Custom Search

Monday, March 2, 2015

Botnet Statistics [2015-03-01]

detection period: 2015-03-01 00:00-23:59 UTC
total number of suspected botnet IPs: 1513
number of botnet IPs notified to network operators: 1464
number of spam blocked: 141942
recipient count of spam blocked: 4941125

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1HINET-NET982
2UNICOM-GD110
3CHINANET-GD46
4ZJU-CN31
5CERNET-CN19
6UNICOM-FJ9
7CHINANET-JS7
8MINDSPRING-DEDA-C3006
9CHINANET-ZJ5
10UNICOM-SD4

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1Taiwan988
2China297
3United States41
4Russian Federation19
5Indonesia18
6Hong Kong12
7South Korea10
8Iran10
9Brazil9
10Viet Nam8

Sunday, March 1, 2015

Suspected Bot List [2015-02-28]

detection period: 2015-02-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 46

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
BD203.76.147.70Bangladesh
EC201.219.60.85Ecuador
EC201.219.60.118Ecuador
ID103.11.23.2Indonesia
ID114.6.45.106Indonesia
ID116.68.251.238Indonesia
ID118.97.175.114Indonesia
ID119.82.240.46Indonesia
ID119.252.166.100Indonesia
ID182.30.250.64Indonesia
ID202.77.96.120Indonesia
ID202.77.108.60Indonesia
ID202.95.148.206Indonesia
ID202.137.230.127Indonesia
ID202.137.230.134Indonesia
ID202.138.249.215Indonesia
ID202.148.7.77Indonesia
ID202.150.139.134Indonesia
ID202.150.157.34Indonesia
ID202.162.213.162Indonesia
ID203.201.172.162Indonesia
IN117.239.146.215India
IN202.63.113.12India
IR82.99.220.219Iran
MN203.91.119.146Mongolia
PE200.1.183.82Peru
PH58.69.100.234Philippines
RU95.188.112.11Russian Federation
RU193.107.17.59Russian Federation
SG27.34.180.25Singapore
SG203.175.170.81Singapore
TR88.247.164.136Turkey
TR88.250.69.146Turkey
TW180.218.34.245Taiwan
US96.35.58.176United States
US208.69.31.250United States
US208.73.202.157United States
US209.220.168.177United States

List from greylisting:

Botnet Statistics [2015-02-28]

detection period: 2015-02-28 00:00-23:59 UTC
total number of suspected botnet IPs: 1375
number of botnet IPs notified to network operators: 1329
number of spam blocked: 127802
recipient count of spam blocked: 4535746

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1HINET-NET870
2UNICOM-GD113
3CHINANET-GD64
4ZJU-CN20
5UNICOM-FJ7
6KORNET-KR6
7CHINANET-JS6
8CERNET-CN6
9UNICOM-SD4
10TR-TELEKOM-200510274

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1Taiwan876
2China298
3United States31
4Indonesia20
5Russian Federation16
6South Korea12
7Hong Kong12
8Iran11
9Brazil9
10Turkey7