Daily Botnet Statistics

Wednesday, February 1, 2017

Botnet Statistics for January 2017

detection period: 2017-01-01 00:00 - 2017-01-31 23:59 UTC
total number of suspected botnet IPs: 5730
number of blocked spams: 551596
recipient count of blocked spams: 2283929

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	4192
2	Taiwan	520
3	United States	111
4	Brazil	100
5	Russian Federation	66
6	Italy	58
7	India	57
8	Viet Nam	50
9	Germany	38
10	Colombia	33
11	United Kingdom	30
12	Argentina	26
13	South Korea	24
14	Ukraine	22
15	Spain	22
16	Japan	20
17	Indonesia	19
18	Romania	17
19	Poland	17
20	Netherlands	17
21	Mexico	14
22	Armenia	14
23	France	13
24	Turkey	12
25	Pakistan	12

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	Taiwan	239181
2	China	167396
3	United States	112297
4	Poland	8544
5	Brazil	3225
6	Colombia	2519
7	India	2439
8	Russian Federation	1773
9	South Korea	1287
10	Chile	930
11	Macau	859
12	Italy	703
13	Bangladesh	620
14	Azerbaijan	578
15	Netherlands	543
16	South Africa	517
17	Cambodia	504
18	El Salvador	486
19	Ukraine	484
20	Pakistan	449
21	Kazakhstan	430
22	Bolivia	409
23	Saudi Arabia	404
24	Argentina	383
25	United Kingdom	368

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Suspected Bot List [2017-01-31]

detection period: 2017-01-31 00:00-23:59 UTC
number of suspected bots' IPs listed here: 25

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	181.231.28.20	Argentina
AR	190.104.231.246	Argentina
BO	186.27.126.130	Bolivia
CO	190.60.234.186	Colombia
CO	190.242.119.220	Colombia
IN	125.16.240.197	India
IN	203.192.212.52	India
IN	223.196.86.228	India
KZ	185.19.194.234	Kazakhstan
SA	212.12.175.222	Saudi Arabia
TW	106.1.195.68	Taiwan
TW	118.232.62.225	Taiwan
TW	118.233.116.192	Taiwan
TW	123.194.119.227	Taiwan
US	206.125.41.139	United States
US	206.125.47.5	United States
US	206.125.47.7	United States
ZA	196.46.23.122	South Africa

List from greylisting:

Botnet Statistics [2017-01-31]

detection period: 2017-01-31 00:00-23:59 UTC
total number of suspected botnet IPs: 665
number of botnet IPs notified to network operators: 642
number of spam blocked: 21465
recipient count of spam blocked: 355215

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	78
2	CHINANET-JS	48
3	UNICOM-SD	46
4	UNICOM-GX	40
5	UNICOM-LN	20
6	UNICOM-SX	18
7	UNICOM-HA	13
8	UNICOM-GD	11
9	CHINANET-YN	11
10	CHINANET-GZ	11

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	419
2	Taiwan	114
3	Brazil	18
4	United States	17
5	Russian Federation	14
6	Germany	11
7	Ukraine	6
8	India	6
9	Colombia	6
10	South Korea	4