Custom Search

Wednesday, January 13, 2016

Botnet Statistics [2016-01-12]

detection period: 2016-01-12 00:00-23:59 UTC
total number of suspected botnet IPs: 915
number of botnet IPs notified to network operators: 891
number of spam blocked: 15575
recipient count of spam blocked: 76588

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1CHINANET-AH182
2CHINANET-ZJ-JH122
3CHINANET-ZJ111
4UNICOM-AH73
5CHINANET-HB71
6CHINANET-JS62
7VNPT-VNNIC-VN39
8CHINANET-SC36
9CHINANET-GD29
10VIETEL-VNNIC-VN13

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1China728
2Viet Nam84
3United States15
4Taiwan12
5Russian Federation10
6India7
7Argentina7
8Indonesia5
9Hong Kong4
10Brazil4

Tuesday, January 12, 2016

Suspected Bots' IP List for December 2015

To encourage cyber security information sharing (as some form of open data) while still giving victims enough time to clean up their computers, the IP list of suspected infected computers will be released here (as shown below). You are free to use them to create more effective defenses, discover latest trends in cyber attacks, etc.

Suspected Bots IP [2015-12-01]
Suspected Bots IP [2015-12-02]
Suspected Bots IP [2015-12-03]
Suspected Bots IP [2015-12-04]
Suspected Bots IP [2015-12-05]
Suspected Bots IP [2015-12-06]
Suspected Bots IP [2015-12-07]
Suspected Bots IP [2015-12-08]
Suspected Bots IP [2015-12-09]
Suspected Bots IP [2015-12-10]
Suspected Bots IP [2015-12-11]
Suspected Bots IP [2015-12-12]
Suspected Bots IP [2015-12-13]
Suspected Bots IP [2015-12-14]
Suspected Bots IP [2015-12-15]
Suspected Bots IP [2015-12-16]
Suspected Bots IP [2015-12-17]
Suspected Bots IP [2015-12-18]
Suspected Bots IP [2015-12-19]
Suspected Bots IP [2015-12-20]
Suspected Bots IP [2015-12-21]
Suspected Bots IP [2015-12-22]
Suspected Bots IP [2015-12-23]
Suspected Bots IP [2015-12-24]
Suspected Bots IP [2015-12-25]
Suspected Bots IP [2015-12-26]
Suspected Bots IP [2015-12-27]
Suspected Bots IP [2015-12-28]
Suspected Bots IP [2015-12-29]
Suspected Bots IP [2015-12-30]
Suspected Bots IP [2015-12-31]

Suspected Bot List [2016-01-11]

detection period: 2016-01-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 29

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
AR186.138.82.251Argentina
GR62.38.135.44Greece
PK116.90.106.129Pakistan

List from greylisting:

country codeIP addressCountry
AR186.38.25.2Argentina
AR186.61.38.29Argentina
AR190.182.234.95Argentina
AR190.193.93.237Argentina
AR190.246.170.71Argentina
AZ91.135.252.178Azerbaijan
BR187.45.216.250Brazil
BR187.45.249.76Brazil
BR189.126.113.138Brazil
CM197.159.0.70Cameroon
DZ193.194.92.3Algeria
ES83.230.182.35Spain
ES87.235.177.251Spain
IN122.168.95.92India
IN122.172.76.177India
IN182.70.109.20India
IN223.234.192.28India
MX189.196.5.24Mexico
PH122.52.15.54Philippines
PK175.107.6.190Pakistan
PK182.187.116.87Pakistan
RO109.102.17.195Romania
TR213.142.146.29Turkey
UA176.121.242.238Ukraine
US23.28.33.176United States
US162.144.34.20United States