Suspected Bot List [2016-02-28]

detection period: 2016-02-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 16

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
MO	60.246.58.65	Macau

List from greylisting:

country code	IP address	Country
AR	200.41.178.234	Argentina
BO	186.27.126.130	Bolivia
CR	201.202.246.162	Costa Rica
EG	41.32.191.122	Egypt
EG	193.227.49.83	Egypt
IL	213.57.90.10	Israel
IN	59.90.111.127	India
IN	117.244.41.87	India
IN	125.16.12.146	India
IN	203.192.212.52	India
IN	203.194.109.142	India
IN	223.227.141.37	India
MX	189.211.231.62	Mexico
MX	200.94.75.212	Mexico
RS	89.216.126.28	Serbia

Botnet Statistics [2016-02-28]

detection period: 2016-02-28 00:00-23:59 UTC
total number of suspected botnet IPs: 919
number of botnet IPs notified to network operators: 903
number of spam blocked: 2547
recipient count of spam blocked: 60328

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	131
2	UNICOM-ZJ	91
3	WASU	75
4	SONET-NET	64
5	WASU-BB	44
6	CHINANET-ZJ	33
7	CHINANET-GD	27
8	VNPT-VNNIC-VN	25
9	NCICNET-NET	20
10	CHINANET-SH	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	400
2	Taiwan	239
3	Viet Nam	56
4	United States	26
5	Brazil	24
6	Russian Federation	22
7	Thailand	16
8	South Korea	13
9	Indonesia	12
10	India	10

Suspected Bot List [2016-02-27]

detection period: 2016-02-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 33

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	186.138.82.251	Argentina
IL	213.57.90.10	Israel
MO	60.246.58.65	Macau

List from greylisting:

country code	IP address	Country
AR	190.19.203.150	Argentina
AR	200.41.178.234	Argentina
BO	186.27.126.130	Bolivia
BW	168.167.88.5	Botswana
CR	201.202.246.162	Costa Rica
EG	193.227.49.83	Egypt
IL	213.57.90.10	Israel
IN	59.90.111.127	India
IN	61.0.154.131	India
IN	112.133.245.25	India
IN	112.133.249.13	India
IN	117.202.158.213	India
IN	117.223.94.199	India
IN	117.244.15.243	India
IN	117.253.227.196	India
IN	122.163.150.95	India
IN	122.172.39.33	India
IN	125.16.12.146	India
IN	202.142.126.186	India
IN	203.192.212.52	India
IN	203.194.109.142	India
MG	41.63.129.101	Madagascar
MX	200.94.75.212	Mexico
PK	39.54.186.155	Pakistan
RO	109.102.64.55	Romania
RS	89.216.126.28	Serbia
SG	49.213.16.207	Singapore
TR	109.235.251.130	Turkey
UZ	213.230.93.156	Uzbekistan
VE	200.11.228.84	Venezuela

Botnet Statistics [2016-02-27]

detection period: 2016-02-27 00:00-23:59 UTC
total number of suspected botnet IPs: 965
number of botnet IPs notified to network operators: 933
number of spam blocked: 3240
recipient count of spam blocked: 81163

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	136
2	WASU	114
3	SONET-NET	83
4	UNICOM-ZJ	64
5	WASU-BB	42
6	VNPT-VNNIC-VN	37
7	CHINANET-ZJ	29
8	CHINANET-GD	23
9	NCICNET-NET	18
10	UNICOM-HA	14

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	370
2	Taiwan	256
3	Viet Nam	76
4	Brazil	37
5	United States	29
6	India	25
7	Thailand	22
8	Russian Federation	20
9	Indonesia	14
10	Romania	9

Suspected Bot List [2016-02-26]

detection period: 2016-02-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 20

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country
AR	200.41.178.234	Argentina
BO	186.27.126.130	Bolivia
DZ	213.140.59.151	Algeria
ID	202.162.214.116	Indonesia
IN	117.99.164.162	India
IN	117.218.118.245	India
IN	122.164.185.163	India
IN	122.168.199.145	India
IN	122.170.68.88	India
IN	125.18.236.210	India
IN	203.192.212.52	India
IN	203.194.109.142	India
MX	200.94.75.212	Mexico
PH	122.3.14.94	Philippines
PL	188.146.89.207	Poland
RO	109.100.247.188	Romania
TR	85.105.20.121	Turkey
TR	85.105.223.152	Turkey
TR	85.105.248.165	Turkey
TR	109.235.251.130	Turkey

Botnet Statistics [2016-02-26]

detection period: 2016-02-26 00:00-23:59 UTC
total number of suspected botnet IPs: 1232
number of botnet IPs notified to network operators: 1212
number of spam blocked: 3170
recipient count of spam blocked: 72703

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	228
2	UNICOM-ZJ	169
3	WASU	155
4	SONET-NET	152
5	WASU-BB	102
6	NCICNET-NET	38
7	CHINANET-JS	33
8	CHINANET-ZJ	32
9	CHINANET-GD	30
10	VNPT-VNNIC-VN	20

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	590
2	Taiwan	440
3	Viet Nam	55
4	Brazil	17
5	United States	14
6	Thailand	13
7	India	11
8	Indonesia	10
9	Russian Federation	7
10	South Korea	7

Suspected Bot List [2016-02-25]

detection period: 2016-02-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 34

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
MO	60.246.58.65	Macau

List from greylisting:

country code	IP address	Country
AR	200.41.178.234	Argentina
AR	200.127.100.46	Argentina
BO	186.27.126.130	Bolivia
CR	201.202.246.162	Costa Rica
EG	193.227.49.83	Egypt
ES	87.235.177.251	Spain
IL	213.57.90.10	Israel
IN	59.90.111.127	India
IN	117.223.1.15	India
IN	117.239.196.29	India
IN	117.244.15.243	India
IN	122.160.202.109	India
IN	122.170.105.219	India
IN	125.99.93.6	India
IN	180.211.126.178	India
IN	182.56.5.137	India
IN	182.64.49.216	India
IN	182.68.72.79	India
IN	182.74.209.118	India
IN	182.75.110.30	India
IN	202.164.59.83	India
IN	203.192.212.52	India
IN	203.192.251.237	India
IN	203.194.109.142	India
MX	187.177.172.13	Mexico
MX	200.94.75.212	Mexico
RO	86.34.170.206	Romania
TR	78.189.108.188	Turkey
TR	85.105.45.172	Turkey
TR	109.235.251.130	Turkey
TR	212.156.85.182	Turkey
UY	167.62.47.91	Uruguay
VE	200.11.228.84	Venezuela
ZW	41.220.28.138	Zimbabwe

Botnet Statistics [2016-02-25]

detection period: 2016-02-25 00:00-23:59 UTC
total number of suspected botnet IPs: 1141
number of botnet IPs notified to network operators: 1106
number of spam blocked: 14916
recipient count of spam blocked: 88030

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-ZJ	163
2	WASU	119
3	HINET-NET	111
4	WASU-BB	93
5	CHINANET-JS	81
6	SONET-NET	68
7	VNPT-VNNIC-VN	25
8	CHINANET-GD	24
9	CHINANET-SH	23
10	NCICNET-NET	15

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	607
2	Taiwan	209
3	Viet Nam	58
4	Brazil	34
5	India	26
6	Russian Federation	25
7	United States	24
8	Thailand	13
9	Turkey	12
10	Indonesia	10

Suspected Bot List [2016-02-24]

detection period: 2016-02-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 44

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
IL	213.57.90.10	Israel
MO	60.246.58.65	Macau

List from greylisting:

country code	IP address	Country
AR	200.41.178.234	Argentina
AR	201.177.76.231	Argentina
BG	217.9.224.141	Bulgaria
BO	186.27.126.130	Bolivia
CR	201.202.246.162	Costa Rica
DZ	105.96.202.44	Algeria
EG	193.227.49.83	Egypt
ES	47.61.102.233	Spain
IL	213.57.90.10	Israel
IN	61.3.125.228	India
IN	117.194.203.250	India
IN	117.204.145.86	India
IN	117.213.116.204	India
IN	117.215.36.28	India
IN	117.221.75.117	India
IN	117.241.23.17	India
IN	117.244.15.243	India
IN	117.247.81.12	India
IN	117.248.72.153	India
IN	117.248.101.58	India
IN	120.60.79.81	India
IN	122.162.10.75	India
IN	122.170.105.219	India
IN	122.171.176.8	India
IN	122.173.88.132	India
IN	150.129.67.79	India
IN	180.211.126.178	India
IN	182.72.170.10	India
IN	182.75.202.214	India
IN	203.192.212.52	India
IN	203.194.109.142	India
KE	197.237.158.148	Kenya
MX	200.94.75.212	Mexico
PK	119.152.34.241	Pakistan
RO	92.84.88.129	Romania
RO	109.102.151.136	Romania
RO	109.103.215.36	Romania
TR	85.105.153.157	Turkey
TR	109.235.251.130	Turkey
US	174.45.173.197	United States
VE	200.11.228.84	Venezuela
ZW	41.220.28.138	Zimbabwe

Botnet Statistics [2016-02-24]

detection period: 2016-02-24 00:00-23:59 UTC
total number of suspected botnet IPs: 1228
number of botnet IPs notified to network operators: 1185
number of spam blocked: 29409
recipient count of spam blocked: 179899

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-ZJ	139
2	HINET-NET	125
3	WASU	103
4	VNPT-VNNIC-VN	78
5	WASU-BB	75
6	SONET-NET	65
7	CHINANET-JS	50
8	CHINANET-GD	35
9	NCICNET-NET	29
10	HINET	21

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	511
2	Taiwan	249
3	Viet Nam	137
4	Brazil	33
5	India	31
6	Russian Federation	30
7	United States	29
8	Thailand	28
9	Indonesia	21
10	Ukraine	13

Suspected Bot List [2016-02-23]

detection period: 2016-02-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 67

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
IL	213.57.90.10	Israel
US	96.37.145.122	United States

List from greylisting:

country code	IP address	Country
AL	213.207.47.78	Albania
AR	190.30.241.192	Argentina
AR	190.136.183.88	Argentina
AR	190.172.68.131	Argentina
AR	200.41.178.234	Argentina
AZ	91.135.246.97	Azerbaijan
BO	186.27.126.130	Bolivia
CR	201.202.246.162	Costa Rica
DZ	193.194.64.68	Algeria
EG	41.32.191.122	Egypt
EG	193.227.49.83	Egypt
ES	87.235.177.251	Spain
ID	103.254.105.98	Indonesia
ID	202.162.214.116	Indonesia
IL	213.57.90.10	Israel
IN	1.39.49.108	India
IN	1.39.84.27	India
IN	27.4.176.106	India
IN	59.90.92.192	India
IN	61.2.72.219	India
IN	61.12.20.178	India
IN	117.197.67.45	India
IN	117.197.104.132	India
IN	117.205.215.52	India
IN	117.206.129.202	India
IN	117.215.166.183	India
IN	117.217.159.240	India
IN	117.218.52.180	India
IN	117.244.15.243	India
IN	117.250.119.248	India
IN	120.57.251.185	India
IN	120.62.62.245	India
IN	122.163.104.192	India
IN	122.169.215.211	India
IN	122.170.44.137	India
IN	122.170.105.219	India
IN	122.171.65.113	India
IN	122.172.16.161	India
IN	122.172.47.13	India
IN	122.176.33.98	India
IN	122.178.23.177	India
IN	182.71.142.106	India
IN	202.142.70.122	India
IN	203.192.212.52	India
IN	203.194.109.142	India
ME	46.161.124.98	Montenegro
MO	122.100.136.74	Macau
MX	200.94.75.212	Mexico
PK	39.32.49.81	Pakistan
PK	175.107.196.135	Pakistan
PL	188.146.7.182	Poland
RO	89.165.206.194	Romania
RO	109.97.107.160	Romania
RO	109.98.165.125	Romania
RO	109.102.91.85	Romania
RS	77.105.24.43	Serbia
SV	190.86.253.9	El Salvador
TH	112.143.17.7	Thailand
TR	94.78.83.137	Turkey
TR	109.235.251.130	Turkey
US	98.126.12.226	United States
US	174.139.17.34	United States
US	174.139.28.146	United States
VE	200.11.228.84	Venezuela
ZW	41.220.28.138	Zimbabwe

Botnet Statistics [2016-02-23]

detection period: 2016-02-23 00:00-23:59 UTC
total number of suspected botnet IPs: 1327
number of botnet IPs notified to network operators: 1261
number of spam blocked: 31459
recipient count of spam blocked: 85906

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-JS	128
2	WASU	123
3	UNICOM-ZJ	123
4	WASU-BB	118
5	VNPT-VNNIC-VN	85
6	HINET-NET	69
7	SONET-NET	37
8	CHINANET-SH	25
9	NCICNET-NET	19
10	CHINANET-GD	18

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	647
2	Viet Nam	156
3	Taiwan	137
4	Brazil	56
5	India	44
6	United States	31
7	Thailand	29
8	Russian Federation	22
9	Ukraine	18
10	Indonesia	17

Suspected Bot List [2016-02-22]

detection period: 2016-02-22 00:00-23:59 UTC
number of suspected bots' IPs listed here: 34

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.0.163.135	Argentina

List from greylisting:

country code	IP address	Country
AR	181.29.185.42	Argentina
AR	200.41.178.234	Argentina
BO	186.27.126.130	Bolivia
CR	201.202.246.162	Costa Rica
DZ	193.194.64.68	Algeria
EG	41.32.191.122	Egypt
EG	193.227.49.83	Egypt
ID	103.254.105.98	Indonesia
ID	202.162.214.116	Indonesia
IL	213.57.90.10	Israel
IN	59.90.111.127	India
IN	59.92.165.60	India
IN	59.177.202.223	India
IN	110.224.197.236	India
IN	114.79.157.196	India
IN	117.199.64.43	India
IN	117.215.177.139	India
IN	117.218.50.134	India
IN	117.218.121.171	India
IN	117.218.232.51	India
IN	117.222.97.107	India
IN	117.239.196.29	India
IN	117.244.15.243	India
IN	117.245.26.205	India
IN	122.170.105.219	India
IN	182.65.104.238	India
IN	203.192.212.52	India
IN	203.194.109.142	India
MX	200.94.75.212	Mexico
PH	122.54.175.195	Philippines
TR	109.235.251.130	Turkey
UZ	213.230.91.11	Uzbekistan
VE	200.11.228.84	Venezuela

Botnet Statistics [2016-02-22]

detection period: 2016-02-22 00:00-23:59 UTC
total number of suspected botnet IPs: 788
number of botnet IPs notified to network operators: 754
number of spam blocked: 27291
recipient count of spam blocked: 171754

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-ZJ	66
2	WASU	65
3	WASU-BB	50
4	VNPT-VNNIC-VN	47
5	CHINANET-JS	40
6	CHINANET-SH	20
7	CHINANET-GD	17
8	HINET-NET	16
9	ETC-VNNIC-VN	12
10	BSNLNET	11

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	371
2	Viet Nam	98
3	Brazil	37
4	India	29
5	United States	28
6	Thailand	28
7	Russian Federation	23
8	Taiwan	20
9	Mexico	11
10	Indonesia	10

Suspected Bot List [2016-02-21]

detection period: 2016-02-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 23

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.0.163.135	Argentina
ES	88.7.109.9	Spain
ES	88.15.127.127	Spain
IL	213.57.90.10	Israel
TR	85.99.248.158	Turkey

List from greylisting:

country code	IP address	Country
AL	213.207.33.19	Albania
AR	200.41.178.234	Argentina
BO	186.27.126.130	Bolivia
CM	197.159.0.70	Cameroon
CR	201.202.246.162	Costa Rica
DZ	193.194.92.3	Algeria
DZ	197.116.169.141	Algeria
EG	193.227.49.83	Egypt
IL	213.57.90.10	Israel
IN	150.242.150.125	India
IN	203.192.212.52	India
IN	203.194.109.142	India
MO	122.100.136.74	Macau
MX	200.94.75.212	Mexico
PK	175.107.196.135	Pakistan
SI	212.18.43.95	Slovenia
TR	85.105.173.52	Turkey
TR	109.235.251.130	Turkey

Botnet Statistics [2016-02-21]

detection period: 2016-02-21 00:00-23:59 UTC
total number of suspected botnet IPs: 437
number of botnet IPs notified to network operators: 415
number of spam blocked: 1799
recipient count of spam blocked: 48288

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	24
2	CHINANET-GD	16
3	002.558.157/0001-62	10
4	CHINANET-ZJ	9
5	ALISOFT	9
6	VIETEL-VNNIC-VN	8
7	CHINANET-JS	8
8	ETC-VNNIC-VN	7
9	MX-MSCV17-LACNIC	6
10	HICHINA	6

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	127
2	Viet Nam	64
3	United States	28
4	Brazil	26
5	Russian Federation	21
6	Thailand	15
7	Indonesia	13
8	India	12
9	Mexico	9
10	Taiwan	7

Suspected Bot List [2016-02-20]

detection period: 2016-02-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 37

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
ES	88.7.109.9	Spain
TW	123.194.54.162	Taiwan

List from greylisting:

country code	IP address	Country
AR	200.41.178.234	Argentina
BO	186.27.126.130	Bolivia
CM	197.159.0.70	Cameroon
IL	213.57.90.10	Israel
IN	27.5.21.210	India
IN	59.90.111.127	India
IN	59.99.92.60	India
IN	59.177.49.67	India
IN	59.180.163.251	India
IN	117.196.159.71	India
IN	117.218.50.134	India
IN	117.221.6.127	India
IN	117.241.15.136	India
IN	117.241.56.38	India
IN	120.57.13.150	India
IN	122.170.105.219	India
IN	122.172.254.48	India
IN	125.19.97.126	India
IN	182.71.111.130	India
IN	182.74.215.162	India
IN	182.77.57.4	India
IN	182.77.62.7	India
IN	203.76.185.110	India
IN	203.192.212.52	India
IN	203.194.109.142	India
KW	188.70.7.189	Kuwait
MX	187.177.172.13	Mexico
MX	200.94.75.212	Mexico
PH	122.53.178.100	Philippines
TR	88.249.62.171	Turkey
TR	88.249.174.103	Turkey
TR	109.235.251.130	Turkey
US	75.132.198.73	United States
VE	200.11.228.84	Venezuela
ZW	41.220.28.138	Zimbabwe

Botnet Statistics [2016-02-20]

detection period: 2016-02-20 00:00-23:59 UTC
total number of suspected botnet IPs: 569
number of botnet IPs notified to network operators: 532
number of spam blocked: 2995
recipient count of spam blocked: 81375

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	65
2	CHINANET-GD	18
3	VIETEL-VNNIC-VN	15
4	FPT-VN	15
5	VIETEL-VN	13
6	HINET-NET	12
7	CHINANET-ZJ	9
8	MX-MSCV17-LACNIC	8
9	ETC-VNNIC-VN	8
10	ALISOFT	8

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Viet Nam	134
2	China	126
3	India	35
4	Brazil	33
5	Thailand	26
6	United States	24
7	Russian Federation	19
8	Taiwan	18
9	Mexico	15
10	Romania	13

Suspected Bot List [2016-02-19]

detection period: 2016-02-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 35

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	186.138.82.251	Argentina
IL	213.57.90.10	Israel
TW	123.194.54.162	Taiwan

List from greylisting:

country code	IP address	Country
AR	179.36.150.224	Argentina
AR	181.171.122.246	Argentina
AR	186.61.60.178	Argentina
AR	186.137.50.211	Argentina
AR	186.190.131.83	Argentina
AR	190.30.12.206	Argentina
AR	200.41.19.200	Argentina
AR	201.251.18.14	Argentina
BO	186.27.126.130	Bolivia
CR	201.202.246.162	Costa Rica
EG	193.227.49.83	Egypt
ID	103.254.105.98	Indonesia
ID	202.162.214.116	Indonesia
IL	213.57.90.10	Israel
IN	59.90.111.127	India
IN	59.178.153.62	India
IN	117.244.15.243	India
IN	122.170.105.219	India
IN	203.192.212.52	India
IN	203.194.109.142	India
IT	188.15.55.239	Italy
KH	117.20.117.40	Cambodia
MX	189.206.1.194	Mexico
MX	200.94.75.212	Mexico
RU	77.232.152.130	Russian Federation
RU	213.33.175.27	Russian Federation
TR	78.187.124.81	Turkey
TR	81.213.174.250	Turkey
TR	88.225.222.82	Turkey
TR	109.235.251.130	Turkey
VE	200.11.228.84	Venezuela
ZW	41.220.28.138	Zimbabwe

Botnet Statistics [2016-02-19]

detection period: 2016-02-19 00:00-23:59 UTC
total number of suspected botnet IPs: 450
number of botnet IPs notified to network operators: 416
number of spam blocked: 2072
recipient count of spam blocked: 55630

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-JS	37
2	CHINANET-GD	21
3	VNPT-VNNIC-VN	10
4	MX-MSCV17-LACNIC	10
5	ALISOFT	9
6	CHINANET-ZJ	8
7	002.558.157/0001-62	8
8	TOT-AS-AP	5
9	MX-USCV4-LACNIC	5
10	HICHINA	5

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	157
2	Brazil	30
3	Viet Nam	29
4	United States	26
5	Russian Federation	22
6	Mexico	20
7	Thailand	19
8	India	12
9	Indonesia	9
10	Argentina	9

Suspected Bot List [2016-02-18]

detection period: 2016-02-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 39

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	186.138.82.251	Argentina
IT	84.221.238.46	Italy

List from greylisting:

country code	IP address	Country
AF	180.94.70.98	Afghanistan
AR	190.112.93.223	Argentina
AR	200.41.178.234	Argentina
AZ	95.86.182.238	Azerbaijan
CR	201.202.246.162	Costa Rica
ES	87.235.177.251	Spain
IL	213.57.90.10	Israel
IN	42.104.70.5	India
IN	49.156.150.72	India
IN	59.90.111.127	India
IN	59.94.35.97	India
IN	117.193.211.110	India
IN	117.198.117.37	India
IN	122.164.207.108	India
IN	122.165.22.97	India
IN	122.169.13.138	India
IN	122.178.103.81	India
IN	182.64.106.4	India
IN	202.164.54.194	India
IN	203.192.212.52	India
IN	203.194.109.142	India
IN	210.7.65.75	India
KE	196.101.186.116	Kenya
MX	200.94.75.212	Mexico
NI	209.124.106.140	Nicaragua
PH	110.55.106.196	Philippines
PH	119.93.33.21	Philippines
PH	122.3.115.77	Philippines
PH	122.53.121.38	Philippines
PK	39.41.232.50	Pakistan
RO	89.121.160.237	Romania
RO	92.84.1.247	Romania
RO	109.103.177.124	Romania
RU	213.33.175.27	Russian Federation
TR	109.235.251.130	Turkey
UZ	213.230.91.11	Uzbekistan
VE	200.11.228.84	Venezuela

Botnet Statistics [2016-02-18]

detection period: 2016-02-18 00:00-23:59 UTC
total number of suspected botnet IPs: 560
number of botnet IPs notified to network operators: 521
number of spam blocked: 7439
recipient count of spam blocked: 74644

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-JS	60
2	VNPT-VNNIC-VN	27
3	CHINANET-GD	13
4	CHINANET-ZJ	10
5	CHINANET-SH	9
6	ALISOFT	9
7	VIETEL-VNNIC-VN	8
8	002.558.157/0001-62	8
9	HICHINA	7
10	CMNET	5

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	183
2	Viet Nam	53
3	Brazil	38
4	United States	35
5	India	32
6	Russian Federation	26
7	Indonesia	16
8	Thailand	15
9	Romania	12
10	South Korea	9

Suspected Bot List [2016-02-17]

detection period: 2016-02-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 72

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
TH	103.22.183.222	Thailand

List from greylisting:

country code	IP address	Country
AE	83.110.97.192	Arab Emirates
AL	109.69.7.130	Albania
AR	190.112.93.223	Argentina
AR	191.81.65.139	Argentina
AR	200.41.178.234	Argentina
BD	116.58.205.137	Bangladesh
BD	150.242.104.214	Bangladesh
BO	186.27.126.130	Bolivia
BO	200.87.177.155	Bolivia
CO	190.90.22.122	Colombia
CR	201.202.246.162	Costa Rica
EG	41.32.191.122	Egypt
EG	193.227.49.83	Egypt
EG	196.219.96.39	Egypt
ES	80.59.199.213	Spain
ES	87.235.177.251	Spain
GA	41.211.167.183	Gabon
GR	91.140.66.7	Greece
ID	103.254.105.98	Indonesia
IE	79.97.93.30	Ireland
IL	213.57.90.10	Israel
IN	45.115.180.18	India
IN	59.90.111.127	India
IN	59.92.227.30	India
IN	59.178.195.99	India
IN	61.0.66.253	India
IN	61.3.140.111	India
IN	116.73.202.155	India
IN	117.99.162.51	India
IN	117.199.136.9	India
IN	117.201.73.66	India
IN	117.206.122.85	India
IN	117.208.143.238	India
IN	117.214.110.227	India
IN	117.241.158.118	India
IN	117.244.15.243	India
IN	120.57.152.11	India
IN	120.62.14.69	India
IN	122.170.105.219	India
IN	125.17.242.26	India
IN	182.64.56.74	India
IN	182.69.8.2	India
IN	182.69.8.61	India
IN	203.192.212.52	India
IN	203.194.109.142	India
IN	223.227.140.75	India
MA	41.137.56.4	Morocco
MG	41.74.28.182	Madagascar
MX	187.163.158.132	Mexico
MX	189.211.231.62	Mexico
MX	200.78.98.189	Mexico
MX	200.94.41.31	Mexico
MX	200.94.75.212	Mexico
NG	197.242.116.245	Nigeria
NI	209.124.106.140	Nicaragua
PK	39.32.237.46	Pakistan
PK	39.37.146.175	Pakistan
PK	175.107.50.157	Pakistan
PK	182.178.209.145	Pakistan
PK	182.185.114.215	Pakistan
PK	182.185.173.167	Pakistan
RO	92.80.194.113	Romania
RS	188.2.181.150	Serbia
RU	109.167.136.199	Russian Federation
RU	213.33.175.27	Russian Federation
TR	46.1.94.45	Turkey
TR	109.235.251.130	Turkey
TR	188.124.17.23	Turkey
VE	200.11.228.84	Venezuela
ZA	197.245.169.68	South Africa
ZW	41.220.28.138	Zimbabwe

Botnet Statistics [2016-02-17]

detection period: 2016-02-17 00:00-23:59 UTC
total number of suspected botnet IPs: 706
number of botnet IPs notified to network operators: 634
number of spam blocked: 6812
recipient count of spam blocked: 68142

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-JS	94
2	VNPT-VNNIC-VN	35
3	CHINANET-SH	21
4	MX-MSCV17-LACNIC	19
5	ETC-VNNIC-VN	13
6	CHINANET-GD	13
7	BSNLNET	11
8	CHINANET-ZJ	10
9	002.558.157/0001-62	10
10	TOT-NET	8

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	223
2	Viet Nam	76
3	Mexico	39
4	India	38
5	Brazil	37
6	United States	28
7	Thailand	25
8	Russian Federation	20
9	Turkey	16
10	Indonesia	14

Suspected Bot List [2016-02-16]

detection period: 2016-02-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 57

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
AR	190.0.163.135	Argentina
TH	103.22.183.222	Thailand
UY	179.25.198.175	Uruguay

List from greylisting:

country code	IP address	Country
AR	181.24.136.16	Argentina
AR	181.30.50.138	Argentina
AR	181.118.108.75	Argentina
AR	186.23.164.78	Argentina
AR	190.210.204.15	Argentina
AR	200.41.178.234	Argentina
AZ	91.135.246.253	Azerbaijan
BO	186.27.126.130	Bolivia
CR	201.202.246.162	Costa Rica
DZ	105.98.175.181	Algeria
DZ	197.116.72.185	Algeria
EG	41.32.191.122	Egypt
EG	193.227.49.83	Egypt
IL	213.57.90.10	Israel
IN	59.90.111.127	India
IN	59.181.132.45	India
IN	59.182.183.241	India
IN	61.0.158.86	India
IN	117.192.45.102	India
IN	117.195.194.138	India
IN	117.200.186.61	India
IN	117.206.118.75	India
IN	117.208.47.104	India
IN	117.218.108.57	India
IN	117.244.15.243	India
IN	117.247.184.253	India
IN	122.162.0.116	India
IN	122.164.152.7	India
IN	122.164.229.171	India
IN	122.167.168.183	India
IN	122.170.105.219	India
IN	122.178.24.71	India
IN	125.21.255.126	India
IN	180.211.126.178	India
IN	182.59.180.240	India
IN	182.64.251.222	India
IN	203.192.212.52	India
IN	203.194.109.142	India
IN	203.217.145.165	India
IT	95.246.1.233	Italy
KE	197.237.10.135	Kenya
MX	187.177.172.13	Mexico
MX	200.94.75.212	Mexico
NI	209.124.106.140	Nicaragua
RO	92.80.123.161	Romania
RO	92.84.151.164	Romania
RO	109.98.161.132	Romania
RS	178.148.24.115	Serbia
RU	89.23.193.43	Russian Federation
RU	213.33.175.27	Russian Federation
TR	31.155.233.3	Turkey
US	75.132.198.73	United States
VE	200.11.228.84	Venezuela
ZW	41.220.28.138	Zimbabwe

Botnet Statistics [2016-02-16]

detection period: 2016-02-16 00:00-23:59 UTC
total number of suspected botnet IPs: 738
number of botnet IPs notified to network operators: 681
number of spam blocked: 7430
recipient count of spam blocked: 105716

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	75
2	CHINANET-JS	56
3	FPT-VN	17
4	MX-MSCV17-LACNIC	14
5	VIETEL-VNNIC-VN	13
6	VIETEL-VN	13
7	ALISOFT	13
8	CHINANET-SH	12
9	CHINANET-ZJ	10
10	BSNLNET	10

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	183
2	Viet Nam	147
3	Thailand	38
4	Russian Federation	37
5	India	37
6	Brazil	36
7	United States	29
8	Mexico	22
9	Indonesia	16
10	Turkey	13

Suspected Bot List [2016-02-15]

detection period: 2016-02-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 34

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country
AR	181.14.245.234	Argentina
AR	181.30.50.138	Argentina
AR	190.210.204.15	Argentina
AR	200.41.178.234	Argentina
BO	186.27.126.130	Bolivia
CM	197.159.0.70	Cameroon
CR	201.202.246.162	Costa Rica
EG	193.227.49.83	Egypt
ES	87.235.177.251	Spain
HN	161.0.213.28	Honduras
IL	213.57.90.10	Israel
IN	59.90.111.127	India
IN	61.0.163.248	India
IN	117.207.151.45	India
IN	117.207.237.6	India
IN	117.218.50.134	India
IN	117.244.15.243	India
IN	122.166.102.163	India
IN	122.170.105.219	India
IN	122.174.218.24	India
IN	171.49.152.178	India
IN	180.211.126.178	India
IN	182.64.32.233	India
IN	202.142.118.228	India
IN	203.192.212.52	India
IN	203.194.109.142	India
KE	196.200.26.82	Kenya
MX	200.94.75.212	Mexico
RS	24.135.33.195	Serbia
RU	213.33.175.27	Russian Federation
TR	109.235.251.130	Turkey
TW	123.195.63.138	Taiwan
US	66.189.137.35	United States
VE	200.11.228.84	Venezuela

Botnet Statistics [2016-02-15]

detection period: 2016-02-15 00:00-23:59 UTC
total number of suspected botnet IPs: 491
number of botnet IPs notified to network operators: 457
number of spam blocked: 3066
recipient count of spam blocked: 69762

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	31
2	MX-MSCV17-LACNIC	19
3	ALISOFT	10
4	CHINANET-ZJ	9
5	CHINANET-JS	9
6	002.558.157/0001-62	9
7	FPT-VN	7
8	CMNET	7
9	VIETEL-VNNIC-VN	6
10	BSNLNET	6

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	103
2	Viet Nam	62
3	Brazil	34
4	Russian Federation	32
5	Mexico	26
6	India	26
7	United States	24
8	Thailand	17
9	Indonesia	15
10	Hong Kong	12

Suspected Bot List [2016-02-14]

detection period: 2016-02-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 26

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
IL	213.57.90.10	Israel
UY	186.50.218.208	Uruguay

List from greylisting:

country code	IP address	Country
AR	181.14.245.234	Argentina
AR	190.17.159.223	Argentina
AR	190.210.204.15	Argentina
AR	190.247.142.77	Argentina
BO	186.27.126.130	Bolivia
CM	197.159.0.70	Cameroon
CR	201.202.246.162	Costa Rica
IL	213.57.90.10	Israel
IN	61.1.73.38	India
IN	117.196.197.230	India
IN	117.218.191.178	India
IN	117.244.15.243	India
IN	122.170.105.219	India
IN	180.211.126.178	India
IN	203.192.212.52	India
IR	89.165.72.163	Iran
RO	86.104.145.8	Romania
RS	89.216.185.53	Serbia
RU	213.33.175.27	Russian Federation
SG	116.251.222.217	Singapore
TR	78.40.226.103	Turkey
UY	179.29.49.58	Uruguay
VE	200.11.228.84	Venezuela
ZW	41.220.28.138	Zimbabwe

Botnet Statistics [2016-02-14]

detection period: 2016-02-14 00:00-23:59 UTC
total number of suspected botnet IPs: 376
number of botnet IPs notified to network operators: 351
number of spam blocked: 5039
recipient count of spam blocked: 132537

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	33
2	MX-MSCV17-LACNIC	16
3	HINET-NET	14
4	CHINANET-GD	12
5	ALISOFT	9
6	CHINANET-JS	8
7	002.558.157/0001-62	8
8	VIETEL-VNNIC-VN	7
9	CHINANET-ZJ	7
10	VIETEL-VN	6

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	92
2	Viet Nam	68
3	Brazil	26
4	United States	20
5	Russian Federation	20
6	Mexico	20
7	Taiwan	15
8	India	11
9	Thailand	9
10	Indonesia	9

Suspected Bots' IP List for January 2016

To encourage cyber security information sharing (as some form of open data) while still giving victims enough time to clean up their computers, the IP list of suspected infected computers will be released here (as shown below). You are free to use them to create more effective defenses, discover latest trends in cyber attacks, etc.

Suspected Bots IP [2016-01-01]
Suspected Bots IP [2016-01-02]
Suspected Bots IP [2016-01-03]
Suspected Bots IP [2016-01-04]
Suspected Bots IP [2016-01-05]
Suspected Bots IP [2016-01-06]
Suspected Bots IP [2016-01-07]
Suspected Bots IP [2016-01-08]
Suspected Bots IP [2016-01-09]
Suspected Bots IP [2016-01-10]
Suspected Bots IP [2016-01-11]
Suspected Bots IP [2016-01-12]
Suspected Bots IP [2016-01-13]
Suspected Bots IP [2016-01-14]
Suspected Bots IP [2016-01-15]
Suspected Bots IP [2016-01-16]
Suspected Bots IP [2016-01-17]
Suspected Bots IP [2016-01-18]
Suspected Bots IP [2016-01-19]
Suspected Bots IP [2016-01-20]
Suspected Bots IP [2016-01-21]
Suspected Bots IP [2016-01-22]
Suspected Bots IP [2016-01-23]
Suspected Bots IP [2016-01-24]
Suspected Bots IP [2016-01-25]
Suspected Bots IP [2016-01-26]
Suspected Bots IP [2016-01-27]
Suspected Bots IP [2016-01-28]
Suspected Bots IP [2016-01-29]
Suspected Bots IP [2016-01-30]
Suspected Bots IP [2016-01-31]

Suspected Bot List [2016-02-13]

detection period: 2016-02-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 40

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
IL	213.57.90.10	Israel
UY	179.24.251.235	Uruguay
UY	179.24.253.127	Uruguay
UY	179.25.153.219	Uruguay

List from greylisting:

country code	IP address	Country
AR	181.14.245.234	Argentina
AR	181.231.128.6	Argentina
AR	190.48.35.204	Argentina
AR	190.210.204.15	Argentina
AR	200.41.178.234	Argentina
AZ	91.135.246.51	Azerbaijan
BO	186.27.126.130	Bolivia
CM	197.159.0.70	Cameroon
CR	201.202.246.162	Costa Rica
ID	202.162.214.116	Indonesia
ID	202.162.219.83	Indonesia
IL	213.57.90.10	Israel
IN	59.89.182.100	India
IN	115.99.252.49	India
IN	117.199.136.0	India
IN	117.204.164.238	India
IN	117.241.78.110	India
IN	117.244.15.243	India
IN	122.170.105.219	India
IN	122.173.147.68	India
IN	122.174.244.17	India
IN	122.178.231.54	India
IN	180.211.126.178	India
IN	203.192.212.52	India
IN	203.192.223.29	India
IN	203.194.109.142	India
ME	62.4.55.184	Montenegro
RO	109.100.210.48	Romania
RO	109.102.91.85	Romania
RU	213.33.175.27	Russian Federation
TR	46.2.196.129	Turkey
TR	109.235.251.130	Turkey
TR	188.3.74.61	Turkey
UY	186.49.231.84	Uruguay
VE	200.11.228.84	Venezuela
ZW	41.220.28.138	Zimbabwe

Botnet Statistics [2016-02-13]

detection period: 2016-02-13 00:00-23:59 UTC
total number of suspected botnet IPs: 476
number of botnet IPs notified to network operators: 437
number of spam blocked: 3818
recipient count of spam blocked: 110407

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	23
2	VNPT-VNNIC-VN	22
3	CHINANET-GD	12
4	CHINANET-ZJ	11
5	CHINANET-JS	9
6	002.558.157/0001-62	9
7	FPT-VN	8
8	ALISOFT	6
9	VIETEL-VNNIC-VN	5
10	TOT-NET	5

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	103
2	Viet Nam	58
3	Brazil	33
4	Russian Federation	28
5	Taiwan	25
6	India	22
7	United States	17
8	Thailand	17
9	Ukraine	14
10	Indonesia	12

Suspected Bot List [2016-02-12]

detection period: 2016-02-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 38

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
IL	213.57.90.10	Israel
UY	179.25.205.102	Uruguay
UY	186.54.161.60	Uruguay

List from greylisting:

country code	IP address	Country
AR	181.14.245.234	Argentina
AR	190.193.237.84	Argentina
AR	200.41.178.234	Argentina
BG	78.90.2.109	Bulgaria
BG	94.26.50.6	Bulgaria
BO	186.27.126.130	Bolivia
BR	150.164.26.101	Brazil
CI	41.66.37.171	Ivory Coast
CM	197.159.0.70	Cameroon
CR	201.202.246.162	Costa Rica
EC	190.90.220.245	Ecuador
EG	193.227.49.83	Egypt
ES	87.235.177.251	Spain
GR	46.190.48.19	Greece
ID	202.162.214.116	Indonesia
ID	202.162.219.83	Indonesia
IL	213.57.90.10	Israel
IN	27.5.217.21	India
IN	117.244.15.243	India
IN	122.164.159.152	India
IN	122.170.105.219	India
IN	180.211.126.178	India
IN	182.66.161.202	India
IN	182.77.25.174	India
IN	203.192.212.52	India
IN	203.194.109.142	India
IT	151.76.107.195	Italy
MX	187.177.172.13	Mexico
NI	209.124.106.140	Nicaragua
PH	122.53.178.100	Philippines
PT	78.130.92.197	Portugal
RS	89.216.204.151	Serbia
RU	213.33.175.27	Russian Federation
TR	109.235.251.130	Turkey
VE	200.11.228.84	Venezuela

Botnet Statistics [2016-02-12]

detection period: 2016-02-12 00:00-23:59 UTC
total number of suspected botnet IPs: 1114
number of botnet IPs notified to network operators: 1077
number of spam blocked: 61760
recipient count of spam blocked: 1814056

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	634
2	MSFT	26
3	MX-MSCV17-LACNIC	22
4	VNPT-VNNIC-VN	19
5	MSFT-GFS	16
6	CHINANET-ZJ	10
7	ALISOFT	10
8	CHINANET-JS	8
9	002.558.157/0001-62	7
10	CHINANET-GD	6

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	636
2	China	104
3	United States	64
4	Viet Nam	40
5	Russian Federation	36
6	Brazil	35
7	Mexico	30
8	India	17
9	Thailand	15
10	Indonesia	10

Suspected Bot List [2016-02-11]

detection period: 2016-02-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 58

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
CA	167.114.135.195	Canada
FR	94.23.114.49	France
IL	213.57.90.10	Israel
UY	179.25.158.15	Uruguay
UY	179.25.253.108	Uruguay

List from greylisting:

country code	IP address	Country
AR	179.38.76.53	Argentina
AR	181.14.245.234	Argentina
AR	181.169.213.213	Argentina
AR	190.7.9.194	Argentina
AR	190.210.204.15	Argentina
AR	200.41.178.234	Argentina
BG	94.26.8.52	Bulgaria
BG	94.26.50.6	Bulgaria
BO	186.27.126.130	Bolivia
CR	186.176.246.110	Costa Rica
CR	201.202.246.162	Costa Rica
EG	193.227.49.83	Egypt
ES	87.235.177.251	Spain
ES	95.120.14.214	Spain
ID	202.162.214.116	Indonesia
ID	202.162.219.83	Indonesia
IL	213.57.90.10	Israel
IN	61.2.82.228	India
IN	106.216.164.51	India
IN	112.133.244.35	India
IN	117.195.108.61	India
IN	117.197.120.11	India
IN	117.197.205.248	India
IN	117.214.29.201	India
IN	117.223.60.100	India
IN	117.244.15.243	India
IN	117.247.85.146	India
IN	117.248.28.65	India
IN	122.170.105.219	India
IN	122.173.35.115	India
IN	122.173.46.229	India
IN	180.211.126.178	India
IN	182.58.235.254	India
IN	182.71.75.246	India
IN	182.71.213.116	India
IN	202.164.49.210	India
IN	203.192.212.52	India
IN	203.194.109.142	India
KE	196.207.30.230	Kenya
MR	41.188.65.50	Mauritania
PH	122.53.178.100	Philippines
PK	39.33.130.214	Pakistan
PK	39.43.9.53	Pakistan
PK	182.185.217.121	Pakistan
RU	213.33.175.27	Russian Federation
TR	46.2.212.203	Turkey
TR	81.213.154.121	Turkey
TR	88.248.251.231	Turkey
TR	109.235.251.130	Turkey
TR	188.3.60.166	Turkey
UY	167.60.90.203	Uruguay
UZ	213.230.93.82	Uzbekistan
ZW	41.220.28.138	Zimbabwe

Botnet Statistics [2016-02-11]

detection period: 2016-02-11 00:00-23:59 UTC
total number of suspected botnet IPs: 1039
number of botnet IPs notified to network operators: 982
number of spam blocked: 53695
recipient count of spam blocked: 1592696

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	580
2	MX-MSCV17-LACNIC	24
3	VNPT-VNNIC-VN	12
4	CHINANET-ZJ	11
5	BSNLNET	9
6	CHINANET-JS	8
7	ALISOFT	8
8	002.558.157/0001-62	8
9	KORNET-KR	5
10	FPT-VN	5

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	Taiwan	583
2	China	95
3	Brazil	33
4	United States	32
5	India	32
6	Mexico	31
7	Viet Nam	28
8	Russian Federation	24
9	Indonesia	16
10	South Korea	12