Botnet Statistics for September 2017

detection period: 2017-09-01 00:00 - 2017-09-30 23:59 UTC
total number of suspected botnet IPs: 4286
number of blocked spams: 614627
recipient count of blocked spams: 4749324

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	2362
2	United States	552
3	India	221
4	Viet Nam	216
5	Brazil	72
6	Turkey	56
7	Mexico	54
8	Iran	50
9	Indonesia	45
10	South Korea	41
11	Italy	37
12	Colombia	36
13	Romania	32
14	Russian Federation	31
15	Taiwan	26
16	Pakistan	22
17	Chile	22
18	Bulgaria	21
19	Argentina	20
20	Thailand	18
21	Spain	17
22	Japan	14
23	Australia	14
24	Canada	13
25	Bolivia	13

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	United States	270485
2	China	140539
3	United Kingdom	36928
4	Netherlands	36139
5	Brazil	14301
6	Ukraine	13128
7	Russian Federation	13123
8	Tunisia	12617
9	Canada	11729
10	Romania	8219
11	Germany	6869
12	Hong Kong	5770
13	Singapore	5265
14	Poland	4739
15	Turkey	4511
16	India	3638
17	Bulgaria	3482
18	Republic Of Moldova	3053
19	Hungary	2782
20	South Korea	2539
21	Albania	2292
22	Estonia	1990
23	Taiwan	1767
24	Saint Kitts And Nevis	1606
25	Thailand	952

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2017-09-30]

detection period: 2017-09-30 00:00-23:59 UTC
total number of suspected botnet IPs: 162
number of botnet IPs notified to network operators: 151
number of spam blocked: 28310
recipient count of spam blocked: 695056

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	Baidu	52
2	CMNET	10
3	CHINANET-JS	10
4	ALISOFT	6
5	CHINANET-GD	5
6	CHINANET-ZJ-NB	4
7	CHINANET-HB	4
8	CHINANET-FJ	4
9	UNIFIEDLAYER-NETWORK-14	3
10	CHINANET-ZJ	3

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	104
2	United States	9
3	Russian Federation	5
4	India	5
5	South Korea	4
6	Viet Nam	3
7	Pakistan	3
8	Mexico	3
9	Tunisia	2
10	Italy	2

Suspected Bot List [2017-09-30]

detection period: 2017-09-30 00:00-23:59 UTC
number of suspected bots' IPs listed here: 11

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
RU	185.127.25.68	Russian Federation
US	206.125.41.139	United States

List from greylisting: