States31
3France16
4South Korea14
5Russian Federation8
6Viet Nam7
7Italy7
8Brazil7
9India6
10Colombia6

Suspected Bot List [2018-07-12]

detection period: 2018-07-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 17

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
VE190.202.116.101Venezuela
ZA197.149.160.59South Africa

List from greylisting:

Thursday, July 12, 2018

Botnet Statistics [2018-07-11]

detection period: 2018-07-11 00:00-23:59 UTC
total number of suspected botnet IPs: 343
number of botnet IPs notified to network operators: 315
number of spam blocked: 35659
recipient count of spam blocked: 835202

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud8
2KORNET-KR8
3CHINANET-GD8
4VNPT-VNNIC-VN7
5CHINANET-JS7
6CMNET6
7GO-DADDY-COM-LLC5
8MSFT4
9HO-24
10FR-OVH-201203204

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China85
2United States41
3France29
4South Korea21
5Brazil18
6Italy14
7Russian Federation12
8India12
9Indonesia12
10Viet Nam10

Suspected Bot List [2018-07-11]

detection period: 2018-07-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 28

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
VE190.202.116.101Venezuela

List from greylisting:

Wednesday, July 11, 2018

Botnet Statistics [2018-07-10]

detection period: 2018-07-10 00:00-23:59 UTC
total number of suspected botnet IPs: 466
number of botnet IPs notified to network operators: 431
number of spam blocked: 23612
recipient count of spam blocked: 663207

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud14
2KORNET-KR12
3VNPT-VNNIC-VN8
4CHINANET-JS7
5GO-DADDY-COM-LLC5
6DOPI15
7IUNET44
8FR-OVH-200609204
9CMNET4
10Baidu4

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China93
2United States51
3France39
4South Korea27
5Brazil24
6Viet Nam20
7Italy18
8India18
9United Kingdom16
10Indonesia15

Suspected Bot List [2018-07-10]

detection period: 2018-07-10 00:00-23:59 UTC
number of suspected bots' IPs listed here: 36

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
VE190.202.116.101Venezuela

List from greylisting:

Tuesday, July 10, 2018

Botnet Statistics [2018-07-09]

detection period: 2018-07-09 00:00-23:59 UTC
total number of suspected botnet IPs: 281
number of botnet IPs notified to network operators: 256
number of spam blocked: 25743
recipient count of spam blocked: 720844

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1KORNET-KR11
2TencentCloud8
3VNPT-VNNIC-VN5
4UNICOM-JS5
5HINET-NET4
6CHINANET-ZJ4
7SELECTEL-NET3
8IE-POOL-BUSINESS-HOSTING3
9FR-OVH-201208233
10FR-OVH-200609203

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China56
2United States29
3France24
4Russian Federation15
5South Korea15
6United Kingdom11
7Brazil11
8Germany9
9Canada8
10Taiwan7

Suspected Bot List [2018-07-09]

detection period: 2018-07-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 25

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
VE190.202.116.101Venezuela

List from greylisting:

Monday, July 9, 2018

Botnet Statistics [2018-07-08]

detection period: 2018-07-08 00:00-23:59 UTC
total number of suspected botnet IPs: 321
number of botnet IPs notified to network operators: 303
number of spam blocked: 26678
recipient count of spam blocked: 799267

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1CHINANET-JS11
2TencentCloud10
3KORNET-KR6
4EC-ANSA-LACNIC5
5HINET-TW4
6DOPI14
7CHINANET-JX4
8UNICOM-JS3
9MSFT3
10IPG3

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China81
2United States41
3France25
4South Korea17
5Russian Federation13
6Italy9
7India9
8Brazil9
9United Kingdom7
10Germany7

Suspected Bot List [2018-07-08]

detection period: 2018-07-08 00:00-23:59 UTC
number of suspected bots' IPs listed here: 18

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
VE190.202.116.101Venezuela

List from greylisting:

Sunday, July 8, 2018

Botnet Statistics [2018-07-07]

detection period: 2018-07-07 00:00-23:59 UTC
total number of suspected botnet IPs: 455
number of botnet IPs notified to network operators: 415
number of spam blocked: 29419
recipient count of spam blocked: 881121

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud13
2KORNET-KR9
3AT-88-Z7
4DOPI16
5CMNET6
6VNPT-VNNIC-VN5
7TENCENT-CN5
8FR-OVH5
9Baidu5
10BHARTI-IN5

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China83
2United States67
3France44
4India21
5South Korea20
6Brazil18
7Russian Federation14
8Italy14
9Viet Nam11
10United Kingdom9

Suspected Bot List [2018-07-07]

detection period: 2018-07-07 00:00-23:59 UTC
number of suspected bots' IPs listed here: 40

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
VE190.202.116.101Venezuela

List from greylisting:

Saturday, July 7, 2018

Botnet Statistics [2018-07-06]

detection period: 2018-07-06 00:00-23:59 UTC
total number of suspected botnet IPs: 382
number of botnet IPs notified to network operators: 345
number of spam blocked: 29547
recipient count of spam blocked: 859121

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud10
2KORNET-KR8
3VNPT-VNNIC-VN6
4CHINANET-JS6
5HINET-NET5
6DIGITALOCEAN-315
7CMNET5
8CHINANET-ZJ5
9Baidu5
10UNICOM-JS4

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China91
2United States56
3France32
4Brazil18
5South Korea17
6Russian Federation12
7Italy10
8India10
9Viet Nam9
10Colombia9

Suspected Bot List [2018-07-06]

detection period: 2018-07-06 00:00-23:59 UTC
number of suspected bots' IPs listed here: 37

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
VE190.202.116.101Venezuela

List from greylisting:

Friday, July 6, 2018

Botnet Statistics [2018-07-05]

detection period: 2018-07-05 00:00-23:59 UTC
total number of suspected botnet IPs: 449
number of botnet IPs notified to network operators: 411
number of spam blocked: 37849
recipient count of spam blocked: 904282

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1KORNET-KR18
2TencentCloud15
3CHINANET-GD8
4FR-OVH6
5CHINANET-JS6
6AT-88-Z6
7TENCENT-CN5
8GO-DADDY-COM-LLC5
9Baidu5
10broadNnet-KR4

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China99
2United States62
3South Korea32
4France30
5Brazil20
6Italy17
7India15
8Russian Federation12
9Indonesia11
10Viet Nam9

Suspected Bot List [2018-07-05]

detection period: 2018-07-05 00:00-23:59 UTC
number of suspected bots' IPs listed here: 38

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Thursday, July 5, 2018

Botnet Statistics [2018-07-04]

detection period: 2018-07-04 00:00-23:59 UTC
total number of suspected botnet IPs: 435
number of botnet IPs notified to network operators: 403
number of spam blocked: 37382
recipient count of spam blocked: 890823

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud13
2KORNET-KR8
3HINET-NET8
4CHINANET-JS8
5broadNnet-KR6
6AT-88-Z6
7CMNET5
8CHINANET-GD5
9MX-USCV4-LACNIC4
10KRNIC-KR4

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China83
2United States55
3France38
4South Korea24
5India22
6Russian Federation17
7Brazil16
8Italy14
9Taiwan11
10Viet Nam10

Suspected Bot List [2018-07-04]

detection period: 2018-07-04 00:00-23:59 UTC
number of suspected bots' IPs listed here: 32

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Wednesday, July 4, 2018

Botnet Statistics [2018-07-03]

detection period: 2018-07-03 00:00-23:59 UTC
total number of suspected botnet IPs: 508
number of botnet IPs notified to network operators: 467
number of spam blocked: 35262
recipient count of spam blocked: 824265

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1KORNET-KR20
2TencentCloud15
3CHINANET-JS11
4CHINANET-GD8
5MSFT6
6FR-OVH6
7VNPT-VNNIC-VN5
8UNICOM-BJ5
9HINET-NET5
10GO-DADDY-COM-LLC5

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China108
2United States63
3France47
4South Korea32
5India31
6Russian Federation17
7Indonesia16
8Brazil15
9Italy13
10Viet Nam12

Suspected Bot List [2018-07-03]

detection period: 2018-07-03 00:00-23:59 UTC
number of suspected bots' IPs listed here: 41

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:

Tuesday, July 3, 2018

Botnet Statistics [2018-07-02]

detection period: 2018-07-02 00:00-23:59 UTC
total number of suspected botnet IPs: 378
number of botnet IPs notified to network operators: 346
number of spam blocked: 31609
recipient count of spam blocked: 880483

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1KORNET-KR15
2TencentCloud12
3CHINANET-JS7
4BHARTI-IN7
5FR-OVH-200609206
6CHINANET-GD6
7CHINANET-ZJ5
8UNKNOWN4
9HINET-NET4
10DIGITALOCEAN-314

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China72
2United States53
3France34
4Russian Federation24
5South Korea23
6India19
7Brazil19
8United Kingdom11
9Italy10
10Viet Nam7

Suspected Bot List [2018-07-02]

detection period: 2018-07-02 00:00-23:59 UTC
number of suspected bots' IPs listed here: 32

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
FR92.154.96.85France
VE190.202.116.101Venezuela

List from greylisting:

Monday, July 2, 2018

Botnet Statistics [2018-07-01]

detection period: 2018-07-01 00:00-23:59 UTC
total number of suspected botnet IPs: 348
number of botnet IPs notified to network operators: 312
number of spam blocked: 42857
recipient count of spam blocked: 1102450

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud10
2CHINANET-JS8
3KORNET-KR7
4MSFT5
5FR-OVH5
6broadNnet-KR4
7CHINANET-GD4
8AT-88-Z4
9VNPT-VNNIC-VN3
10UNKNOWN3

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China71
2United States49
3France26
4South Korea22
5Brazil18
6India15
7Indonesia11
8Russian Federation10
9Italy10
10Germany10

Suspected Bot List [2018-07-01]

detection period: 2018-07-01 00:00-23:59 UTC
number of suspected bots' IPs listed here: 36

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
VE190.202.116.101Venezuela

List from greylisting:

Sunday, July 1, 2018

Suspected Bots' IP List for May 2018

To encourage cyber security information sharing (as some form of open data) while still giving victims enough time to clean up their computers, the IP list of suspected infected computers will be released here (as shown below). You are free to use them to create more effective defenses, discover latest trends in cyber attacks, etc.

Suspected Bots IP [2018-05-01]
Suspected Bots IP [2018-05-02]
Suspected Bots IP [2018-05-03]
Suspected Bots IP [2018-05-04]
Suspected Bots IP [2018-05-05]
Suspected Bots IP [2018-05-06]
Suspected Bots IP [2018-05-07]
Suspected Bots IP [2018-05-08]
Suspected Bots IP [2018-05-09]
Suspected Bots IP [2018-05-10]
Suspected Bots IP [2018-05-11]
Suspected Bots IP [2018-05-12]
Suspected Bots IP [2018-05-13]
Suspected Bots IP [2018-05-14]
Suspected Bots IP [2018-05-15]
Suspected Bots IP [2018-05-16]
Suspected Bots IP [2018-05-17]
Suspected Bots IP [2018-05-18]
Suspected Bots IP [2018-05-19]
Suspected Bots IP [2018-05-20]
Suspected Bots IP [2018-05-21]
Suspected Bots IP [2018-05-22]
Suspected Bots IP [2018-05-23]
Suspected Bots IP [2018-05-24]
Suspected Bots IP [2018-05-25]
Suspected Bots IP [2018-05-26]
Suspected Bots IP [2018-05-27]
Suspected Bots IP [2018-05-28]
Suspected Bots IP [2018-05-29]
Suspected Bots IP [2018-05-30]
Suspected Bots IP [2018-05-31]

Botnet Statistics [2018-06-30]

detection period: 2018-06-30 00:00-23:59 UTC
total number of suspected botnet IPs: 566
number of botnet IPs notified to network operators: 518
number of spam blocked: 29661
recipient count of spam blocked: 840350

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1KORNET-KR15
2TencentCloud12
3CHINANET-JS9
4CMNET8
5CHINANET-GD7
6AT-88-Z7
7VNPT-VNNIC-VN6
8OVH6
9GO-DADDY-COM-LLC6
10FR-OVH-200609206

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China105
2United States95
3France46
4South Korea33
5India30
6Brazil19
7Russian Federation16
8Germany16
9Indonesia15
10Viet Nam14

Suspected Bot List [2018-06-30]

detection period: 2018-06-30 00:00-23:59 UTC
number of suspected bots' IPs listed here: 50

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
VE190.202.116.101Venezuela

List from greylisting: