Botnet Statistics [2020-01-30]

detection period: 2020-01-30 00:00-23:59 UTC
total number of suspected botnet IPs: 28917
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 27348
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	899
2	Baidu	768
3	VNPT-VN	654
4	TENCENT-CN	588
5	HINET-NET	478
6	TELKOMNET	424
7	VIETTEL-VN	397
8	ALISOFT	392
9	KORNET	389
10	CHINANET-JS	324

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6354
2	United States	2760
3	India	1680
4	Viet Nam	1599
5	Russian Federation	1539
6	Indonesia	1174
7	Brazil	1082
8	France	1012
9	Taiwan	640
10	South Korea	633

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1	2755706
2	5150	486538
3	445	148499
4	2220	114084
5	4444	74021
6	2200	58296
7	222	47744
8	22	42302
9	1433	30180
10	23	30057

Suspected Bot List [2020-01-30]

detection period: 2020-01-30 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1569

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-29]

detection period: 2020-01-29 00:00-23:59 UTC
total number of suspected botnet IPs: 28119
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 26461
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	905
2	Baidu	777
3	TENCENT-CN	590
4	ALISOFT	474
5	HINET-NET	467
6	TELKOMNET	441
7	VNPT-VN	367
8	KORNET	346
9	DO-13	320
10	CHINANET-JS	319

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6439
2	United States	2844
3	India	1629
4	Russian Federation	1450
5	Indonesia	1142
6	Brazil	1073
7	France	1026
8	Viet Nam	1013
9	Taiwan	623
10	Thailand	595

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1	1381231
2	2220	110004
3	5038	75944
4	445	69074
5	4444	55744
6	22	46066
7	222	44119
8	3389	38324
9	23	36062
10	7070	31229

Suspected Bot List [2020-01-29]

detection period: 2020-01-29 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1658

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-28]

detection period: 2020-01-28 00:00-23:59 UTC
total number of suspected botnet IPs: 28258
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 26525
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	917
2	Baidu	780
3	TENCENT-CN	598
4	HINET-NET	468
5	TELKOMNET	447
6	ALISOFT	380
7	DO-13	355
8	CHINANET-JS	330
9	KORNET	303
10	VNPT-VN	302

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6416
2	United States	2998
3	Russian Federation	1527
4	India	1497
5	Brazil	1149
6	Indonesia	1122
7	France	1055
8	Viet Nam	906
9	Taiwan	653
10	South Korea	535

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2220	135572
2	4444	73003
3	445	68676
4	3389	47114
5	23	43103
6	222	42419
7	22	40758
8	1024	29787
9	1433	27741
10	3306	17592

Suspected Bot List [2020-01-28]

detection period: 2020-01-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1733

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-27]

detection period: 2020-01-27 00:00-23:59 UTC
total number of suspected botnet IPs: 30063
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 28314
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	946
2	Baidu	783
3	TENCENT-CN	606
4	TELKOMNET	518
5	HINET-NET	514
6	DO-13	435
7	ALISOFT	435
8	KORNET	373
9	VNPT-VN	339
10	CHINANET-JS	324

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6377
2	United States	3490
3	India	1722
4	Russian Federation	1570
5	Indonesia	1334
6	Brazil	1226
7	France	1160
8	Viet Nam	933
9	Taiwan	680
10	Thailand	627

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2220	153556
2	445	108489
3	3389	89515
4	4444	83359
5	222	45228
6	22	41909
7	1433	30340
8	23	29076
9	25	26472
10	1024	24475

Suspected Bot List [2020-01-27]

detection period: 2020-01-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1749

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-26]

detection period: 2020-01-26 00:00-23:59 UTC
total number of suspected botnet IPs: 28621
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 26778
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	969
2	Baidu	824
3	TENCENT-CN	654
4	KORNET	555
5	HINET-NET	488
6	ALISOFT	469
7	DO-13	456
8	CHINANET-JS	338
9	VNPT-VN	333
10	AT-88-Z	316

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6678
2	United States	3513
3	Russian Federation	1490
4	France	1174
5	India	1030
6	Viet Nam	967
7	Indonesia	881
8	Brazil	877
9	South Korea	810
10	Taiwan	655

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	3389	80453
2	445	76685
3	4444	73396
4	5038	69997
5	22	61765
6	222	54622
7	1433	34616
8	23	31345
9	5901	28363
10	5900	25889

Suspected Bot List [2020-01-26]

detection period: 2020-01-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1843

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-25]

detection period: 2020-01-25 00:00-23:59 UTC
total number of suspected botnet IPs: 25496
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 23863
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	892
2	Baidu	782
3	TENCENT-CN	624
4	HINET-NET	486
5	DO-13	384
6	ALISOFT	382
7	CHINANET-JS	339
8	KORNET	301
9	CMNET	280
10	CHINANET-GD	277

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6303
2	United States	2974
3	India	1383
4	Russian Federation	1332
5	France	952
6	Viet Nam	857
7	Brazil	783
8	Indonesia	696
9	Taiwan	620
10	South Korea	510

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	69731
2	22	64972
3	3389	60078
4	222	56975
5	445	40000
6	4444	38827
7	1433	33592
8	23	32587
9	5901	28041
10	1024	27615

Suspected Bot List [2020-01-25]

detection period: 2020-01-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1633

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-24]

detection period: 2020-01-24 00:00-23:59 UTC
total number of suspected botnet IPs: 25956
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 24424
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	913
2	ALISOFT	793
3	Baidu	784
4	TENCENT-CN	635
5	HINET-NET	391
6	DO-13	377
7	TELKOMNET	341
8	KORNET	323
9	CHINANET-JS	302
10	CHINANET-GD	286

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6705
2	United States	3054
3	India	1357
4	Russian Federation	1181
5	France	924
6	Indonesia	910
7	Viet Nam	811
8	Brazil	694
9	South Korea	543
10	Taiwan	522

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	107442
2	22	58488
3	13022	48027
4	222	47190
5	3389	46815
6	1024	32921
7	1433	30784
8	2662	28246
9	5901	28183
10	5900	27611

Suspected Bot List [2020-01-24]

detection period: 2020-01-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1532

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-23]

detection period: 2020-01-23 00:00-23:59 UTC
total number of suspected botnet IPs: 26423
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 24973
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	945
2	Baidu	772
3	ALISOFT	682
4	TENCENT-CN	650
5	DO-13	397
6	HINET-NET	382
7	CHINANET-JS	330
8	KORNET	328
9	TELKOMNET	300
10	CMNET	300

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6681
2	United States	3046
3	India	1344
4	Russian Federation	1228
5	France	946
6	Brazil	942
7	Indonesia	884
8	Viet Nam	842
9	South Korea	556
10	Taiwan	521

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	81495
2	445	50764
3	3389	41086
4	222	37352
5	1433	37124
6	38022	33343
7	5900	28962
8	23	28707
9	5901	28414
10	13022	27930

Suspected Bot List [2020-01-23]

detection period: 2020-01-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1450

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-22]

detection period: 2020-01-22 00:00-23:59 UTC
total number of suspected botnet IPs: 26448
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 24913
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	938
2	Baidu	771
3	TENCENT-CN	647
4	ALISOFT	508
5	HINET-NET	387
6	DO-13	379
7	VNPT-VN	343
8	CHINANET-JS	342
9	KORNET	314
10	CMNET	296

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6502
2	United States	3054
3	India	1310
4	Russian Federation	1211
5	France	960
6	Viet Nam	944
7	Brazil	893
8	Indonesia	863
9	South Korea	547
10	Taiwan	535

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	88162
2	5022	68815
3	445	59841
4	3389	40437
5	222	39737
6	1433	36678
7	8122	35716
8	5901	28496
9	23	28143
10	5900	26895

Suspected Bot List [2020-01-22]

detection period: 2020-01-22 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1535

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-21]

detection period: 2020-01-21 00:00-23:59 UTC
total number of suspected botnet IPs: 27249
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 25764
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	925
2	Baidu	763
3	TENCENT-CN	636
4	VNPT-VN	536
5	ALISOFT	477
6	HINET-NET	397
7	DO-13	373
8	KORNET	363
9	TELKOMNET	357
10	CHINANET-JS	332

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6621
2	United States	2975
3	India	1451
4	Viet Nam	1323
5	Russian Federation	1256
6	Indonesia	1021
7	France	962
8	Brazil	882
9	South Korea	589
10	Taiwan	541

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	72937
2	22	64914
3	999	63239
4	8122	61027
5	222	40951
6	5022	33893
7	3389	31020
8	1433	30907
9	5901	28307
10	23	28202

Suspected Bot List [2020-01-21]

detection period: 2020-01-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1485

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-20]

detection period: 2020-01-20 00:00-23:59 UTC
total number of suspected botnet IPs: 27019
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 25563
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	908
2	Baidu	737
3	VNPT-VN	696
4	TENCENT-CN	634
5	HINET-NET	391
6	KORNET	367
7	VIETTEL-VN	366
8	TELKOMNET	363
9	ALISOFT	356
10	DO-13	347

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6301
2	United States	2908
3	Viet Nam	1516
4	India	1366
5	Russian Federation	1300
6	Indonesia	1049
7	France	965
8	Brazil	882
9	South Korea	593
10	Thailand	546

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	77191
2	22	75766
3	999	63012
4	8122	60990
5	222	42669
6	23	31343
7	1433	30611
8	3389	29352
9	5901	28022
10	5900	26736

Suspected Bot List [2020-01-20]

detection period: 2020-01-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1456

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-19]

detection period: 2020-01-19 00:00-23:59 UTC
total number of suspected botnet IPs: 26145
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 24855
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	934
2	Baidu	765
3	TENCENT-CN	667
4	KORNET	523
5	HINET-NET	471
6	VNPT-VN	414
7	ALISOFT	389
8	CHINANET-JS	374
9	DO-13	349
10	CMNET	288

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6427
2	United States	3053
3	Russian Federation	1220
4	Viet Nam	1085
5	France	1066
6	India	900
7	Brazil	877
8	South Korea	765
9	Indonesia	687
10	Taiwan	644

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	216600
2	445	99504
3	22	80039
4	999	63614
5	222	50233
6	8122	38103
7	23	35065
8	3389	34997
9	5901	28094
10	1433	26695

Suspected Bot List [2020-01-19]

detection period: 2020-01-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1290

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-18]

detection period: 2020-01-18 00:00-23:59 UTC
total number of suspected botnet IPs: 25326
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 23953
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	855
2	Baidu	698
3	TENCENT-CN	616
4	VNPT-VN	473
5	HINET-NET	444
6	ALISOFT	416
7	CHINANET-JS	328
8	DO-13	324
9	TELKOMNET	313
10	KORNET	309

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6059
2	United States	2760
3	India	1264
4	Viet Nam	1247
5	Russian Federation	1199
6	France	932
7	Brazil	805
8	Indonesia	804
9	Taiwan	604
10	South Korea	554

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	253343
2	22	77193
3	999	63008
4	445	54522
5	23	44098
6	222	38703
7	3389	34417
8	1433	29864
9	5901	28141
10	5900	26650

Suspected Bot List [2020-01-18]

detection period: 2020-01-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1373

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-17]

detection period: 2020-01-17 00:00-23:59 UTC
total number of suspected botnet IPs: 26566
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 25150
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	884
2	Baidu	690
3	VNPT-VN	681
4	TENCENT-CN	622
5	HINET-NET	431
6	VIETTEL-VN	415
7	ALISOFT	395
8	CHINANET-JS	343
9	KORNET	321
10	TELKOMNET	317

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6117
2	United States	2760
3	Viet Nam	1635
4	Russian Federation	1355
5	India	1289
6	Brazil	937
7	France	930
8	Indonesia	887
9	Taiwan	581
10	South Korea	539

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	999	298209
2	5038	161991
3	22	109049
4	1024	63111
5	445	57443
6	3389	34530
7	1433	30990
8	23	29103
9	5901	28215
10	5900	27425

Suspected Bot List [2020-01-17]

detection period: 2020-01-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1416

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-16]

detection period: 2020-01-16 00:00-23:59 UTC
total number of suspected botnet IPs: 27238
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 25757
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	901
2	VNPT-VN	729
3	Baidu	698
4	TENCENT-CN	623
5	HINET-NET	440
6	VIETTEL-VN	407
7	TELKOMNET	393
8	ALISOFT	351
9	KORNET	328
10	CHINANET-JS	325

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6144
2	United States	2820
3	Viet Nam	1693
4	Russian Federation	1336
5	India	1323
6	Indonesia	1014
7	Brazil	1003
8	France	903
9	Taiwan	608
10	South Korea	548

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	999	571883
2	1024	263091
3	445	87783
4	22	75138
5	2242	58413
6	1433	37630
7	3389	31910
8	23	29449
9	5901	28105
10	5038	27222

Suspected Bot List [2020-01-16]

detection period: 2020-01-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1481

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-15]

detection period: 2020-01-15 00:00-23:59 UTC
total number of suspected botnet IPs: 27382
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 25709
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	898
2	VNPT-VN	705
3	Baidu	691
4	TENCENT-CN	607
5	HINET-NET	433
6	VIETTEL-VN	423
7	TELKOMNET	390
8	DO-13	363
9	KORNET	330
10	CHINANET-JS	318

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6105
2	United States	2878
3	Viet Nam	1709
4	Russian Federation	1310
5	India	1166
6	Indonesia	1040
7	France	933
8	Brazil	903
9	Taiwan	572
10	South Korea	558

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	999	366180
2	1024	275128
3	5038	243336
4	445	82605
5	22	67511
6	2242	62297
7	8000	36602
8	2262	33823
9	1433	32989
10	23	31065

Suspected Bot List [2020-01-15]

detection period: 2020-01-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1673

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-14]

detection period: 2020-01-14 00:00-23:59 UTC
total number of suspected botnet IPs: 27579
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 25911
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	891
2	Baidu	691
3	VNPT-VN	682
4	TENCENT-CN	605
5	VIETTEL-VN	456
6	HINET-NET	442
7	DO-13	397
8	TELKOMNET	396
9	KORNET	344
10	CHINANET-JS	331

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6145
2	United States	3054
3	Viet Nam	1663
4	Russian Federation	1318
5	India	1292
6	Indonesia	1033
7	France	958
8	Brazil	907
9	Taiwan	587
10	South Korea	569

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	999	328994
2	1024	271099
3	22	179810
4	445	69580
5	3389	69554
6	2252	49448
7	2242	47478
8	1433	33656
9	23	29529
10	5900	23316

Suspected Bot List [2020-01-14]

detection period: 2020-01-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1668

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-13]

detection period: 2020-01-13 00:00-23:59 UTC
total number of suspected botnet IPs: 28843
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 27180
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	908
2	VNPT-VN	786
3	Baidu	690
4	TENCENT-CN	621
5	HINET-NET	467
6	VIETTEL-VN	461
7	TELKOMNET	403
8	KORNET	391
9	ALISOFT	379
10	DO-13	352

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6196
2	United States	3128
3	Viet Nam	1810
4	India	1471
5	Russian Federation	1460
6	Indonesia	1105
7	France	983
8	Brazil	978
9	Taiwan	642
10	South Korea	638

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	3389	3187300
2	666	3150678
3	9000	3148682
4	33890	3147170
5	1022	3144516
6	5000	3142009
7	22	462163
8	1024	269545
9	999	249853
10	445	72383

Suspected Bot List [2020-01-13]

detection period: 2020-01-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1663

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-12]

detection period: 2020-01-12 00:00-23:59 UTC
total number of suspected botnet IPs: 25563
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 24117
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	892
2	Baidu	668
3	TENCENT-CN	623
4	KORNET	502
5	VNPT-VN	488
6	HINET-NET	451
7	ALISOFT	396
8	VIETTEL-VN	330
9	CHINANET-JS	322
10	DO-13	320

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5912
2	United States	3046
3	Russian Federation	1297
4	Viet Nam	1289
5	France	1011
6	India	952
7	Brazil	835
8	Indonesia	721
9	South Korea	717
10	Taiwan	627

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1024	274653
2	999	237685
3	22	59584
4	8022	41427
5	445	36417
6	7000	35594
7	7070	32120
8	1433	27699
9	5900	26419
10	7410	22356

Suspected Bot List [2020-01-12]

detection period: 2020-01-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1446

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-11]

detection period: 2020-01-11 00:00-23:59 UTC
total number of suspected botnet IPs: 24374
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 23049
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	801
2	VNPT-VN	616
3	Baidu	584
4	TENCENT-CN	569
5	VIETTEL-VN	397
6	HINET-NET	396
7	ALISOFT	376
8	TELKOMNET	338
9	KORNET	312
10	CHINANET-JS	297

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5473
2	United States	2741
3	Viet Nam	1472
4	India	1313
5	Russian Federation	1170
6	France	930
7	Indonesia	876
8	Brazil	788
9	Taiwan	534
10	South Korea	517

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	7301701
2	999	308518
3	1024	259218
4	445	76960
5	7000	44984
6	22	41660
7	2209	35264
8	1433	31512
9	7410	29529
10	5900	26295

Suspected Bot List [2020-01-11]

detection period: 2020-01-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1325

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-10]

detection period: 2020-01-10 00:00-23:59 UTC
total number of suspected botnet IPs: 26399
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 25027
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	802
2	TencentCloud	785
3	Baidu	586
4	TENCENT-CN	577
5	VIETTEL-VN	488
6	HINET-NET	453
7	KORNET	447
8	TELKOMNET	409
9	ALISOFT	351
10	CHINANET-JS	311

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5549
2	United States	2822
3	Viet Nam	1856
4	India	1570
5	Russian Federation	1387
6	Indonesia	1050
7	Brazil	929
8	France	900
9	South Korea	675
10	Taiwan	598

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	999	308616
2	445	60579
3	2210	45148
4	22	39951
5	2208	35457
6	1433	31515
7	2205	28977
8	3389	28846
9	5900	26275
10	2212	24703

Suspected Bot List [2020-01-10]

detection period: 2020-01-10 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1372

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-09]

detection period: 2020-01-09 00:00-23:59 UTC
total number of suspected botnet IPs: 26681
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 25111
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	810
2	VNPT-VN	775
3	Baidu	611
4	TENCENT-CN	585
5	VIETTEL-VN	482
6	KORNET	469
7	HINET-NET	423
8	TELKOMNET	407
9	ALISOFT	385
10	CHINANET-JS	300

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5810
2	United States	2474
3	Viet Nam	1835
4	India	1540
5	Russian Federation	1342
6	Indonesia	1043
7	France	950
8	Brazil	916
9	South Korea	685
10	Taiwan	578

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	999	115877
2	2210	68293
3	445	57416
4	22	36509
5	2207	36203
6	1433	33306
7	2205	31392
8	3389	30345
9	2580	26281
10	5900	26268

Suspected Bot List [2020-01-09]

detection period: 2020-01-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1570

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-01-08]

detection period: 2020-01-08 00:00-23:59 UTC
total number of suspected botnet IPs: 26646
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 25126
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	825
2	VNPT-VN	700
3	Baidu	636
4	KORNET	617
5	TENCENT-CN	603
6	HINET-NET	484
7	VIETTEL-VN	453
8	TELKOMNET	411
9	ALISOFT	386
10	CMNET	289

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5726
2	United States	2567
3	Viet Nam	1696
4	India	1502
5	Russian Federation	1157
6	Indonesia	1041
7	France	995
8	Brazil	944
9	South Korea	857
10	Taiwan	653

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	1002219
2	5000	370184
3	7070	299034
4	2210	66212
5	999	59326
6	445	51553
7	8000	37506
8	2205	36853
9	22	36788
10	3389	31091