Daily Botnet Statistics

Wednesday, April 2, 2014

Botnet Statistics [2014-04-01]

detection period: 2014-04-01 00:00-23:59 UTC
total number of suspected botnet IPs: 3560
number of botnet IPs notified to network operators: 3470
number of spam blocked: 99082
recipient count of spam blocked: 2330077

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CMNET	551
2	CRTC	384
3	CHINANET-GD	362
4	CTTNET	145
5	CHINANET-JS	118
6	HINET-NET	103
7	UNICOM-SD	102
8	UNICOM-HA	71
9	CHINANET-FJ	55
10	UNICOM-HE	51

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	2984
2	Taiwan	151
3	United States	81
4	Russian Federation	31
5	Indonesia	25
6	Ukraine	18
7	India	17
8	Brazil	17
9	Turkey	14
10	France	13

Suspected Bot List [2014-03-31]

detection period: 2014-03-31 00:00-23:59 UTC
number of suspected bots' IPs listed here: 105

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AL	80.78.75.103	Albania
AR	190.182.225.42	Argentina
BO	190.129.12.162	Bolivia
BO	190.129.58.252	Bolivia
CN	202.142.20.8	China
CZ	80.188.121.251	Czech Republic
ES	80.35.117.49	Spain
GH	212.96.12.198	Ghana
HN	190.107.140.77	Honduras
ID	27.131.4.6	Indonesia
IN	117.222.242.2	India
IN	202.62.67.250	India
IN	203.88.131.106	India
IQ	95.170.214.44	Iraq
IT	85.159.181.210	Italy
IT	95.227.34.226	Italy
IT	95.253.67.148	Italy
PH	124.107.165.60	Philippines
RU	95.188.112.11	Russian Federation
SA	94.77.199.148	Saudi Arabia
SK	93.184.71.66	Slovakia
TR	195.244.39.195	Turkey
TW	211.76.33.123	Taiwan
TW	211.76.90.115	Taiwan
TW	211.76.94.85	Taiwan
US	50.201.42.106	United States
US	66.240.236.121	United States
US	69.64.48.57	United States
US	96.44.179.105	United States
US	204.195.104.31	United States
VE	190.39.82.232	Venezuela

List from greylisting:

Botnet Statistics [2014-03-31]

detection period: 2014-03-31 00:00-23:59 UTC
total number of suspected botnet IPs: 2933
number of botnet IPs notified to network operators: 2828
number of spam blocked: 93496
recipient count of spam blocked: 2134295

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CMNET	436
2	CRTC	340
3	CHINANET-GD	290
4	CTTNET	115
5	CHINANET-JS	81
6	UNICOM-HN	80
7	HINET-NET	64
8	UNICOM	57
9	CHINANET-FJ	49
10	UNICOM-SD	48

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	2356
2	Taiwan	106
3	United States	77
4	Russian Federation	37
5	Brazil	22
6	Italy	21
7	Indonesia	20
8	Ukraine	18
9	Viet Nam	16
10	Turkey	16