Suspected Bot List [2014-09-02]

detection period: 2014-09-02 00:00-23:59 UTC
number of suspected bots' IPs listed here: 418

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	200.63.164.22	Argentina
BD	203.76.147.70	Bangladesh
IN	27.5.182.53	India
IN	202.62.67.254	India
IN	203.90.114.228	India
IR	91.98.147.62	Iran
IR	194.33.124.77	Iran
IT	31.199.192.17	Italy
IT	31.199.192.20	Italy
IT	95.227.105.203	Italy
PE	200.110.35.150	Peru
PH	58.69.100.234	Philippines
PH	124.107.165.60	Philippines
PK	103.4.92.88	Pakistan
PK	221.120.222.69	Pakistan
SA	94.77.199.148	Saudi Arabia
TR	88.247.164.136	Turkey
US	50.201.42.106	United States
US	68.119.62.142	United States

List from greylisting:

Botnet Statistics [2014-09-02]

detection period: 2014-09-02 00:00-23:59 UTC
total number of suspected botnet IPs: 3153
number of botnet IPs notified to network operators: 2735
number of spam blocked: 102993
recipient count of spam blocked: 3007222

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1180
2	VNPT-VNNIC-VN	180
3	CRTC	161
4	WASU	63
5	VIETEL-VNNIC-VN	51
6	AR-TEAR7-LACNIC	45
7	CHINANET-GD	44
8	KORNET-KR	43
9	PE-TPSA-LACNIC	42
10	CHINANET-HB	32

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	1202
2	China	485
3	Viet Nam	291
4	South Korea	95
5	Argentina	87
6	Peru	85
7	Brazil	80
8	Colombia	68
9	United States	63
10	India	62

Suspected Bot List [2014-09-01]

detection period: 2014-09-01 00:00-23:59 UTC
number of suspected bots' IPs listed here: 78

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
BD	203.76.147.70	Bangladesh
IN	27.5.182.53	India
IN	202.62.67.254	India
IN	203.90.114.228	India
IR	91.98.147.62	Iran
IR	194.33.124.77	Iran
IT	31.199.192.17	Italy
IT	31.199.192.20	Italy
IT	95.227.105.203	Italy
PE	200.110.35.150	Peru
PH	58.69.100.234	Philippines
PH	124.107.165.60	Philippines
PK	103.4.92.88	Pakistan
PK	221.120.222.69	Pakistan
SA	94.77.199.148	Saudi Arabia
TR	88.247.164.136	Turkey
US	50.201.42.106	United States
UZ	89.236.219.106	Uzbekistan

List from greylisting: