Daily Botnet Statistics

Thursday, August 7, 2014

Botnet Statistics [2014-08-06]

detection period: 2014-08-06 00:00-23:59 UTC
total number of suspected botnet IPs: 2425
number of botnet IPs notified to network operators: 2279
number of spam blocked: 97771
recipient count of spam blocked: 2818835

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	969
2	CRTC	146
3	SPEEDVM-NETWORK-GROUP	118
4	WASU	85
5	Wotone	75
6	CHINANET-GD	62
7	UNICOM-ZJ	57
8	WASU-BB	48
9	VNPT-VNNIC-VN	46
10	CHINANET-HB	33

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	976
2	China	642
3	United States	207
4	Viet Nam	72
5	Russian Federation	56
6	India	50
7	Brazil	28
8	Italy	27
9	South Korea	22
10	Indonesia	21

Wednesday, August 6, 2014

Suspected Bot List [2014-08-05]

detection period: 2014-08-05 00:00-23:59 UTC
number of suspected bots' IPs listed here: 244

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AL	217.24.253.251	Albania
BD	180.211.180.18	Bangladesh
GR	89.210.13.196	Greece
HN	190.107.140.77	Honduras
IN	27.5.182.53	India
IN	117.218.165.135	India
IN	117.245.95.252	India
IN	125.21.245.146	India
IN	202.62.67.250	India
IN	203.90.114.228	India
IR	82.99.220.219	Iran
IR	91.98.147.62	Iran
IR	194.33.124.77	Iran
IT	31.199.192.17	Italy
IT	31.199.192.20	Italy
IT	31.199.192.150	Italy
IT	95.227.105.203	Italy
LB	194.126.140.247	Lebanon
LV	85.9.201.199	Latvia
PH	58.69.100.234	Philippines
PH	122.54.80.66	Philippines
PK	221.120.222.69	Pakistan
RU	109.167.201.26	Russian Federation
SA	94.77.199.148	Saudi Arabia
SE	80.78.31.131	Sweden
SG	116.251.209.131	Singapore
TR	193.255.143.62	Turkey
UA	109.251.56.82	Ukraine
US	50.201.42.106	United States
US	174.139.94.82	United States

List from greylisting:

Botnet Statistics [2014-08-05]

detection period: 2014-08-05 00:00-23:59 UTC
total number of suspected botnet IPs: 2494
number of botnet IPs notified to network operators: 2250
number of spam blocked: 61390
recipient count of spam blocked: 1981802

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	973
2	CRTC	134
3	CHINANET-GD	78
4	UNICOM-ZJ	64
5	Wotone	51
6	VNPT-VNNIC-VN	36
7	WASU	34
8	SPEEDVM-NETWORK-GROUP	24
9	CHINANET-HB	24
10	UNICOM-SD	22

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	980
2	China	551
3	United States	168
4	India	97
5	Viet Nam	71
6	Brazil	47
7	United Kingdom	40
8	Russian Federation	34
9	Italy	34
10	Argentina	34