Daily Botnet Statistics

Wednesday, March 2, 2016

Botnet Statistics [2016-03-01]

detection period: 2016-03-01 00:00-23:59 UTC
total number of suspected botnet IPs: 1541
number of botnet IPs notified to network operators: 1509
number of spam blocked: 7165
recipient count of spam blocked: 55364

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	395
2	SONET-NET	176
3	WASU	120
4	UNICOM-ZJ	103
5	CHINANET-JS	95
6	WASU-BB	73
7	NCICNET-NET	58
8	CHINANET-GD	38
9	CHINANET-ZJ	35
10	VNPT-VNNIC-VN	28

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	663
2	China	584
3	Viet Nam	47
4	United States	36
5	Brazil	30
6	Russian Federation	26
7	India	25
8	Thailand	17
9	Indonesia	10
10	Turkey	8

Tuesday, March 1, 2016

Suspected Bot List [2016-02-29]

detection period: 2016-02-29 00:00-23:59 UTC
number of suspected bots' IPs listed here: 43

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
MO	60.246.58.65	Macau
MO	60.246.150.171	Macau
TR	85.105.164.203	Turkey

List from greylisting:

country code	IP address	Country
AR	190.9.17.210	Argentina
AR	190.105.26.235	Argentina
AR	200.41.178.234	Argentina
BD	203.76.149.74	Bangladesh
BO	186.27.126.130	Bolivia
CN	122.49.30.56	China
CR	201.202.246.162	Costa Rica
EG	193.227.49.83	Egypt
ID	103.254.105.98	Indonesia
IL	213.57.90.10	Israel
IN	27.4.67.183	India
IN	59.96.224.115	India
IN	59.99.249.63	India
IN	61.1.32.186	India
IN	106.202.38.236	India
IN	116.74.145.143	India
IN	117.194.106.177	India
IN	117.218.118.245	India
IN	117.223.138.34	India
IN	117.223.189.162	India
IN	117.244.55.235	India
IN	120.60.128.248	India
IN	122.167.82.41	India
IN	125.16.12.146	India
IN	180.211.126.178	India
IN	202.91.73.30	India
IN	202.164.59.83	India
IN	203.192.212.52	India
IN	203.194.109.142	India
IR	89.165.72.163	Iran
MX	200.94.75.212	Mexico
RU	213.33.255.26	Russian Federation
TR	88.247.28.227	Turkey
TR	195.175.61.110	Turkey
US	69.18.153.59	United States
US	71.14.212.34	United States
US	72.48.145.237	United States
UZ	84.54.97.2	Uzbekistan
VE	200.11.228.84	Venezuela
ZW	41.220.28.138	Zimbabwe

Botnet Statistics [2016-02-29]

detection period: 2016-02-29 00:00-23:59 UTC
total number of suspected botnet IPs: 1420
number of botnet IPs notified to network operators: 1377
number of spam blocked: 6535
recipient count of spam blocked: 61626

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	290
2	SONET-NET	138
3	WASU	119
4	UNICOM-ZJ	92
5	WASU-BB	89
6	CHINANET-JS	69
7	CHINANET-ZJ	46
8	CHINANET-GD	46
9	VNPT-VNNIC-VN	39
10	NCICNET-NET	37

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	588
2	Taiwan	497
3	Viet Nam	73
4	United States	38
5	India	30
6	Russian Federation	26
7	Thailand	23
8	Brazil	20
9	Indonesia	9
10	Hong Kong	9