Custom Search

Thursday, March 3, 2016

Botnet Statistics [2016-03-02]

detection period: 2016-03-02 00:00-23:59 UTC
total number of suspected botnet IPs: 1320
number of botnet IPs notified to network operators: 1284
number of spam blocked: 10640
recipient count of spam blocked: 70262

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1HINET-NET263
2UNICOM-ZJ124
3SONET-NET115
4WASU86
5CHINANET-GD71
6CHINANET-JS54
7WASU-BB53
8UNICOM-AH47
9VNPT-VNNIC-VN42
10CHINANET-ZJ31

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1China590
2Taiwan431
3Viet Nam71
4Brazil26
5United States20
6Russian Federation20
7India19
8Thailand17
9Ukraine7
10Indonesia7

Wednesday, March 2, 2016

Botnet Statistics for February 2016

detection period: 2016-02-01 00:00 - 2016-02-29 23:59 UTC
total number of suspected botnet IPs: 13376
number of blocked spams: 388337
recipient count of blocked spams: 9090102

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1Taiwan4106
2China3853
3Viet Nam1760
4India430
5United States375
6Brazil287
7Thailand277
8Russian Federation256
9Mexico249
10Indonesia139
11Ukraine137
12Turkey129
13Romania124
14Iran75
15Poland74
16Argentina59
17Germany54
18Kazakhstan48
19South Korea44
20Israel39
21Hong Kong39
22United Kingdom36
23Colombia32
24Italy31
25Spain30

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

RankCountry# of blocked spams
1Taiwan221669
2Mexico56850
3Poland30866
4China24873
5United States8269
6Hong Kong7656
7Thailand5938
8Viet Nam5576
9Sweden3942
10Turkey3508
11India2014
12France1863
13Bolivia1760
14South Korea1527
15Russian Federation1445
16Iran1036
17Canada1034
18Uruguay993
19Saudi Arabia904
20Macau856
21Brazil763
22Argentina684
23Indonesia634
24Romania604
25Colombia580

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Suspected Bot List [2016-03-01]

detection period: 2016-03-01 00:00-23:59 UTC
number of suspected bots' IPs listed here: 33

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
IL213.57.90.10Israel
MO113.52.92.248Macau
TR85.105.15.50Turkey

List from greylisting:

country codeIP addressCountry
AR186.137.28.202Argentina
AR200.41.178.234Argentina
BO186.27.126.130Bolivia
CN122.49.30.56China
CR201.202.246.162Costa Rica
EG193.227.49.83Egypt
ID202.162.214.116Indonesia
IL213.57.90.10Israel
IN59.90.111.127India
IN59.94.147.131India
IN117.206.79.176India
IN117.223.242.164India
IN117.242.188.101India
IN117.247.186.189India
IN122.160.145.150India
IN122.164.197.17India
IN122.170.105.219India
IN122.176.25.91India
IN125.16.12.146India
IN182.68.116.73India
IN182.69.79.141India
IN203.192.212.52India
IN203.194.109.142India
KE197.237.57.204Kenya
MX200.94.75.212Mexico
PH121.97.139.252Philippines
PH122.53.178.100Philippines
PH125.212.43.196Philippines
UA193.107.130.143Ukraine
US66.84.56.49United States