Daily Botnet Statistics

Wednesday, October 2, 2019

Suspected Bot List [2019-10-01]

detection period: 2019-10-01 00:00-23:59 UTC
number of suspected bots' IPs listed here: 692

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
CA	51.79.86.150	Canada

List from TCP port scans:

Botnet Statistics [2019-09-30]

detection period: 2019-09-30 00:00-23:59 UTC
total number of suspected botnet IPs: 15301
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 14429
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TENCENT-CN	500
2	TencentCloud	472
3	Baidu	458
4	KORNET	322
5	HINET-NET	320
6	DO-13	216
7	DIGITALOCEAN-12	209
8	VNPT-VN	199
9	OVH	178
10	CMNET	165

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	3506
2	United States	1914
3	France	801
4	Russian Federation	639
5	India	573
6	Viet Nam	549
7	Brazil	543
8	South Korea	523
9	Indonesia	447
10	Taiwan	384

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	19411
2	23	15865
3	445	15297
4	3389	11894
5	2200	5838
6	8080	5137
7	222	5120
8	2222	4982
9	5900	4978
10	7123	4965

Suspected Bot List [2019-09-30]

detection period: 2019-09-30 00:00-23:59 UTC
number of suspected bots' IPs listed here: 872