Custom Search

Friday, January 1, 2016

Botnet Statistics for December 2015

detection period: 2015-12-01 00:00 - 2015-12-31 23:59 UTC
total number of suspected botnet IPs: 43006
number of blocked spams: 829301
recipient count of blocked spams: 8967433

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1China36694
2Taiwan2090
3Viet Nam1559
4United States364
5India273
6Russian Federation238
7Brazil185
8Ukraine131
9Turkey117
10Indonesia95
11Romania87
12Argentina80
13Kazakhstan63
14Germany61
15Mexico60
16South Korea60
17Poland57
18Iran46
19Thailand45
20United Kingdom34
21Hong Kong33
22Spain31
23Israel28
24Colombia28
25Bulgaria27

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

RankCountry# of blocked spams
1United States408104
2Taiwan182049
3China88167
4Brazil69623
5Russian Federation14105
6United Kingdom11264
7Germany9505
8Thailand7029
9Sweden6293
10Mexico5901
11Spain4654
12Antigua And Barbuda4281
13India3090
14Turkey2863
15France1880
16Canada1695
17Norway1175
18Argentina1115
19Israel920
20Ireland889
21Tunisia846
22Netherlands819
23Italy693
24Colombia596
25Chile509

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Suspected Bot List [2015-12-31]

detection period: 2015-12-31 00:00-23:59 UTC
number of suspected bots' IPs listed here: 27

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
AR190.178.154.45Argentina
US198.144.189.140United States
US198.144.189.149United States

List from greylisting:

country codeIP addressCountry
AR181.177.25.175Argentina
AR186.59.10.86Argentina
AR186.128.76.240Argentina
AR190.17.135.3Argentina
AR190.193.195.196Argentina
AR190.246.234.51Argentina
AR200.127.194.46Argentina
CM197.159.0.70Cameroon
DZ105.104.8.231Algeria
ES87.235.177.251Spain
IN117.202.96.27India
IN117.204.137.203India
IN117.205.253.240India
IN117.215.166.86India
IN117.216.65.6India
IN122.171.48.127India
IN122.176.25.175India
IN122.252.236.142India
RO89.165.206.194Romania
RS178.149.98.229Serbia
TR31.155.243.222Turkey
TW123.194.241.175Taiwan
US65.185.188.244United States
US104.223.2.202United States

Botnet Statistics [2015-12-31]

detection period: 2015-12-31 00:00-23:59 UTC
total number of suspected botnet IPs: 2450
number of botnet IPs notified to network operators: 2423
number of spam blocked: 122223
recipient count of spam blocked: 322492

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1CHINANET-AH655
2CHINANET-JS344
3CHINANET-ZJ-JH326
4CHINANET-SC209
5UNICOM-AH207
6CHINANET-HB201
7CHINANET-ZJ140
8VNPT-VNNIC-VN78
9CHINANET-GD29
10VIETEL-VNNIC-VN15

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1China2170
2Viet Nam141
3United States17
4Ukraine13
5Russian Federation13
6Brazil12
7India11
8Argentina8
9Taiwan7
10Turkey4