Daily Botnet Statistics

Saturday, November 2, 2013

Botnet Statistics [2013-11-01]

detection period: 2013-11-01 00:00-23:59 UTC
total number of suspected botnet IPs: 3314
number of botnet IPs notified to network operators: 3168
number of spam blocked: 103113
recipient count of spam blocked: 3583807

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	879
2	CMNET	340
3	CHINANET-GD	178
4	CRTC	152
5	UNICOM-SD	108
6	CTTNET	105
7	UNICOM-LN	86
8	UNICOM-HE	76
9	UNICOM-HA	65
10	CHINANET-JS	59

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	1964
2	Taiwan	893
3	United States	47
4	Brazil	43
5	Russian Federation	29
6	Argentina	23
7	Peru	18
8	United Kingdom	16
9	Iran	15
10	India	15

Friday, November 1, 2013

Suspected Bot List [2013-10-31]

detection period: 2013-10-31 00:00-23:59 UTC
number of suspected bots' IPs listed here: 298

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.15.201.202	Argentina
AR	200.41.181.170	Argentina
AR	200.55.57.214	Argentina
CA	70.38.64.167	Canada
CM	41.202.206.53	Cameroon
CN	150.255.183.177	China
GB	77.246.20.2	United Kingdom
GB	193.164.207.16	United Kingdom
HN	190.107.140.77	Honduras
IN	117.239.29.114	India
IN	117.240.239.120	India
IN	122.183.99.146	India
IN	182.73.111.162	India
IN	202.63.105.226	India
IQ	86.111.144.194	Iraq
IR	94.183.223.16	Iran
LB	213.175.188.158	Lebanon
MX	187.174.173.18	Mexico
MX	189.204.49.66	Mexico
NP	202.79.52.53	Nepal
PE	190.187.168.186	Peru
PE	200.31.105.172	Peru
PE	200.37.197.148	Peru
PK	111.68.104.155	Pakistan
PK	115.186.59.70	Pakistan
PK	124.109.47.66	Pakistan
SA	94.77.199.148	Saudi Arabia
SG	112.140.184.245	Singapore
SK	62.197.209.93	Slovakia
TW	211.76.90.150	Taiwan
UA	109.251.115.24	Ukraine
US	24.101.120.44	United States
US	74.222.3.249	United States
US	192.30.87.242	United States
US	209.239.112.104	United States

List from greylisting:

Botnet Statistics [2013-10-31]

detection period: 2013-10-31 00:00-23:59 UTC
total number of suspected botnet IPs: 3689
number of botnet IPs notified to network operators: 3395
number of spam blocked: 103214
recipient count of spam blocked: 3547065

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	831
2	CMNET	321
3	CRTC	206
4	CHINANET-GD	147
5	CTTNET	144
6	UNICOM-SD	89
7	UNICOM-LN	81
8	UNICOM-HE	76
9	UNICOM-HL	65
10	CHINANET-JS	56

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	2059
2	Taiwan	846
3	United States	95
4	Brazil	56
5	South Korea	46
6	Spain	35
7	Argentina	35
8	India	33
9	Russian Federation	31
10	Italy	27