Botnet Statistics [2019-12-30]

detection period: 2019-12-30 00:00-23:59 UTC
total number of suspected botnet IPs: 22169
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21204
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	733
2	VNPT-VN	599
3	Baidu	594
4	TENCENT-CN	541
5	HINET-NET	419
6	KORNET	399
7	VIETTEL-VN	365
8	TELKOMNET	321
9	CHINANET-JS	261
10	02.558.157/0001-62	230

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4944
2	United States	2109
3	Viet Nam	1435
4	India	1171
5	Russian Federation	1051
6	Brazil	876
7	Indonesia	845
8	France	785
9	South Korea	591
10	Taiwan	572

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	47189
2	22	42174
3	3022	36144
4	6678	35301
5	23	32410
6	222	24825
7	8080	20998
8	3389	14323
9	2227	14087
10	5901	14039

Suspected Bot List [2019-12-30]

detection period: 2019-12-30 00:00-23:59 UTC
number of suspected bots' IPs listed here: 965

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-29]

detection period: 2019-12-29 00:00-23:59 UTC
total number of suspected botnet IPs: 20265
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19399
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	730
2	Baidu	600
3	TENCENT-CN	539
4	KORNET	391
5	HINET-NET	383
6	VNPT-VN	378
7	VIETTEL-VN	294
8	CHINANET-JS	247
9	CMNET	227
10	DO-13	216

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4774
2	United States	2283
3	Viet Nam	1030
4	Russian Federation	889
5	France	810
6	India	761
7	Brazil	710
8	Indonesia	587
9	South Korea	571
10	Taiwan	536

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	50446
2	6678	34618
3	445	27211
4	222	25503
5	23	21986
6	10000	19943
7	3389	18923
8	2227	18454
9	2222	15711
10	9022	13695

Suspected Bot List [2019-12-29]

detection period: 2019-12-29 00:00-23:59 UTC
number of suspected bots' IPs listed here: 866

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-28]

detection period: 2019-12-28 00:00-23:59 UTC
total number of suspected botnet IPs: 20405
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19558
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	725
2	Baidu	610
3	TENCENT-CN	537
4	VNPT-VN	465
5	KORNET	378
6	VIETTEL-VN	334
7	HINET-NET	302
8	CHINANET-JS	249
9	TELKOMNET	215
10	MX-MTSC2-LACNIC	212

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4587
2	United States	2379
3	Viet Nam	1209
4	India	968
5	Russian Federation	955
6	France	768
7	Brazil	760
8	Indonesia	635
9	South Korea	553
10	Mexico	498

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	46255
2	445	31235
3	222	26124
4	3389	19620
5	23	17827
6	9022	12009
7	2382	10937
8	2222	10604
9	8080	10041
10	2837	9597

Suspected Bot List [2019-12-28]

detection period: 2019-12-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 847

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-27]

detection period: 2019-12-27 00:00-23:59 UTC
total number of suspected botnet IPs: 21723
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20832
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	739
2	TencentCloud	734
3	Baidu	613
4	TENCENT-CN	546
5	VIETTEL-VN	440
6	KORNET	356
7	HINET-NET	318
8	CHINANET-JS	273
9	TELKOMNET	263
10	02.558.157/0001-62	219

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4690
2	United States	2353
3	Viet Nam	1662
4	India	1142
5	Russian Federation	1040
6	Brazil	853
7	France	828
8	Indonesia	816
9	South Korea	520
10	Mexico	435

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	45175
2	22	34887
3	6053	34385
4	222	24785
5	5922	21768
6	23	18599
7	3389	15358
8	9022	10263
9	2222	10139
10	1046	9956

Suspected Bot List [2019-12-27]

detection period: 2019-12-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 891

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-26]

detection period: 2019-12-26 00:00-23:59 UTC
total number of suspected botnet IPs: 20897
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19993
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	749
2	Baidu	623
3	VNPT-VN	607
4	TENCENT-CN	545
5	VIETTEL-VN	377
6	KORNET	334
7	TELKOMNET	286
8	HINET-NET	262
9	CHINANET-JS	235
10	DO-13	216

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4656
2	United States	2170
3	Viet Nam	1428
4	India	1080
5	Russian Federation	1047
6	Indonesia	837
7	France	829
8	Brazil	829
9	South Korea	500
10	Mexico	463

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	48068
2	22	35413
3	6053	29909
4	5922	23544
5	222	20118
6	23	16483
7	9022	10937
8	2382	9280
9	5900	9171
10	1046	9153

Suspected Bot List [2019-12-26]

detection period: 2019-12-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 904

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-25]

detection period: 2019-12-25 00:00-23:59 UTC
total number of suspected botnet IPs: 20141
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19338
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	752
2	Baidu	626
3	VNPT-VN	616
4	TENCENT-CN	556
5	VIETTEL-VN	392
6	KORNET	371
7	HINET-NET	259
8	CHINANET-JS	241
9	MX-MTSC2-LACNIC	231
10	DO-13	212

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4642
2	United States	2163
3	Viet Nam	1469
4	Russian Federation	1044
5	India	930
6	France	824
7	Brazil	705
8	Indonesia	594
9	South Korea	544
10	Mexico	443

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	39989
2	445	30792
3	23	18346
4	222	15631
5	9000	11319
6	3389	11288
7	9022	11031
8	2356	9640
9	1433	9379
10	22345	9318

Suspected Bot List [2019-12-25]

detection period: 2019-12-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 803

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-24]

detection period: 2019-12-24 00:00-23:59 UTC
total number of suspected botnet IPs: 21256
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20328
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	744
2	Baidu	643
3	VNPT-VN	620
4	TENCENT-CN	570
5	KORNET	411
6	VIETTEL-VN	377
7	CHINANET-JS	263
8	TELKOMNET	251
9	HINET-NET	243
10	MX-MTSC2-LACNIC	228

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4768
2	United States	2191
3	Viet Nam	1461
4	India	1119
5	Russian Federation	1090
6	France	848
7	Brazil	785
8	Indonesia	710
9	South Korea	587
10	Mexico	521

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	37188
2	445	36290
3	222	24372
4	23	14957
5	3389	13540
6	9000	12498
7	9022	12484
8	8922	12481
9	12322	10953
10	2382	10683

Suspected Bot List [2019-12-24]

detection period: 2019-12-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 928

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-23]

detection period: 2019-12-23 00:00-23:59 UTC
total number of suspected botnet IPs: 24861
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 23761
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	834
2	TencentCloud	760
3	Baidu	623
4	TENCENT-CN	561
5	VIETTEL-VN	544
6	KORNET	519
7	TELKOMNET	368
8	HINET-NET	306
9	CHINANET-JS	269
10	02.558.157/0001-62	252

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5018
2	United States	2370
3	Viet Nam	1929
4	India	1409
5	Russian Federation	1350
6	Indonesia	1011
7	Brazil	1006
8	France	947
9	South Korea	711
10	Thailand	556

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	63971
2	3022	52217
3	445	48202
4	222	30225
5	2226	26318
6	1433	25666
7	9000	22736
8	3389	19141
9	29418	18934
10	23	17727

Suspected Bot List [2019-12-23]

detection period: 2019-12-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1100

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-22]

detection period: 2019-12-22 00:00-23:59 UTC
total number of suspected botnet IPs: 16648
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15869
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	351
2	VIETTEL-VN	346
3	HINET-NET	311
4	Baidu	298
5	KORNET	273
6	TELKOMNET	220
7	TencentCloud	217
8	02.558.157/0001-62	208
9	CHINANET-JS	207
10	DIGITALOCEAN-12	187

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	2838
2	United States	1608
3	Russian Federation	1145
4	Viet Nam	1087
5	India	775
6	Brazil	751
7	Indonesia	642
8	France	588
9	South Korea	423
10	Taiwan	404

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	1044730
2	7070	494310
3	22	87499
4	445	39205
5	2225	30111
6	222	27973
7	1433	25495
8	9000	23860
9	2222	21239
10	3389	18750

Suspected Bot List [2019-12-22]

detection period: 2019-12-22 00:00-23:59 UTC
number of suspected bots' IPs listed here: 779

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-21]

detection period: 2019-12-21 00:00-23:59 UTC
total number of suspected botnet IPs: 17781
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16896
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	582
2	VIETTEL-VN	365
3	HINET-NET	315
4	TELKOMNET	281
5	KORNET	279
6	Baidu	260
7	TencentCloud	240
8	CHINANET-JS	225
9	DIGITALOCEAN-12	205
10	02.558.157/0001-62	195

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	2843
2	United States	1614
3	Viet Nam	1385
4	Russian Federation	1132
5	India	1129
6	Brazil	805
7	Indonesia	785
8	France	573
9	Taiwan	421
10	South Korea	408

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	3042658
2	7070	1014891
3	22	71997
4	445	52945
5	5151	43895
6	1433	24630
7	9000	24420
8	2225	24411
9	222	19029
10	3389	18744

Suspected Bot List [2019-12-21]

detection period: 2019-12-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 885

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-20]

detection period: 2019-12-20 00:00-23:59 UTC
total number of suspected botnet IPs: 18304
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17449
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	805
2	VIETTEL-VN	460
3	TELKOMNET	355
4	HINET-NET	298
5	KORNET	291
6	Baidu	260
7	TencentCloud	246
8	VE-CSVE-LACNIC	223
9	02.558.157/0001-62	219
10	CHINANET-JS	197

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	2715
2	Viet Nam	1744
3	United States	1628
4	Russian Federation	1168
5	India	1133
6	Indonesia	930
7	Brazil	835
8	France	554
9	Thailand	447
10	South Korea	428

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22445	720662
2	5038	95469
3	22	67719
4	445	66153
5	9000	23524
6	1433	22595
7	5151	20571
8	7070	19845
9	3389	19723
10	5000	19722

Suspected Bot List [2019-12-20]

detection period: 2019-12-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 855

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-19]

detection period: 2019-12-19 00:00-23:59 UTC
total number of suspected botnet IPs: 13128
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 12582
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	275
2	KORNET	261
3	Baidu	257
4	CHINANET-JS	223
5	TencentCloud	210
6	DIGITALOCEAN-12	195
7	VIETTEL-VN	186
8	CMNET	171
9	TENCENT-CN	164
10	TELKOMNET	151

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	2726
2	United States	1559
3	India	768
4	Viet Nam	725
5	Russian Federation	555
6	France	540
7	Indonesia	455
8	Brazil	440
9	South Korea	380
10	Singapore	282

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	7070	508862
2	5038	231924
3	5000	107375
4	445	74290
5	8000	70937
6	22	64274
7	22445	30322
8	3389	27451
9	1433	24215
10	9000	23076

Suspected Bot List [2019-12-19]

detection period: 2019-12-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 546

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-18]

detection period: 2019-12-18 00:00-23:59 UTC
total number of suspected botnet IPs: 15247
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14560
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	498
2	VIETTEL-VN	293
3	TencentCloud	289
4	Baidu	274
5	TELKOMNET	255
6	KORNET	249
7	CHINANET-JS	204
8	TENCENT-CN	198
9	DIGITALOCEAN-12	197
10	02.558.157/0001-62	195

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	2767
2	United States	1710
3	Viet Nam	1135
4	India	931
5	Russian Federation	793
6	Indonesia	731
7	Brazil	669
8	France	562
9	South Korea	364
10	Thailand	313

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	2964244
2	7070	69185
3	22	62088
4	445	54880
5	1433	24257
6	3389	21071
7	9000	19076
8	222	18216
9	2022	16840
10	23	13543

Suspected Bot List [2019-12-18]

detection period: 2019-12-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 687

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-17]

detection period: 2019-12-17 00:00-23:59 UTC
total number of suspected botnet IPs: 18657
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17786
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	647
2	TencentCloud	442
3	VIETTEL-VN	366
4	TELKOMNET	328
5	TENCENT-CN	323
6	Baidu	304
7	KORNET	288
8	HINET-NET	247
9	CHINANET-JS	243
10	CMNET	198

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3388
2	United States	1926
3	Viet Nam	1406
4	India	1116
5	Russian Federation	1103
6	Indonesia	864
7	Brazil	826
8	France	642
9	South Korea	428
10	Thailand	417

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	74990
2	445	60888
3	1433	28423
4	222	27770
5	3389	19757
6	2222	17727
7	9000	15794
8	22222	15211
9	23	14251
10	9099	13306

Suspected Bot List [2019-12-17]

detection period: 2019-12-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 871

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-16]

detection period: 2019-12-16 00:00-23:59 UTC
total number of suspected botnet IPs: 15098
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14456
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	444
2	VNPT-VN	383
3	TENCENT-CN	304
4	KORNET	301
5	Baidu	297
6	VIETTEL-VN	249
7	CHINANET-JS	215
8	TELKOMNET	213
9	DIGITALOCEAN-12	192
10	HINET-NET	191

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3276
2	United States	1627
3	Viet Nam	873
4	India	778
5	Russian Federation	746
6	France	617
7	Brazil	563
8	Indonesia	561
9	South Korea	439
10	Singapore	318

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	77367
2	445	71434
3	1433	28218
4	222	26148
5	2221	21141
6	2022	18584
7	23	15511
8	2222	15000
9	22222	14050
10	3022	13810

Suspected Bot List [2019-12-16]

detection period: 2019-12-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 642

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-15]

detection period: 2019-12-15 00:00-23:59 UTC
total number of suspected botnet IPs: 15850
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15148
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	394
2	VNPT-VN	348
3	TENCENT-CN	295
4	VIETTEL-VN	274
5	KORNET	274
6	Baidu	264
7	HINET-NET	238
8	TELKOMNET	225
9	CHINANET-JS	206
10	DIGITALOCEAN-12	194

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3027
2	United States	1647
3	Russian Federation	1014
4	Viet Nam	907
5	India	741
6	Brazil	714
7	Indonesia	613
8	France	608
9	South Korea	397
10	Taiwan	329

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	6600	368627
2	22	73437
3	5038	34437
4	8999	33194
5	445	27690
6	1433	27061
7	222	23140
8	2222	15033
9	5900	14973
10	3389	14372

Suspected Bot List [2019-12-15]

detection period: 2019-12-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 702

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-14]

detection period: 2019-12-14 00:00-23:59 UTC
total number of suspected botnet IPs: 18483
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17613
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	559
2	TencentCloud	445
3	VIETTEL-VN	323
4	Baidu	323
5	TENCENT-CN	322
6	KORNET	311
7	HINET-NET	286
8	TELKOMNET	261
9	02.558.157/0001-62	244
10	CHINANET-JS	230

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3539
2	United States	1847
3	Viet Nam	1270
4	Russian Federation	1058
5	India	1055
6	Brazil	841
7	Indonesia	739
8	France	628
9	South Korea	463
10	Taiwan	385

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	6600	144913
2	22	84754
3	445	47705
4	1433	30777
5	222	27927
6	2222	19650
7	22222	17212
8	22322	16985
9	23	15248
10	3389	14722

Suspected Bot List [2019-12-14]

detection period: 2019-12-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 870

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-13]

detection period: 2019-12-13 00:00-23:59 UTC
total number of suspected botnet IPs: 17929
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17125
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	554
2	TencentCloud	425
3	TENCENT-CN	353
4	VIETTEL-VN	324
5	Baidu	312
6	KORNET	308
7	TELKOMNET	291
8	HINET-NET	275
9	CHINANET-JS	229
10	DIGITALOCEAN-12	199

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3457
2	United States	1893
3	Viet Nam	1257
4	India	1121
5	Russian Federation	977
6	Indonesia	800
7	Brazil	751
8	France	635
9	South Korea	447
10	Thailand	391

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	89868
2	22322	61234
3	445	52489
4	222	32697
5	1433	30177
6	2222	22377
7	3389	18351
8	23	17800
9	22222	17240
10	822	16277

Suspected Bot List [2019-12-13]

detection period: 2019-12-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 804

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-12]

detection period: 2019-12-12 00:00-23:59 UTC
total number of suspected botnet IPs: 20965
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20077
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	674
2	TencentCloud	506
3	Baidu	382
4	VIETTEL-VN	361
5	TENCENT-CN	360
6	KORNET	356
7	HINET-NET	352
8	TELKOMNET	348
9	CHINANET-JS	258
10	02.558.157/0001-62	219

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4061
2	United States	1956
3	Viet Nam	1506
4	India	1234
5	Russian Federation	1214
6	Indonesia	946
7	Brazil	911
8	France	734
9	South Korea	535
10	Taiwan	429

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	101289
2	22322	65270
3	445	63120
4	222	42907
5	1433	40646
6	23	25951
7	2222	22615
8	822	21702
9	3389	20960
10	22222	16988

Suspected Bot List [2019-12-12]

detection period: 2019-12-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 888

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-11]

detection period: 2019-12-11 00:00-23:59 UTC
total number of suspected botnet IPs: 22694
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21664
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	766
2	TencentCloud	538
3	VIETTEL-VN	459
4	Baidu	398
5	TENCENT-CN	386
6	HINET-NET	383
7	TELKOMNET	372
8	KORNET	360
9	02.558.157/0001-62	266
10	CHINANET-JS	249

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4137
2	United States	2057
3	Viet Nam	1724
4	India	1499
5	Russian Federation	1214
6	Brazil	1138
7	Indonesia	965
8	France	730
9	South Korea	555
10	Taiwan	491

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	110833
2	445	100743
3	22322	65432
4	222	49747
5	5038	41391
6	1433	32022
7	22222	29733
8	3389	28790
9	2222	25011
10	23	24592

Suspected Bot List [2019-12-11]

detection period: 2019-12-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1030

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-10]

detection period: 2019-12-10 00:00-23:59 UTC
total number of suspected botnet IPs: 24572
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 23469
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	910
2	TencentCloud	535
3	VIETTEL-VN	524
4	TELKOMNET	474
5	Baidu	429
6	TENCENT-CN	420
7	KORNET	394
8	HINET-NET	357
9	CHINANET-JS	290
10	02.558.157/0001-62	285

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4230
2	United States	2071
3	Viet Nam	2031
4	India	1570
5	Russian Federation	1404
6	Brazil	1266
7	Indonesia	1197
8	France	793
9	South Korea	585
10	Thailand	476

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	999	156463
2	22	122675
3	445	72160
4	22322	67721
5	222	64131
6	22220	48782
7	1433	36092
8	3389	29845
9	2222	28744
10	3030	28202

Suspected Bot List [2019-12-10]

detection period: 2019-12-10 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1103

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-09]

detection period: 2019-12-09 00:00-23:59 UTC
total number of suspected botnet IPs: 26501
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 25389
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	1036
2	VIETTEL-VN	593
3	TencentCloud	556
4	TELKOMNET	499
5	KORNET	452
6	TENCENT-CN	424
7	Baidu	418
8	HINET-NET	369
9	02.558.157/0001-62	287
10	CHINANET-JS	271

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4472
2	Viet Nam	2269
3	United States	2230
4	India	1688
5	Russian Federation	1502
6	Brazil	1430
7	Indonesia	1264
8	France	811
9	South Korea	669
10	Thailand	667

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	999	648671
2	22	128395
3	445	105924
4	22322	94904
5	222	79938
6	110	44003
7	1433	36018
8	3389	33309
9	23	31056
10	2222	28636

Suspected Bot List [2019-12-09]

detection period: 2019-12-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1112

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-12-08]

detection period: 2019-12-08 00:00-23:59 UTC
total number of suspected botnet IPs: 24732
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 23672
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	614
2	TencentCloud	595
3	TENCENT-CN	458
4	KORNET	448
5	Baidu	441
6	VIETTEL-VN	395
7	HINET-NET	394
8	TELKOMNET	339
9	CHINANET-JS	288
10	02.558.157/0001-62	284

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4751
2	United States	2168
3	Russian Federation	1529
4	Viet Nam	1468
5	Brazil	1398
6	India	1215
7	Indonesia	890
8	France	818
9	South Korea	645
10	Thailand	542

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	999	686229
2	22	137712
3	222	79208
4	445	52458
5	5038	39130
6	23	32301
7	3389	31465
8	1433	30374
9	2222	28088
10	5900	20470