Botnet Statistics [2019-09-29]

detection period: 2019-09-29 00:00-23:59 UTC
total number of suspected botnet IPs: 14153
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 13533
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TENCENT-CN	499
2	TencentCloud	465
3	Baidu	449
4	HINET-NET	366
5	KORNET	287
6	DO-13	232
7	DIGITALOCEAN-12	213
8	OVH	177
9	CMNET	146
10	VNPT-VN	140

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3483
2	United States	1851
3	France	826
4	Russian Federation	584
5	Brazil	504
6	South Korea	472
7	Taiwan	434
8	India	419
9	Viet Nam	416
10	Indonesia	301

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	3389	23962
2	22	20829
3	445	19470
4	23	16044
5	222	10273
6	7070	9921
7	7071	6975
8	954	6720
9	149	6683
10	8080	6576

Suspected Bot List [2019-09-29]

detection period: 2019-09-29 00:00-23:59 UTC
number of suspected bots' IPs listed here: 620

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-09-28]

detection period: 2019-09-28 00:00-23:59 UTC
total number of suspected botnet IPs: 14450
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 13824
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TENCENT-CN	499
2	TencentCloud	471
3	Baidu	453
4	HINET-NET	367
5	KORNET	289
6	DO-13	230
7	DIGITALOCEAN-12	208
8	VNPT-VN	205
9	OVH	181
10	CMNET	154

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3420
2	United States	1821
3	France	832
4	Russian Federation	587
5	Brazil	548
6	India	514
7	Viet Nam	513
8	South Korea	470
9	Taiwan	436
10	Indonesia	312

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	17753
2	23	16526
3	445	14122
4	3389	10170
5	102	8611
6	1433	7464
7	5522	6893
8	6622	6148
9	8080	5383
10	725	5222

Suspected Bot List [2019-09-28]

detection period: 2019-09-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 626

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
NG	41.203.76.251	Nigeria
ZA	102.165.35.137	South Africa

List from TCP port scans:

Botnet Statistics [2019-09-27]

detection period: 2019-09-27 00:00-23:59 UTC
total number of suspected botnet IPs: 14966
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14227
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TENCENT-CN	506
2	TencentCloud	475
3	Baidu	458
4	KORNET	301
5	DO-13	247
6	HINET-NET	241
7	VNPT-VN	224
8	DIGITALOCEAN-12	198
9	VIETTEL-VN	175
10	OVH	174

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3437
2	United States	1855
3	France	842
4	Russian Federation	635
5	Viet Nam	602
6	Brazil	571
7	India	552
8	South Korea	493
9	Indonesia	401
10	Taiwan	296

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	18641
2	445	15430
3	23	13857
4	3389	11786
5	2200	7621
6	7070	6882
7	1122	6513
8	1433	6467
9	2222	6355
10	725	6049

Suspected Bot List [2019-09-27]

detection period: 2019-09-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 739

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-09-26]

detection period: 2019-09-26 00:00-23:59 UTC
total number of suspected botnet IPs: 15542
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14770
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TENCENT-CN	514
2	TencentCloud	480
3	Baidu	453
4	KORNET	287
5	VNPT-VN	252
6	HINET-NET	247
7	DO-13	241
8	DIGITALOCEAN-12	218
9	CMNET	180
10	VIETTEL-VN	173

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3566
2	United States	1954
3	France	796
4	Brazil	672
5	Russian Federation	669
6	Viet Nam	637
7	India	531
8	South Korea	478
9	Indonesia	441
10	Taiwan	314

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	23182
2	1433	20598
3	23	17107
4	22	12117
5	221	10662
6	7070	9395
7	5038	9201
8	2200	8775
9	5900	7539
10	5000	7503

Suspected Bot List [2019-09-26]

detection period: 2019-09-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 772

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
NG	41.203.76.251	Nigeria
NL	185.244.25.205	Netherlands

List from TCP port scans:

Botnet Statistics [2019-09-25]

detection period: 2019-09-25 00:00-23:59 UTC
total number of suspected botnet IPs: 15005
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14211
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	433
2	TENCENT-CN	430
3	Baidu	429
4	KORNET	283
5	VNPT-VN	262
6	HINET-NET	257
7	DIGITALOCEAN-12	204
8	DO-13	200
9	OVH	170
10	CMNET	167

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3373
2	United States	2023
3	France	746
4	Russian Federation	634
5	Viet Nam	628
6	Brazil	550
7	India	510
8	South Korea	465
9	Indonesia	424
10	Taiwan	320

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	27474
2	23	15870
3	22	15628
4	5900	10374
5	5038	9625
6	8022	7647
7	1433	6695
8	3389	6379
9	2200	6099
10	7070	5666

Suspected Bot List [2019-09-25]

detection period: 2019-09-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 794

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
EG	41.32.37.250	Egypt
NL	185.244.25.190	Netherlands
NL	185.244.25.205	Netherlands
ZA	156.38.214.154	South Africa

List from TCP port scans:

Botnet Statistics [2019-09-24]

detection period: 2019-09-24 00:00-23:59 UTC
total number of suspected botnet IPs: 15332
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14532
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	Baidu	445
2	TENCENT-CN	433
3	TencentCloud	415
4	DO-13	296
5	KORNET	284
6	HINET-NET	283
7	VNPT-VN	233
8	DIGITALOCEAN-12	207
9	AT-88-Z	192
10	OVH	175

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3412
2	United States	2248
3	France	796
4	Brazil	621
5	Viet Nam	601
6	India	593
7	Russian Federation	573
8	South Korea	482
9	Indonesia	404
10	Taiwan	346

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1433	23404
2	445	21966
3	22	21194
4	23	14164
5	3389	12455
6	5900	9013
7	8080	6044
8	700	5804
9	1821	5651
10	2022	5581

Suspected Bot List [2019-09-24]

detection period: 2019-09-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 800

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
NL	185.244.25.205	Netherlands
ZA	102.165.35.137	South Africa

List from TCP port scans:

Botnet Statistics [2019-09-23]

detection period: 2019-09-23 00:00-23:59 UTC
total number of suspected botnet IPs: 15584
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14672
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	Baidu	448
2	TENCENT-CN	440
3	TencentCloud	412
4	DO-13	331
5	KORNET	305
6	HINET-NET	291
7	VNPT-VN	247
8	DIGITALOCEAN-12	220
9	OVH	181
10	CMNET	167

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3451
2	United States	2272
3	France	803
4	Russian Federation	617
5	Brazil	613
6	Viet Nam	599
7	India	545
8	South Korea	503
9	Indonesia	424
10	Taiwan	352

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	21956
2	22	16597
3	23	13288
4	22122	9983
5	5900	9085
6	3389	7057
7	8080	6147
8	25	5901
9	2022	5521
10	724	4992

Suspected Bot List [2019-09-23]

detection period: 2019-09-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 912

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
IT	37.130.156.36	Italy

List from TCP port scans:

Botnet Statistics [2019-09-22]

detection period: 2019-09-22 00:00-23:59 UTC
total number of suspected botnet IPs: 15380
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14623
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	Baidu	451
2	TENCENT-CN	448
3	TencentCloud	425
4	DO-13	403
5	KORNET	312
6	HINET-NET	283
7	DIGITALOCEAN-12	221
8	VNPT-VN	195
9	OVH	189
10	AFRINIC-042005	160

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3318
2	United States	2411
3	France	876
4	Russian Federation	647
5	Brazil	586
6	South Korea	527
7	Viet Nam	502
8	India	441
9	Taiwan	349
10	Singapore	332

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	21889
2	445	18673
3	23	13860
4	5900	7547
5	222	7175
6	913	5100
7	937	4942
8	2563	4939
9	2022	4902
10	8080	4838

Suspected Bot List [2019-09-22]

detection period: 2019-09-22 00:00-23:59 UTC
number of suspected bots' IPs listed here: 757

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
NL	185.244.25.205	Netherlands
ZA	155.93.250.199	South Africa

List from TCP port scans:

Botnet Statistics [2019-09-21]

detection period: 2019-09-21 00:00-23:59 UTC
total number of suspected botnet IPs: 16813
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16053
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	Baidu	460
2	TENCENT-CN	442
3	TencentCloud	433
4	DO-13	384
5	KORNET	338
6	HINET-NET	275
7	DIGITALOCEAN-12	218
8	VNPT-VN	198
9	OVH	179
10	CMNET	161

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3428
2	United States	2333
3	France	860
4	Russian Federation	633
5	Brazil	596
6	India	548
7	South Korea	535
8	Viet Nam	513
9	Indonesia	352
10	Taiwan	336

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	23147
2	22	17489
3	23	13612
4	5900	7625
5	2020	6241
6	2022	5617
7	674	5207
8	147	5002
9	700	4865
10	8080	4843

Suspected Bot List [2019-09-21]

detection period: 2019-09-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 816

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
EG	156.222.61.72	Egypt
MU	197.227.103.183	Mauritius

List from TCP port scans:

Botnet Statistics [2019-09-20]

detection period: 2019-09-20 00:00-23:59 UTC
total number of suspected botnet IPs: 16813
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16053
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	Baidu	469
2	TENCENT-CN	446
3	TencentCloud	441
4	DO-13	410
5	KORNET	344
6	HINET-NET	311
7	VNPT-VN	254
8	DIGITALOCEAN-12	209
9	OVH	192
10	02.558.157/0001-62	172

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3486
2	United States	2534
3	France	906
4	Brazil	690
5	Russian Federation	673
6	India	616
7	Viet Nam	608
8	South Korea	560
9	Indonesia	398
10	Taiwan	387

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	18955
2	23	14561
3	445	12968
4	2222	11326
5	5900	8236
6	8022	7933
7	3002	5948
8	8080	5823
9	2022	5211
10	6379	5149

Suspected Bot List [2019-09-20]

detection period: 2019-09-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 760

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
MU	105.21.33.2	Mauritius
MX	189.243.148.7	Mexico
NL	185.244.25.171	Netherlands
NL	185.244.25.205	Netherlands
SN	154.125.172.255	Senegal

List from TCP port scans:

Botnet Statistics [2019-09-19]

detection period: 2019-09-19 00:00-23:59 UTC
total number of suspected botnet IPs: 18184
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17390
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	DO-13	478
2	Baidu	463
3	TENCENT-CN	448
4	TencentCloud	432
5	KORNET	346
6	HINET-NET	337
7	VNPT-VN	265
8	DIGITALOCEAN-12	217
9	VIETTEL-VN	195
10	OVH	192

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3734
2	United States	2861
3	France	943
4	Brazil	747
5	Russian Federation	730
6	India	709
7	Viet Nam	685
8	South Korea	575
9	Indonesia	455
10	Taiwan	399

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	18579
2	22	16641
3	23	15724
4	6379	10471
5	5000	8688
6	3002	8659
7	7070	8603
8	8000	8262
9	5900	8043
10	22222	6466

Suspected Bot List [2019-09-19]

detection period: 2019-09-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 794

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
DE	116.203.218.159	Germany
ES	81.42.219.153	Spain
MU	105.21.33.2	Mauritius

List from TCP port scans:

Botnet Statistics [2019-09-18]

detection period: 2019-09-18 00:00-23:59 UTC
total number of suspected botnet IPs: 15627
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14905
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	Baidu	425
2	DO-13	409
3	HINET-NET	301
4	TENCENT-CN	300
5	TencentCloud	291
6	KORNET	288
7	VNPT-VN	262
8	DIGITALOCEAN-12	219
9	OVH	179
10	TELKOMNET	152

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3217
2	United States	2434
3	France	773
4	Russian Federation	650
5	India	642
6	Viet Nam	622
7	Brazil	599
8	South Korea	481
9	Indonesia	471
10	Taiwan	350

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	24010
2	22	18720
3	23	16953
4	5038	12480
5	6379	9962
6	5900	8350
7	3002	7875
8	1122	5934
9	8080	5264
10	729	5237

Suspected Bot List [2019-09-18]

detection period: 2019-09-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 722

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
ES	83.44.249.18	Spain
NL	185.244.25.171	Netherlands

List from TCP port scans:

Botnet Statistics [2019-09-17]

detection period: 2019-09-17 00:00-23:59 UTC
total number of suspected botnet IPs: 15752
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15006
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	DO-13	419
2	Baidu	416
3	TENCENT-CN	310
4	KORNET	302
5	TencentCloud	292
6	HINET-NET	267
7	VNPT-VN	248
8	DIGITALOCEAN-12	211
9	CHINANET-GD	172
10	OVH	169

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3458
2	United States	2458
3	France	743
4	Russian Federation	644
5	India	614
6	Brazil	585
7	Viet Nam	567
8	South Korea	503
9	Indonesia	472
10	Taiwan	330

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	25998
2	5000	23511
3	7070	23507
4	8000	23248
5	22	23190
6	7000	20605
7	445	16543
8	23	16257
9	22222	12659
10	5900	6619

Suspected Bot List [2019-09-17]

detection period: 2019-09-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 746

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
ZA	102.165.35.4	South Africa
ZA	169.0.226.142	South Africa

List from TCP port scans:

Botnet Statistics [2019-09-16]

detection period: 2019-09-16 00:00-23:59 UTC
total number of suspected botnet IPs: 15985
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15304
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	DO-13	447
2	Baidu	428
3	TENCENT-CN	304
4	KORNET	298
5	HINET-NET	296
6	TencentCloud	291
7	DIGITALOCEAN-12	246
8	VNPT-VN	212
9	OVH	169
10	CMNET	169

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3536
2	United States	2588
3	France	797
4	Russian Federation	645
5	Brazil	608
6	India	567
7	Viet Nam	531
8	South Korea	504
9	Indonesia	416
10	Taiwan	347

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	23643
2	23	19708
3	22	19266
4	2126	5802
5	2022	5763
6	149	5406
7	2200	5248
8	8080	5210
9	420	5178
10	724	5117

Suspected Bot List [2019-09-16]

detection period: 2019-09-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 681

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-09-15]

detection period: 2019-09-15 00:00-23:59 UTC
total number of suspected botnet IPs: 15108
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14480
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	DO-13	461
2	Baidu	420
3	HINET-NET	352
4	TENCENT-CN	306
5	KORNET	297
6	TencentCloud	289
7	DIGITALOCEAN-12	240
8	OVH	170
9	CHINANET-GD	156
10	VNPT-VN	155

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3372
2	United States	2465
3	France	830
4	Russian Federation	629
5	Brazil	538
6	South Korea	512
7	India	448
8	Viet Nam	427
9	Taiwan	406
10	Singapore	312

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	23	23070
2	445	23060
3	22	17422
4	3389	8309
5	1724	5587
6	7072	5567
7	674	5563
8	408	5315
9	633	5274
10	7077	5198

Suspected Bot List [2019-09-15]

detection period: 2019-09-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 628

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-09-14]

detection period: 2019-09-14 00:00-23:59 UTC
total number of suspected botnet IPs: 15060
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14442
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	DO-13	491
2	Baidu	416
3	TENCENT-CN	401
4	TencentCloud	381
5	HINET-NET	304
6	KORNET	281
7	DIGITALOCEAN-12	212
8	VNPT-VN	190
9	OVH	177
10	02.558.157/0001-62	142

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3373
2	United States	2507
3	France	785
4	Russian Federation	568
5	Brazil	559
6	India	554
7	Viet Nam	508
8	South Korea	483
9	Taiwan	348
10	Singapore	329

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	40223
2	23	19066
3	22	16224
4	2222	6618
5	8080	5985
6	2022	5795
7	674	5338
8	1400	5338
9	719	5319
10	921	5018

Suspected Bot List [2019-09-14]

detection period: 2019-09-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 618

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
GR	150.140.135.202	Greece
TN	102.152.53.54	Tunisia
ZA	165.73.113.139	South Africa

List from TCP port scans:

Botnet Statistics [2019-09-13]

detection period: 2019-09-13 00:00-23:59 UTC
total number of suspected botnet IPs: 15613
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14784
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	DO-13	475
2	TENCENT-CN	456
3	Baidu	408
4	TencentCloud	406
5	KORNET	291
6	DIGITALOCEAN-12	260
7	HINET-NET	251
8	VNPT-VN	234
9	OVH	174
10	VIETTEL-VN	151

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3387
2	United States	2509
3	France	805
4	Russian Federation	644
5	Viet Nam	615
6	India	597
7	Brazil	513
8	South Korea	487
9	Indonesia	390
10	Singapore	332

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	23	22005
2	445	17177
3	22	13610
4	2022	6866
5	8080	6104
6	1400	5893
7	1433	5646
8	690	5310
9	724	5306
10	674	5256

Suspected Bot List [2019-09-13]

detection period: 2019-09-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 829

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
ZA	160.119.141.196	South Africa

List from TCP port scans:

Botnet Statistics [2019-09-12]

detection period: 2019-09-12 00:00-23:59 UTC
total number of suspected botnet IPs: 14175
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 13530
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TENCENT-CN	354
2	TencentCloud	338
3	Baidu	323
4	HINET-NET	312
5	DO-13	291
6	DIGITALOCEAN-12	283
7	VNPT-VN	275
8	KORNET	239
9	VIETTEL-VN	155
10	02.558.157/0001-62	148

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	2894
2	United States	2108
3	France	663
4	Viet Nam	639
5	Russian Federation	624
6	Brazil	596
7	India	531
8	South Korea	401
9	Indonesia	389
10	Taiwan	377

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	28208
2	23	26313
3	222	19612
4	22	19318
5	2222	12708
6	22222	9307
7	2022	9090
8	81	5673
9	7046	5449
10	1400	5306

Suspected Bot List [2019-09-12]

detection period: 2019-09-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 645

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
ES	81.38.63.176	Spain
ID	103.255.121.135	Indonesia
KR	219.240.49.50	South Korea
MA	197.247.38.139	Morocco
MX	189.147.224.58	Mexico
MX	201.114.252.23	Mexico
TH	103.27.202.18	Thailand
ZA	160.119.141.196	South Africa

List from TCP port scans:

Botnet Statistics [2019-09-11]

detection period: 2019-09-11 00:00-23:59 UTC
total number of suspected botnet IPs: 10358
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 9864
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	DIGITALOCEAN-12	332
2	HINET-NET	297
3	VNPT-VN	238
4	KORNET	214
5	DIGITALOCEAN-15	163
6	VIETTEL-VN	142
7	DO-13	140
8	TENCENT-CN	125
9	02.558.157/0001-62	121
10	Baidu	114

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	1662
2	United States	1581
3	Viet Nam	536
4	Russian Federation	486
5	Brazil	475
6	India	419
7	France	367
8	Taiwan	365
9	South Korea	328
10	Indonesia	308

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	36968
2	23	26849
3	22	18440
4	22222	17305
5	222	16673
6	2222	15582
7	1433	9744
8	5038	5736
9	81	5353
10	674	4685

Suspected Bot List [2019-09-11]

detection period: 2019-09-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 494

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
EG	41.77.137.114	Egypt
ES	80.58.142.254	Spain
ES	81.42.219.153	Spain
LK	203.115.15.210	Sri Lanka
MX	189.147.224.58	Mexico
MX	201.114.252.23	Mexico
TH	103.27.202.18	Thailand
TZ	41.93.40.16	Tanzania
US	18.27.197.252	United States

List from TCP port scans:

Botnet Statistics [2019-09-10]

detection period: 2019-09-10 00:00-23:59 UTC
total number of suspected botnet IPs: 10400
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 9954
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	282
2	DIGITALOCEAN-12	277
3	VNPT-VN	246
4	KORNET	228
5	DIGITALOCEAN-15	164
6	VIETTEL-VN	139
7	TELKOMNET	138
8	DO-13	136
9	02.558.157/0001-62	121
10	TencentCloud	111

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	1638
2	United States	1601
3	Viet Nam	537
4	Russian Federation	516
5	Brazil	501
6	India	379
7	France	374
8	South Korea	351
9	Indonesia	345
10	Taiwan	342

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	30228
2	23	27963
3	22	15743
4	2222	14855
5	222	12507
6	5038	11451
7	22222	11162
8	8000	9375
9	7070	8993
10	3022	7187

Suspected Bot List [2019-09-10]

detection period: 2019-09-10 00:00-23:59 UTC
number of suspected bots' IPs listed here: 446

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
BJ	41.74.4.114	Benin
BR	150.161.8.120	Brazil
CM	195.24.207.199	Cameroon
ES	2.139.176.35	Spain
ES	80.58.142.254	Spain
JP	210.227.113.18	Japan
MX	189.169.141.154	Mexico
NG	80.248.6.187	Nigeria
SN	154.65.33.198	Senegal
TZ	41.93.40.16	Tanzania

List from TCP port scans:

Botnet Statistics [2019-09-09]

detection period: 2019-09-09 00:00-23:59 UTC
total number of suspected botnet IPs: 12191
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 11679
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	311
2	DIGITALOCEAN-12	286
3	HINET-NET	273
4	KORNET	223
5	TencentCloud	180
6	TENCENT-CN	171
7	DIGITALOCEAN-15	171
8	AT-88-Z	166
9	Baidu	165
10	DO-13	164

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	2024
2	United States	2005
3	Viet Nam	660
4	Russian Federation	599
5	India	520
6	Brazil	503
7	France	410
8	Indonesia	397
9	South Korea	343
10	Taiwan	336

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	3022	37395
2	23	23874
3	445	23030
4	22	18491
5	2222	12593
6	5900	11927
7	222	11206
8	81	9813
9	22222	9315
10	7046	7404

Suspected Bot List [2019-09-09]

detection period: 2019-09-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 512

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
ES	2.139.176.35	Spain
ES	83.48.101.184	Spain
JP	210.227.113.18	Japan
KR	219.240.49.50	South Korea
MA	41.249.94.232	Morocco
PL	91.90.190.130	Poland

List from TCP port scans:

Botnet Statistics [2019-09-08]

detection period: 2019-09-08 00:00-23:59 UTC
total number of suspected botnet IPs: 15505
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14910
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	DO-13	476
2	TENCENT-CN	475
3	Baidu	415
4	TencentCloud	402
5	KORNET	297
6	DIGITALOCEAN-12	261
7	HINET-NET	257
8	AT-88-Z	239
9	VNPT-VN	217
10	DIGITALOCEAN-15	182

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3373
2	United States	2853
3	France	791
4	Brazil	638
5	Russian Federation	626
6	Viet Nam	505
7	South Korea	477
8	India	467
9	Indonesia	327
10	Taiwan	313

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	23	23077
2	445	20389
3	22	14635
4	3389	10563
5	5900	9079
6	700	6767
7	2200	6686
8	3022	6610
9	674	6007
10	2222	5940