Daily Botnet Statistics

Monday, December 2, 2019

Suspected Bot List [2019-12-01]

detection period: 2019-12-01 00:00-23:59 UTC
number of suspected bots' IPs listed here: 761

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-11-30]

detection period: 2019-11-30 00:00-23:59 UTC
total number of suspected botnet IPs: 18895
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18172
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	714
2	Baidu	578
3	TENCENT-CN	564
4	KORNET	292
5	HINET-NET	265
6	CHINANET-JS	265
7	VNPT-VN	230
8	DO-13	211
9	VIETTEL-VN	207
10	DIGITALOCEAN-12	198

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4806
2	United States	2222
3	India	901
4	Brazil	796
5	Russian Federation	740
6	France	739
7	Viet Nam	684
8	South Korea	466
9	Indonesia	429
10	Singapore	389

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	93594
2	22	58161
3	23	24003
4	222	19662
5	8222	18095
6	26	16206
7	1433	14140
8	2200	10116
9	2205	9476
10	3389	9371

Suspected Bot List [2019-11-30]

detection period: 2019-11-30 00:00-23:59 UTC
number of suspected bots' IPs listed here: 723