Custom Search

Wednesday, December 2, 2015

Botnet Statistics [2015-12-01]

detection period: 2015-12-01 00:00-23:59 UTC
total number of suspected botnet IPs: 1299
number of botnet IPs notified to network operators: 1274
number of spam blocked: 42749
recipient count of spam blocked: 261338

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1CHINANET-AH159
2UNICOM-ZJ152
3CHINANET-ZJ-JH129
4CHINANET-SC115
5WASU96
6CHINANET-HB87
7CHINANET-ZJ86
8WASU-BB82
9UNICOM-AH66
10CHINANET-JS60

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1China1155
2United States20
3Viet Nam9
4Brazil8
5Argentina7
6Taiwan6
7Russian Federation6
8India6
9Colombia6
10Ukraine4

Tuesday, December 1, 2015

Suspected Bot List [2015-11-30]

detection period: 2015-11-30 00:00-23:59 UTC
number of suspected bots' IPs listed here: 25

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
AR190.178.152.172Argentina
MX187.141.118.20Mexico
MX189.242.104.72Mexico
US50.255.96.65United States

List from greylisting:

country codeIP addressCountry
AR181.29.6.177Argentina
AR181.118.199.135Argentina
AR181.230.106.6Argentina
AR186.182.189.41Argentina
AR190.193.1.185Argentina
AR201.212.154.67Argentina
BD180.210.130.16Bangladesh
CM41.202.221.42Cameroon
ES87.235.177.251Spain
ES188.84.80.78Spain
ID119.252.172.194Indonesia
ID202.162.214.108Indonesia
IN61.0.56.49India
IN61.0.87.241India
IN182.74.201.70India
IR91.98.24.140Iran
MX148.244.92.58Mexico
RO109.98.160.144Romania
RO109.100.183.123Romania
RU5.19.182.236Russian Federation
US162.144.104.214United States

Botnet Statistics [2015-11-30]

detection period: 2015-11-30 00:00-23:59 UTC
total number of suspected botnet IPs: 1443
number of botnet IPs notified to network operators: 1418
number of spam blocked: 50629
recipient count of spam blocked: 280494

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1CHINANET-AH171
2UNICOM-ZJ161
3WASU135
4CHINANET-ZJ-JH131
5CHINANET-HB118
6CHINANET-SC115
7CHINANET-ZJ94
8UNICOM-AH90
9WASU-BB72
10CHINANET-JS70

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1China1263
2Viet Nam33
3United States25
4Russian Federation15
5Brazil11
6Turkey7
7India7
8Argentina7
9Taiwan5
10Thailand5