Botnet Statistics [2020-02-28]

detection period: 2020-02-28 00:00-23:59 UTC
total number of suspected botnet IPs: 35113
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 33213
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1068
2	VNPT-VN	1066
3	VIETTEL-VN	814
4	Baidu	781
5	HINET-NET	778
6	TENCENT-CN	674
7	KORNET	534
8	TELKOMNET	491
9	ALISOFT	448
10	CHINANET-JS	382

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7671
2	United States	3027
3	Viet Nam	2588
4	India	1933
5	Russian Federation	1884
6	Indonesia	1348
7	Taiwan	1182
8	France	1003
9	South Korea	826
10	Thailand	789

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2048	595661
2	404	530861
3	2	228965
4	21	132926
5	7777	83758
6	445	80814
7	39022	76990
8	4444	76517
9	23	59715
10	5903	43104

Suspected Bot List [2020-02-28]

detection period: 2020-02-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1900

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-27]

detection period: 2020-02-27 00:00-23:59 UTC
total number of suspected botnet IPs: 34135
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 32359
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1092
2	VNPT-VN	969
3	HINET-NET	850
4	Baidu	816
5	VIETTEL-VN	744
6	TENCENT-CN	690
7	TELKOMNET	485
8	ALISOFT	447
9	KORNET	424
10	CHINANET-JS	375

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7782
2	United States	2999
3	Viet Nam	2346
4	Russian Federation	1947
5	India	1771
6	Indonesia	1332
7	Taiwan	1206
8	France	1006
9	Thailand	734
10	South Korea	687

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	404	788094
2	2048	594890
3	21	143604
4	445	89698
5	7777	84547
6	4444	74413
7	2020	73659
8	5038	65605
9	23	58356
10	39022	58327

Suspected Bot List [2020-02-27]

detection period: 2020-02-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1856

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-26]

detection period: 2020-02-26 00:00-23:59 UTC
total number of suspected botnet IPs: 35388
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 33532
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1147
2	TencentCloud	1088
3	VNPT-VN	1057
4	VIETTEL-VN	924
5	Baidu	832
6	TENCENT-CN	691
7	KORNET	564
8	ALISOFT	486
9	TELKOMNET	455
10	CHINANET-JS	378

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7745
2	United States	3104
3	Viet Nam	2691
4	Russian Federation	1944
5	India	1857
6	Taiwan	1610
7	Indonesia	1311
8	France	1006
9	South Korea	873
10	Thailand	710

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2048	595685
2	404	202790
3	21	193810
4	445	85956
5	2020	78047
6	7777	74064
7	4444	73767
8	39022	70527
9	23	70135
10	22	51356

Suspected Bot List [2020-02-26]

detection period: 2020-02-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1856

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-25]

detection period: 2020-02-25 00:00-23:59 UTC
total number of suspected botnet IPs: 48342
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 46513
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1107
2	VNPT-VN	1028
3	HINET-NET	894
4	Baidu	814
5	VIETTEL-VN	805
6	CHINANET-JS	693
7	TENCENT-CN	683
8	CHINANET-SN	590
9	CHINANET-JX	585
10	CHINANET-XJ	543

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	21578
2	United States	3146
3	Viet Nam	2529
4	Russian Federation	1821
5	India	1736
6	Taiwan	1308
7	Indonesia	1241
8	France	1029
9	South Korea	819
10	Thailand	747

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2048	563229
2	21	320811
3	5038	148347
4	7070	139563
5	7000	136714
6	8000	104136
7	2020	78037
8	7777	75028
9	4444	71574
10	39022	70889

Suspected Bot List [2020-02-25]

detection period: 2020-02-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1829

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-24]

detection period: 2020-02-24 00:00-23:59 UTC
total number of suspected botnet IPs: 36473
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 34722
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1164
2	TencentCloud	1119
3	Baidu	880
4	VNPT-VN	861
5	TENCENT-CN	708
6	KORNET	685
7	VIETTEL-VN	670
8	ALISOFT	475
9	CHINANET-JS	426
10	CMNET	372

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	9721
2	United States	3347
3	Viet Nam	2213
4	Russian Federation	1690
5	Taiwan	1608
6	India	1598
7	France	1176
8	Indonesia	1159
9	South Korea	1024
10	Thailand	641

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	999	200895
2	5038	165252
3	23	71839
4	445	59261
5	7777	53096
6	9999	52174
7	4444	51673
8	26	36582
9	2020	36560
10	22	29168

Suspected Bot List [2020-02-24]

detection period: 2020-02-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1751

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-23]

detection period: 2020-02-23 00:00-23:59 UTC
total number of suspected botnet IPs: 33133
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31620
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1410
2	TencentCloud	1108
3	KORNET	871
4	Baidu	870
5	TENCENT-CN	710
6	VIETTEL-VN	650
7	VNPT-VN	509
8	ALISOFT	454
9	CMNET	372
10	CHINANET-GD	366

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7687
2	United States	3522
3	Taiwan	1869
4	Viet Nam	1749
5	Russian Federation	1667
6	South Korea	1215
7	France	1168
8	India	1113
9	Indonesia	808
10	Italy	506

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	101851
2	23	81557
3	7777	64895
4	4444	55712
5	2020	36708
6	26	36110
7	445	35270
8	22	35208
9	2220	28615
10	7070	28303

Suspected Bot List [2020-02-23]

detection period: 2020-02-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1513

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-22]

detection period: 2020-02-22 00:00-23:59 UTC
total number of suspected botnet IPs: 33256
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31693
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1186
2	TencentCloud	1064
3	Baidu	824
4	KORNET	776
5	VIETTEL-VN	773
6	TENCENT-CN	662
7	VNPT-VN	661
8	ALISOFT	418
9	CHINANET-JS	350
10	CMNET	349

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7320
2	United States	3391
3	Viet Nam	2078
4	Russian Federation	1791
5	Taiwan	1581
6	India	1475
7	France	1106
8	South Korea	1087
9	Indonesia	920
10	Brazil	652

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	160698
2	7070	144722
3	8000	139596
4	5000	139330
5	7000	138746
6	23	86108
7	4444	75027
8	445	54480
9	22	45709
10	2020	41363

Suspected Bot List [2020-02-22]

detection period: 2020-02-22 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1563

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-21]

detection period: 2020-02-21 00:00-23:59 UTC
total number of suspected botnet IPs: 32561
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30969
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1068
2	HINET-NET	881
3	VNPT-VN	856
4	VIETTEL-VN	848
5	Baidu	832
6	TENCENT-CN	662
7	KORNET	521
8	ALISOFT	486
9	TELKOMNET	440
10	CMNET	338

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7120
2	United States	3391
3	Viet Nam	2361
4	Russian Federation	1752
5	India	1431
6	Indonesia	1155
7	Taiwan	1145
8	France	1092
9	South Korea	788
10	Thailand	666

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	23	95215
2	4444	75274
3	445	61435
4	9	61156
5	22	50641
6	2020	40885
7	2220	40182
8	222	39017
9	26	36428
10	1433	30833

Suspected Bot List [2020-02-21]

detection period: 2020-02-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1592

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-20]

detection period: 2020-02-20 00:00-23:59 UTC
total number of suspected botnet IPs: 34482
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 32690
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1056
2	VNPT-VN	951
3	VIETTEL-VN	916
4	Baidu	838
5	HINET-NET	817
6	KORNET	689
7	TENCENT-CN	675
8	TELKOMNET	522
9	ALISOFT	470
10	02.558.157/0001-62	351

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7033
2	United States	3418
3	Viet Nam	2566
4	India	1852
5	Russian Federation	1851
6	Indonesia	1353
7	France	1097
8	Taiwan	1058
9	South Korea	1006
10	Thailand	668

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	777	175613
2	2048	99019
3	7777	78965
4	23	75325
5	4444	75017
6	9	71280
7	2220	68192
8	445	63773
9	22	49398
10	26	38002

Suspected Bot List [2020-02-20]

detection period: 2020-02-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1792

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-19]

detection period: 2020-02-19 00:00-23:59 UTC
total number of suspected botnet IPs: 37742
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 35703
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1106
2	VNPT-VN	1095
3	VIETTEL-VN	979
4	TencentCloud	975
5	Baidu	799
6	KORNET	732
7	TENCENT-CN	616
8	TELKOMNET	531
9	ALISOFT	409
10	02.558.157/0001-62	374

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7220
2	United States	3461
3	Viet Nam	2821
4	Russian Federation	2039
5	India	1966
6	Indonesia	1421
7	Taiwan	1401
8	France	1166
9	South Korea	1059
10	Thailand	847

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	777	406864
2	2048	182662
3	23	94453
4	7777	90083
5	445	81250
6	4444	75129
7	5038	71687
8	1389	67829
9	2242	63358
10	33	49243

Suspected Bot List [2020-02-19]

detection period: 2020-02-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 2039

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-18]

detection period: 2020-02-18 00:00-23:59 UTC
total number of suspected botnet IPs: 35583
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 33713
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1281
2	VNPT-VN	1039
3	VIETTEL-VN	1023
4	TencentCloud	909
5	Baidu	708
6	TENCENT-CN	568
7	KORNET	544
8	TELKOMNET	502
9	ALISOFT	438
10	02.558.157/0001-62	380

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6763
2	United States	3180
3	Viet Nam	2760
4	India	1941
5	Russian Federation	1916
6	Taiwan	1594
7	Indonesia	1338
8	France	1075
9	Brazil	906
10	South Korea	833

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	777	359390
2	2048	197695
3	23	99038
4	7777	90424
5	4444	75319
6	445	75135
7	22	59462
8	2220	41863
9	222	38634
10	1433	33356

Suspected Bot List [2020-02-18]

detection period: 2020-02-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1870

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-17]

detection period: 2020-02-17 00:00-23:59 UTC
total number of suspected botnet IPs: 34208
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 32416
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1222
2	VNPT-VN	1002
3	TencentCloud	894
4	VIETTEL-VN	885
5	Baidu	715
6	TENCENT-CN	566
7	KORNET	530
8	TELKOMNET	473
9	ALISOFT	409
10	02.558.157/0001-62	392

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6465
2	United States	3186
3	Viet Nam	2547
4	India	1818
5	Russian Federation	1788
6	Taiwan	1509
7	Indonesia	1328
8	Brazil	1173
9	France	1107
10	South Korea	792

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	777	346678
2	2048	196374
3	23	98800
4	7777	87546
5	445	76189
6	4444	73753
7	17700	67740
8	22	56330
9	2220	40389
10	222	38813

Suspected Bot List [2020-02-17]

detection period: 2020-02-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1792

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-16]

detection period: 2020-02-16 00:00-23:59 UTC
total number of suspected botnet IPs: 31243
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29741
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1197
2	TencentCloud	925
3	VIETTEL-VN	733
4	Baidu	729
5	KORNET	643
6	VNPT-VN	594
7	TENCENT-CN	590
8	ALISOFT	460
9	DO-13	331
10	CMNET	331

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6487
2	United States	3239
3	Viet Nam	1840
4	Russian Federation	1728
5	Taiwan	1510
6	India	1254
7	France	1128
8	Brazil	969
9	South Korea	927
10	Indonesia	832

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	777	357593
2	2048	199307
3	3874	142628
4	7777	90011
5	23	88658
6	4444	75694
7	22	47575
8	2220	40515
9	222	37504
10	445	37323

Suspected Bot List [2020-02-16]

detection period: 2020-02-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1502

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-15]

detection period: 2020-02-15 00:00-23:59 UTC
total number of suspected botnet IPs: 31415
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29900
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1259
2	TencentCloud	912
3	Baidu	775
4	VIETTEL-VN	716
5	VNPT-VN	715
6	TENCENT-CN	597
7	DIGITALOCEAN-6	467
8	DIGITALOCEAN-7	448
9	KORNET	424
10	ALISOFT	393

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6554
2	United States	3516
3	Viet Nam	2001
4	Russian Federation	1619
5	India	1580
6	Taiwan	1544
7	France	1095
8	Indonesia	974
9	Brazil	740
10	South Korea	698

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	777	359360
2	2048	203859
3	2220	128993
4	23	93179
5	7777	89623
6	4444	75046
7	5038	60824
8	445	42217
9	22	41903
10	3389	39957

Suspected Bot List [2020-02-15]

detection period: 2020-02-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1515

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-14]

detection period: 2020-02-14 00:00-23:59 UTC
total number of suspected botnet IPs: 31892
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30335
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1036
2	VNPT-VN	992
3	VIETTEL-VN	982
4	TencentCloud	890
5	Baidu	761
6	TENCENT-CN	587
7	TELKOMNET	482
8	DIGITALOCEAN-6	463
9	DIGITALOCEAN-7	438
10	KORNET	425

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6365
2	United States	3373
3	Viet Nam	2578
4	Russian Federation	1686
5	India	1549
6	Indonesia	1319
7	Taiwan	1306
8	France	1016
9	Brazil	844
10	Thailand	807

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	777	358628
2	2048	281044
3	2220	139696
4	23	103123
5	445	94162
6	7777	90802
7	4444	83992
8	3388	42145
9	22	41474
10	222	39219

Suspected Bot List [2020-02-14]

detection period: 2020-02-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1557

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-13]

detection period: 2020-02-13 00:00-23:59 UTC
total number of suspected botnet IPs: 30815
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29269
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1007
2	TencentCloud	938
3	VNPT-VN	882
4	VIETTEL-VN	827
5	Baidu	778
6	TENCENT-CN	621
7	KORNET	445
8	TELKOMNET	434
9	ALISOFT	365
10	02.558.157/0001-62	326

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6419
2	United States	3090
3	Viet Nam	2349
4	Russian Federation	1517
5	India	1506
6	Taiwan	1266
7	Indonesia	1171
8	France	1022
9	Brazil	802
10	South Korea	667

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	777	351121
2	2048	323378
3	23	99976
4	2220	95330
5	7777	87808
6	8000	84204
7	5000	75803
8	445	73204
9	4444	72054
10	5038	67384

Suspected Bot List [2020-02-13]

detection period: 2020-02-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1546

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-12]

detection period: 2020-02-12 00:00-23:59 UTC
total number of suspected botnet IPs: 31120
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29607
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1238
2	TencentCloud	950
3	VIETTEL-VN	902
4	Baidu	795
5	VNPT-VN	783
6	TENCENT-CN	626
7	KORNET	475
8	TELKOMNET	382
9	ALISOFT	359
10	CHINANET-JS	309

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6541
2	United States	3083
3	Viet Nam	2306
4	Russian Federation	1600
5	Taiwan	1505
6	India	1443
7	Indonesia	1057
8	France	1057
9	Brazil	790
10	South Korea	716

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	777	343515
2	2048	312373
3	23	93656
4	2220	92357
5	4444	74216
6	445	61923
7	22	61505
8	10000	57805
9	7777	49480
10	7070	39184

Suspected Bot List [2020-02-12]

detection period: 2020-02-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1513

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-11]

detection period: 2020-02-11 00:00-23:59 UTC
total number of suspected botnet IPs: 31698
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30187
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1134
2	TencentCloud	965
3	VIETTEL-VN	838
4	Baidu	814
5	VNPT-VN	797
6	TENCENT-CN	626
7	KORNET	591
8	TELKOMNET	418
9	ALISOFT	361
10	CMNET	319

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6657
2	United States	3129
3	Viet Nam	2237
4	Russian Federation	1558
5	India	1538
6	Taiwan	1393
7	Indonesia	1124
8	France	1116
9	South Korea	854
10	Brazil	808

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	777	359920
2	2048	322935
3	2220	104835
4	23	77048
5	22122	76017
6	7777	75725
7	10000	64487
8	4444	58043
9	445	55885
10	22	53810

Suspected Bot List [2020-02-11]

detection period: 2020-02-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1511

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-10]

detection period: 2020-02-10 00:00-23:59 UTC
total number of suspected botnet IPs: 28783
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 27333
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1171
2	TencentCloud	865
3	VNPT-VN	787
4	Baidu	756
5	VIETTEL-VN	696
6	TENCENT-CN	571
7	TELKOMNET	434
8	ALISOFT	345
9	CMNET	328
10	CHINANET-JS	315

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6337
2	United States	2849
3	Viet Nam	2029
4	Russian Federation	1458
5	India	1428
6	Taiwan	1410
7	Indonesia	1199
8	France	941
9	Brazil	782
10	South Korea	516

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	777	360753
2	2048	319946
3	2220	98465
4	445	83933
5	4444	75056
6	9005	56532
7	23	55329
8	222	47565
9	22	43136
10	3389	38804

Suspected Bot List [2020-02-10]

detection period: 2020-02-10 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1450

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-09]

detection period: 2020-02-09 00:00-23:59 UTC
total number of suspected botnet IPs: 26261
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 25086
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1224
2	TencentCloud	861
3	Baidu	758
4	TENCENT-CN	566
5	VIETTEL-VN	492
6	VNPT-VN	438
7	CHINANET-JS	337
8	ALISOFT	334
9	KORNET	330
10	CMNET	303

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6429
2	United States	2960
3	Taiwan	1430
4	Viet Nam	1369
5	Russian Federation	1332
6	France	917
7	India	871
8	Indonesia	687
9	Brazil	630
10	Hong Kong	577

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2048	319502
2	777	280379
3	2220	91779
4	4444	74817
5	23	68174
6	222	56433
7	22	48818
8	445	40487
9	5901	37777
10	3389	33586

Suspected Bot List [2020-02-09]

detection period: 2020-02-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1175

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-08]

detection period: 2020-02-08 00:00-23:59 UTC
total number of suspected botnet IPs: 25493
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 24197
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	863
2	Baidu	762
3	TENCENT-CN	567
4	VNPT-VN	549
5	HINET-NET	487
6	VIETTEL-VN	397
7	ALISOFT	354
8	KORNET	329
9	CHINANET-JS	324
10	CMNET	307

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6099
2	United States	2929
3	Viet Nam	1421
4	Russian Federation	1391
5	India	1151
6	France	930
7	Indonesia	756
8	Taiwan	657
9	Brazil	644
10	South Korea	529

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2048	321083
2	2220	93231
3	4444	74940
4	777	71843
5	445	69649
6	22	60569
7	222	56830
8	23	41298
9	5901	38060
10	26	32977

Suspected Bot List [2020-02-08]

detection period: 2020-02-08 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1296

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-07]

detection period: 2020-02-07 00:00-23:59 UTC
total number of suspected botnet IPs: 27672
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 26264
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	865
2	Baidu	762
3	VNPT-VN	738
4	TENCENT-CN	566
5	HINET-NET	523
6	VIETTEL-VN	480
7	ALISOFT	421
8	TELKOMNET	382
9	KORNET	346
10	CHINANET-JS	316

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6177
2	United States	3208
3	Viet Nam	1869
4	Russian Federation	1460
5	India	1374
6	Indonesia	1048
7	France	977
8	Taiwan	697
9	Brazil	686
10	Thailand	603

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2048	310875
2	777	279314
3	22	274012
4	2220	105522
5	445	82126
6	4444	76483
7	222	56786
8	23	43332
9	26	33479
10	3389	31237

Suspected Bot List [2020-02-07]

detection period: 2020-02-07 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1408

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-02-06]

detection period: 2020-02-06 00:00-23:59 UTC
total number of suspected botnet IPs: 29124
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 27597
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	899
2	Baidu	767
3	VNPT-VN	717
4	TENCENT-CN	598
5	VIETTEL-VN	505
6	TELKOMNET	475
7	HINET-NET	436
8	KORNET	394
9	ALISOFT	377
10	CHINANET-JS	334

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6466
2	United States	2976
3	Viet Nam	1873
4	India	1732
5	Russian Federation	1543
6	Indonesia	1304
7	France	981
8	Brazil	710
9	Thailand	679
10	South Korea	617

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	1657068
2	777	242658
3	2048	241229
4	2220	101124
5	445	73017
6	4444	60721
7	222	53500
8	23	43005
9	3389	34813
10	26	33871