Custom Search

Wednesday, September 2, 2015

Botnet Statistics [2015-09-01]

detection period: 2015-09-01 00:00-23:59 UTC
total number of suspected botnet IPs: 3782
number of botnet IPs notified to network operators: 3702
number of spam blocked: 143299
recipient count of spam blocked: 3866553

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1HINET-NET1024
2CHINANET-GD436
3CHINANET-JS202
4CHINANET-HN166
5WASU140
6CHINANET-LN140
7UNICOM-ZJ136
8CHINANET-SX125
9WASU-BB116
10VNPT-VNNIC-VN101

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1China2019
2Taiwan1033
3Viet Nam199
4United States109
5Brazil50
6India38
7Ukraine32
8Russian Federation27
9Indonesia17
10Germany17
Labels:
Posted by at No comments:

Tuesday, September 1, 2015

Suspected Bot List [2015-08-31]

detection period: 2015-08-31 00:00-23:59 UTC
number of suspected bots' IPs listed here: 69

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
AM5.77.222.183Armenia
AM46.241.194.139Armenia
AR190.104.232.112Argentina
AR190.176.152.14Argentina
BO186.27.126.130Bolivia
EG193.227.49.83Egypt
IN59.90.91.95India
IN122.170.105.219India
MA41.137.19.3Morocco
SV201.247.149.77El Salvador
US24.181.221.172United States
US68.188.100.100United States
US69.144.223.99United States
US74.131.25.162United States
US184.167.56.70United States

List from greylisting:

country codeIP addressCountry
AM46.241.194.139Armenia
AR186.182.66.112Argentina
AR190.2.36.165Argentina
AR190.11.205.130Argentina
AR190.104.232.112Argentina
AR190.178.67.144Argentina
AR190.178.88.25Argentina
AR190.185.134.117Argentina
AR190.189.175.131Argentina
AR190.191.110.78Argentina
AR200.127.21.69Argentina
AR201.231.200.54Argentina
BG77.70.114.134Bulgaria
BG89.253.150.31Bulgaria
BR150.161.21.211Brazil
EE88.196.182.180Estonia
EG193.227.49.83Egypt
ES87.235.177.251Spain
ES212.170.208.65Spain
IN117.193.3.167India
IN117.214.0.71India
IN117.217.20.89India
IN117.223.48.231India
IN117.247.50.6India
IN117.247.122.1India
IN120.62.181.188India
IN122.170.105.219India
IN182.69.210.199India
IN210.212.215.35India
MA197.144.34.8Morocco
MA212.217.2.8Morocco
MX177.240.78.33Mexico
MX187.235.152.79Mexico
MX189.199.65.79Mexico
PH49.148.152.20Philippines
PK39.32.185.246Pakistan
PK39.47.172.253Pakistan
PK124.29.207.19Pakistan
PK182.187.73.171Pakistan
RO92.84.1.32Romania
RU5.19.139.21Russian Federation
RU95.71.123.161Russian Federation
SV201.247.149.77El Salvador
TR46.2.216.92Turkey
TR213.248.175.118Turkey
TT190.58.249.4Trinidad/Tobago
US24.181.221.172United States
US68.188.100.100United States
US69.144.223.99United States
US74.131.25.162United States
US96.39.42.106United States
US142.4.9.32United States
UY167.58.47.138Uruguay
UY186.48.148.193Uruguay

Labels:
Posted by at No comments:

Botnet Statistics [2015-08-31]

detection period: 2015-08-31 00:00-23:59 UTC
total number of suspected botnet IPs: 3421
number of botnet IPs notified to network operators: 3361
number of spam blocked: 254176
recipient count of spam blocked: 4943889

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1HINET-NET1027
2CHINANET-GD495
3WASU191
4WASU-BB169
5CHINANET-JS155
6CHINANET-HN132
7UNICOM-ZJ122
8CHINANET-LN86
9CHINANET-SX80
10CHINANET-YN78

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1China1876
2Taiwan1033
3Viet Nam136
4United States60
5Brazil60
6Russian Federation34
7Ukraine26
8India26
9Indonesia15
10Argentina12
Labels:
Posted by at No comments:
Subscribe to: Posts (Atom)