Botnet Statistics [2018-11-29]

detection period: 2018-11-29 00:00-23:59 UTC
total number of suspected botnet IPs: 3722
number of botnet IPs notified to network operators: 3476
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	98
2	TENCENT-CN	58
3	CHINANET-GD	49
4	KORNET-KR	48
5	002.558.157/0001-62	46
6	DO-13	41
7	DIGITALOCEAN-8	41
8	CMNET	40
9	Baidu	39
10	AT-88-Z	39

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	718
2	United States	619
3	France	333
4	Brazil	186
5	Russian Federation	171
6	India	107
7	Italy	106
8	Netherlands	104
9	South Korea	91
10	Canada	88

Suspected Bot List [2018-11-29]

detection period: 2018-11-29 00:00-23:59 UTC
number of suspected bots' IPs listed here: 246

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-28]

detection period: 2018-11-28 00:00-23:59 UTC
total number of suspected botnet IPs: 3299
number of botnet IPs notified to network operators: 3061
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	71
2	CHINANET-JS	50
3	CMNET	45
4	CHINANET-GD	45
5	KORNET-KR	43
6	AT-88-Z	40
7	UNKNOWN	39
8	TENCENT-CN	38
9	DO-13	37
10	MSFT	36

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	656
2	United States	533
3	France	293
4	Russian Federation	147
5	Brazil	125
6	Italy	101
7	India	92
8	Netherlands	89
9	South Korea	80
10	United Kingdom	79

Suspected Bot List [2018-11-28]

detection period: 2018-11-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 238

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-27]

detection period: 2018-11-27 00:00-23:59 UTC
total number of suspected botnet IPs: 2830
number of botnet IPs notified to network operators: 2623
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-JS	53
2	CHINANET-GD	47
3	CMNET	41
4	TencentCloud	36
5	DO-13	33
6	KORNET-KR	31
7	002.558.157/0001-62	28
8	MSFT	26
9	AT-88-Z	26
10	TENCENT-CN	23

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	574
2	United States	465
3	France	221
4	Brazil	119
5	Russian Federation	111
6	Netherlands	85
7	Germany	74
8	India	70
9	Italy	66
10	United Kingdom	64

Suspected Bot List [2018-11-27]

detection period: 2018-11-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 207

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-26]

detection period: 2018-11-26 00:00-23:59 UTC
total number of suspected botnet IPs: 2143
number of botnet IPs notified to network operators: 1972
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-JS	44
2	CHINANET-GD	37
3	CMNET	32
4	002.558.157/0001-62	27
5	AT-88-Z	25
6	TencentCloud	24
7	KORNET-KR	23
8	DO-13	22
9	HINET-NET	18
10	GOOGLE-CLOUD	17

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	456
2	United States	365
3	France	142
4	Russian Federation	106
5	Brazil	84
6	Netherlands	71
7	Germany	59
8	South Korea	51
9	Canada	51
10	India	50

Suspected Bot List [2018-11-26]

detection period: 2018-11-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 171

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-25]

detection period: 2018-11-25 00:00-23:59 UTC
total number of suspected botnet IPs: 2049
number of botnet IPs notified to network operators: 1896
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	49
2	CHINANET-JS	41
3	002.558.157/0001-62	40
4	CMNET	35
5	KORNET-KR	26
6	HINET-NET	26
7	AT-88-Z	23
8	TencentCloud	22
9	CHINANET-SC	21
10	DO-13	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	468
2	United States	332
3	France	138
4	Russian Federation	101
5	Brazil	94
6	Netherlands	65
7	United Kingdom	52
8	Italy	47
9	South Korea	41
10	Taiwan	39

Suspected Bot List [2018-11-25]

detection period: 2018-11-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 153

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-24]

detection period: 2018-11-24 00:00-23:59 UTC
total number of suspected botnet IPs: 2035
number of botnet IPs notified to network operators: 1854
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	41
2	CMNET	35
3	CHINANET-JS	33
4	KORNET-KR	28
5	AT-88-Z	28
6	TencentCloud	26
7	002.558.157/0001-62	26
8	HINET-NET	18
9	ONLINE_NET_DEDICATED_SERVERS	17
10	DO-13	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	492
2	United States	319
3	Russian Federation	114
4	Brazil	86
5	France	84
6	Netherlands	71
7	South Korea	58
8	India	44
9	Germany	43
10	Viet Nam	39

Suspected Bot List [2018-11-24]

detection period: 2018-11-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 181

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-23]

detection period: 2018-11-23 00:00-23:59 UTC
total number of suspected botnet IPs: 1870
number of botnet IPs notified to network operators: 1703
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	45
2	CMNET	37
3	CHINANET-JS	28
4	KORNET-KR	27
5	HINET-NET	26
6	TencentCloud	23
7	AT-88-Z	22
8	002.558.157/0001-62	22
9	CHINANET-SC	17
10	SGCABLEVISION-SG	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	451
2	United States	300
3	Russian Federation	100
4	Brazil	80
5	France	61
6	Netherlands	50
7	South Korea	50
8	Viet Nam	45
9	Italy	44
10	United Kingdom	40

Suspected Bot List [2018-11-23]

detection period: 2018-11-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 167

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-22]

detection period: 2018-11-22 00:00-23:59 UTC
total number of suspected botnet IPs: 1989
number of botnet IPs notified to network operators: 1814
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CHINANET-GD	53
2	CHINANET-JS	39
3	AT-88-Z	34
4	TencentCloud	27
5	CMNET	27
6	HINET-NET	25
7	AMAZON-2011L	25
8	KORNET-KR	21
9	MX-USCV4-LACNIC	20
10	UNICOM-LN	19

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	475
2	United States	328
3	Russian Federation	123
4	Brazil	84
5	France	78
6	Netherlands	58
7	Italy	48
8	Viet Nam	45
9	Taiwan	43
10	India	42

Suspected Bot List [2018-11-22]

detection period: 2018-11-22 00:00-23:59 UTC
number of suspected bots' IPs listed here: 175

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-21]

detection period: 2018-11-21 00:00-23:59 UTC
total number of suspected botnet IPs: 3844
number of botnet IPs notified to network operators: 3530
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNKNOWN	184
2	VNPT-VNNIC-VN	145
3	TELKOMNET	64
4	HINET-NET	60
5	CHINANET-JS	45
6	VE-CSVE-LACNIC	44
7	KORNET-KR	39
8	CHINANET-GD	37
9	TencentCloud	31
10	AT-88-Z	31

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	557
2	United States	460
3	Viet Nam	293
4	Russian Federation	259
5	Brazil	207
6	France	184
7	Indonesia	172
8	India	163
9	Taiwan	87
10	Thailand	79

Suspected Bot List [2018-11-21]

detection period: 2018-11-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 314

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-20]

detection period: 2018-11-20 00:00-23:59 UTC
total number of suspected botnet IPs: 3544
number of botnet IPs notified to network operators: 3243
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	118
2	VE-CSVE-LACNIC	72
3	HINET-NET	64
4	CHINANET-GD	51
5	CHINANET-JS	43
6	TELKOMNET	42
7	002.558.157/0001-62	41
8	KORNET-KR	39
9	TencentCloud	31
10	MX-USCV4-LACNIC	29

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	513
2	United States	396
3	Viet Nam	247
4	Russian Federation	239
5	India	188
6	Brazil	178
7	France	165
8	Indonesia	109
9	Taiwan	99
10	Venezuela	80

Suspected Bot List [2018-11-20]

detection period: 2018-11-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 301

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-19]

detection period: 2018-11-19 00:00-23:59 UTC
total number of suspected botnet IPs: 3124
number of botnet IPs notified to network operators: 2839
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	149
2	TELKOMNET	64
3	HINET-NET	53
4	CHINANET-GD	47
5	VE-CSVE-LACNIC	39
6	UNKNOWN	39
7	VIETEL-VNNIC-VN	37
8	TencentCloud	35
9	MX-USCV4-LACNIC	33
10	CHINANET-JS	32

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	543
2	United States	328
3	Viet Nam	264
4	Russian Federation	181
5	Brazil	169
6	Indonesia	157
7	India	144
8	Taiwan	75
9	France	72
10	Ukraine	64

Suspected Bot List [2018-11-19]

detection period: 2018-11-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 286

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-18]

detection period: 2018-11-18 00:00-23:59 UTC
total number of suspected botnet IPs: 2745
number of botnet IPs notified to network operators: 2518
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	74
2	HINET-NET	59
3	VE-CSVE-LACNIC	45
4	CHINANET-GD	43
5	TELKOMNET	41
6	TencentCloud	34
7	UNKNOWN	28
8	002.558.157/0001-62	27
9	CMNET	26
10	DIGITALOCEAN-8	25

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	474
2	United States	314
3	Russian Federation	212
4	Viet Nam	140
5	Brazil	121
6	India	107
7	France	92
8	Indonesia	89
9	Taiwan	75
10	Netherlands	60

Suspected Bot List [2018-11-18]

detection period: 2018-11-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 227

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-17]

detection period: 2018-11-17 00:00-23:59 UTC
total number of suspected botnet IPs: 2903
number of botnet IPs notified to network operators: 2630
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	86
2	HINET-NET	51
3	TELKOMNET	47
4	VE-CSVE-LACNIC	45
5	UNKNOWN	45
6	CHINANET-GD	43
7	CHINANET-JS	33
8	TencentCloud	31
9	KORNET-KR	31
10	MX-USCV4-LACNIC	29

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	497
2	United States	325
3	Russian Federation	211
4	Viet Nam	193
5	Brazil	153
6	India	126
7	Indonesia	115
8	Taiwan	75
9	United Kingdom	66
10	South Korea	62

Suspected Bot List [2018-11-17]

detection period: 2018-11-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 273

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-16]

detection period: 2018-11-16 00:00-23:59 UTC
total number of suspected botnet IPs: 2936
number of botnet IPs notified to network operators: 2650
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	112
2	TELKOMNET	63
3	HINET-NET	50
4	CHINANET-GD	48
5	TencentCloud	46
6	VE-CSVE-LACNIC	44
7	AMAZON-2011L	41
8	002.558.157/0001-62	38
9	UNKNOWN	35
10	AT-88-Z	33

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	482
2	United States	335
3	Viet Nam	223
4	Russian Federation	194
5	Brazil	156
6	Indonesia	142
7	India	135
8	Taiwan	76
9	United Kingdom	76
10	Mexico	59

Suspected Bot List [2018-11-16]

detection period: 2018-11-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 286

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-15]

detection period: 2018-11-15 00:00-23:59 UTC
total number of suspected botnet IPs: 2944
number of botnet IPs notified to network operators: 2666
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	108
2	TELKOMNET	74
3	VE-CSVE-LACNIC	51
4	CHINANET-GD	50
5	HINET-NET	47
6	002.558.157/0001-62	44
7	UNKNOWN	36
8	CHINANET-JS	36
9	TencentCloud	35
10	MX-USCV4-LACNIC	32

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	469
2	United States	335
3	Viet Nam	220
4	Russian Federation	206
5	Indonesia	148
6	Brazil	142
7	India	141
8	Netherlands	85
9	France	75
10	United Kingdom	73

Suspected Bot List [2018-11-15]

detection period: 2018-11-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 278

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-14]

detection period: 2018-11-14 00:00-23:59 UTC
total number of suspected botnet IPs: 3129
number of botnet IPs notified to network operators: 2806
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	149
2	TELKOMNET	65
3	VE-CSVE-LACNIC	59
4	CHINANET-GD	49
5	HINET-NET	48
6	UNKNOWN	39
7	DIGITALOCEAN-7	34
8	VIETEL-VN	33
9	TencentCloud	33
10	MX-USCV4-LACNIC	33

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	487
2	United States	329
3	Viet Nam	277
4	Russian Federation	202
5	Indonesia	186
6	Brazil	168
7	India	145
8	Taiwan	79
9	France	71
10	Venezuela	69

Suspected Bot List [2018-11-14]

detection period: 2018-11-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 323

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

TCP port scan detection with HAProxy: Revised

I gained more understanding of Debian and HAProxy after my previous post on detecting TCP port scans with HAProxy. Because the HAProxy package for Debian has its own logging setting,  my own logging configurations are not really necessary. Here are the revised and shorter instructions:

1. Install HAProxy.
   

   apt-get install haproxy

2. Append the following lines to HAProxy's configuration at /etc/haproxy/haproxy.cfg.  Please note that the "log" statement has changed.
   

   frontend fr_tcp
       log global
       mode tcp
       bind <IP address of your HAProxy server>:1-24
       bind <IP address of your HAProxy server>:26-79
       bind <IP address of your HAProxy server>:81-40000
       log-format %ci:%cp\ =>\ %[dst]:%[dst_port]\ [%t]\ %ft\ %b/%s\ %Tw/%Tc/%Tt\ %B\ %ts\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq
       default_backend bk_tcp
   
   backend bk_tcp
       mode tcp
       server www-2 127.0.0.1:1028
   

3. restart rsyslog and haproxy.
   

   service rsyslog restart
   service haproxy restart

That's all you need to get HAProxy to detect TCP port scans.  You should soon get TCP scan logs in /var/log/haproxy.log like the following:

2018-11-14T13:23:43.916980+00:00 vps542 haproxy[23849]: 20x.1yz.35.1xz:43908 => 18x.1yz.122.zy:22032 [14/Nov/2018:13:23:39.095] fr_tcp bk_tcp/www-2 1/0/4821 991 -- 2/2/2/2/0 0/0

It shows that a node at IP 20x.1yz.35.1xz had tried to connect to TCP port 22032 of my VPS.  Simple, huh?

Botnet Statistics [2018-11-13]

detection period: 2018-11-13 00:00-23:59 UTC
total number of suspected botnet IPs: 2751
number of botnet IPs notified to network operators: 2370
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	134
2	UNKNOWN	123
3	TELKOMNET	69
4	HINET-NET	49
5	CMNET	36
6	VE-CSVE-LACNIC	34
7	MX-USCV4-LACNIC	33
8	CHINANET-GD	33
9	VIETEL-VNNIC-VN	31
10	002.558.157/0001-62	31

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	389
2	United States	258
3	Viet Nam	253
4	Russian Federation	209
5	Brazil	155
6	Indonesia	150
7	India	146
8	Taiwan	77
9	France	69
10	Mexico	61

Suspected Bot List [2018-11-13]

detection period: 2018-11-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 383

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-12]

detection period: 2018-11-12 00:00-23:59 UTC
total number of suspected botnet IPs: 3029
number of botnet IPs notified to network operators: 2672
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNKNOWN	126
2	VNPT-VNNIC-VN	106
3	DIGITALOCEAN-8	60
4	TELKOMNET	57
5	CHINANET-GD	54
6	HINET-NET	51
7	VE-CSVE-LACNIC	43
8	CMNET	40
9	CHINANET-JS	40
10	002.558.157/0001-62	28

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	564
2	United States	319
3	Russian Federation	213
4	Viet Nam	212
5	Brazil	162
6	Indonesia	145
7	India	143
8	Taiwan	78
9	France	72
10	Thailand	61

Suspected Bot List [2018-11-12]

detection period: 2018-11-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 360

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-11]

detection period: 2018-11-11 00:00-23:59 UTC
total number of suspected botnet IPs: 2535
number of botnet IPs notified to network operators: 2270
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNKNOWN	73
2	VNPT-VNNIC-VN	59
3	CHINANET-GD	47
4	VE-CSVE-LACNIC	39
5	HINET-NET	39
6	CHINANET-JS	36
7	TELKOMNET	34
8	DIGITALOCEAN-8	32
9	TencentCloud	31
10	002.558.157/0001-62	29

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	455
2	United States	316
3	Russian Federation	206
4	Brazil	143
5	Viet Nam	134
6	Indonesia	92
7	India	84
8	France	78
9	Taiwan	65
10	United Kingdom	65

Suspected Bot List [2018-11-11]

detection period: 2018-11-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 265

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-10]

detection period: 2018-11-10 00:00-23:59 UTC
total number of suspected botnet IPs: 1981
number of botnet IPs notified to network operators: 1735
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNKNOWN	74
2	VNPT-VNNIC-VN	60
3	HINET-NET	35
4	CHINANET-GD	35
5	DIGITALOCEAN-8	34
6	CHINANET-JS	33
7	VE-CSVE-LACNIC	30
8	TELKOMNET	28
9	TencentCloud	25
10	LogicWeb-Inc	23

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	364
2	United States	250
3	Russian Federation	133
4	Brazil	110
5	Viet Nam	98
6	France	72
7	Indonesia	71
8	India	67
9	Taiwan	58
10	Turkey	41

Suspected Bot List [2018-11-10]

detection period: 2018-11-10 00:00-23:59 UTC
number of suspected bots' IPs listed here: 246

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-09]

detection period: 2018-11-09 00:00-23:59 UTC
total number of suspected botnet IPs: 2270
number of botnet IPs notified to network operators: 1967
number of spam blocked: 1069
recipient count of spam blocked: 31983

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	81
2	CMPak-KHI-IGW	73
3	UNKNOWN	68
4	DIGITALOCEAN-8	51
5	TELKOMNET	38
6	LogicWeb-Inc	36
7	CHINANET-GD	35
8	MX-USCV4-LACNIC	32
9	VE-CSVE-LACNIC	31
10	HINET-NET	31

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	357
2	United States	264
3	Viet Nam	153
4	Russian Federation	146
5	Brazil	113
6	India	100
7	Pakistan	93
8	Indonesia	87
9	Mexico	52
10	Turkey	51

Suspected Bot List [2018-11-09]

detection period: 2018-11-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 303

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-08]

detection period: 2018-11-08 00:00-23:59 UTC
total number of suspected botnet IPs: 2858
number of botnet IPs notified to network operators: 2605
number of spam blocked: 3892
recipient count of spam blocked: 116731

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	133
2	TELKOMNET	63
3	VE-CSVE-LACNIC	54
4	HINET-NET	52
5	CMPak-KHI-IGW	41
6	CHINANET-GD	39
7	TencentCloud	36
8	DIGITALOCEAN-8	35
9	VIETEL-VNNIC-VN	32
10	CHINANET-JS	30

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	445
2	United States	300
3	Viet Nam	259
4	Russian Federation	212
5	Indonesia	157
6	Brazil	139
7	India	114
8	France	91
9	Taiwan	70
10	Venezuela	62

Suspected Bot List [2018-11-08]

detection period: 2018-11-08 00:00-23:59 UTC
number of suspected bots' IPs listed here: 253

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-07]

detection period: 2018-11-07 00:00-23:59 UTC
total number of suspected botnet IPs: 2381
number of botnet IPs notified to network operators: 2124
number of spam blocked: 90
recipient count of spam blocked: 2671

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	69
2	CMPak-KHI-IGW	53
3	TELKOMNET	44
4	AMAZON-2011L	44
5	VE-CSVE-LACNIC	41
6	MX-USCV4-LACNIC	35
7	AT-88-Z	35
8	HINET-NET	34
9	DIGITALOCEAN-8	31
10	CHINANET-GD	30

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	369
2	United States	319
3	Viet Nam	145
4	Russian Federation	144
5	Brazil	120
6	Indonesia	103
7	Pakistan	82
8	India	69
9	France	59
10	Mexico	56

Suspected Bot List [2018-11-07]

detection period: 2018-11-07 00:00-23:59 UTC
number of suspected bots' IPs listed here: 257

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-06]

detection period: 2018-11-06 00:00-23:59 UTC
total number of suspected botnet IPs: 2438
number of botnet IPs notified to network operators: 2214
number of spam blocked: 40
recipient count of spam blocked: 1142

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	79
2	CMPak-KHI-IGW	50
3	TELKOMNET	45
4	DIGITALOCEAN-8	43
5	CHINANET-GD	39
6	HINET-NET	34
7	CMNET	32
8	VE-CSVE-LACNIC	31
9	002.558.157/0001-62	30
10	LogicWeb-Inc	28

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	397
2	United States	256
3	Russian Federation	162
4	Viet Nam	158
5	Brazil	125
6	Indonesia	107
7	India	93
8	France	80
9	Pakistan	70
10	Netherlands	69

Suspected Bot List [2018-11-06]

detection period: 2018-11-06 00:00-23:59 UTC
number of suspected bots' IPs listed here: 224

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-05]

detection period: 2018-11-05 00:00-23:59 UTC
total number of suspected botnet IPs: 2214
number of botnet IPs notified to network operators: 2008
number of spam blocked: 12300
recipient count of spam blocked: 66747

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	68
2	CMPak-KHI-IGW	51
3	TELKOMNET	37
4	CHINANET-GD	34
5	HINET-NET	33
6	KORNET-KR	31
7	VE-CSVE-LACNIC	29
8	CHINANET-JS	29
9	CMNET	26
10	002.558.157/0001-62	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	387
2	United States	230
3	Russian Federation	141
4	Viet Nam	139
5	India	105
6	Brazil	105
7	Indonesia	78
8	France	76
9	Pakistan	61
10	United Kingdom	53

Suspected Bot List [2018-11-05]

detection period: 2018-11-05 00:00-23:59 UTC
number of suspected bots' IPs listed here: 206

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Suspected Bots' IP List for October 2018

To encourage cyber security information sharing (as some form of open data) while still giving victims enough time to clean up their computers, the IP list of suspected infected computers will be released here (as shown below). You are free to use them to create more effective defenses, discover latest trends in cyber attacks, etc.

Suspected Bots IP [2018-10-01]
Suspected Bots IP [2018-10-02]
Suspected Bots IP [2018-10-03]
Suspected Bots IP [2018-10-04]
Suspected Bots IP [2018-10-05]
Suspected Bots IP [2018-10-06]
Suspected Bots IP [2018-10-07]
Suspected Bots IP [2018-10-08]
Suspected Bots IP [2018-10-09]
Suspected Bots IP [2018-10-10]
Suspected Bots IP [2018-10-11]
Suspected Bots IP [2018-10-12]
Suspected Bots IP [2018-10-13]
Suspected Bots IP [2018-10-14]
Suspected Bots IP [2018-10-15]
Suspected Bots IP [2018-10-16]
Suspected Bots IP [2018-10-17]
Suspected Bots IP [2018-10-18]
Suspected Bots IP [2018-10-19]
Suspected Bots IP [2018-10-20]
Suspected Bots IP [2018-10-21]
Suspected Bots IP [2018-10-22]
Suspected Bots IP [2018-10-23]
Suspected Bots IP [2018-10-24]
Suspected Bots IP [2018-10-25]
Suspected Bots IP [2018-10-26]
Suspected Bots IP [2018-10-27]
Suspected Bots IP [2018-10-28]
Suspected Bots IP [2018-10-29]
Suspected Bots IP [2018-10-30]
Suspected Bots IP [2018-10-31]

Suspected Bots' IP List for September 2018

To encourage cyber security information sharing (as some form of open data) while still giving victims enough time to clean up their computers, the IP list of suspected infected computers will be released here (as shown below). You are free to use them to create more effective defenses, discover latest trends in cyber attacks, etc.

Suspected Bots IP [2018-09-01]
Suspected Bots IP [2018-09-02]
Suspected Bots IP [2018-09-03]
Suspected Bots IP [2018-09-04]
Suspected Bots IP [2018-09-05]
Suspected Bots IP [2018-09-06]
Suspected Bots IP [2018-09-07]
Suspected Bots IP [2018-09-08]
Suspected Bots IP [2018-09-09]
Suspected Bots IP [2018-09-10]
Suspected Bots IP [2018-09-11]
Suspected Bots IP [2018-09-12]
Suspected Bots IP [2018-09-13]
Suspected Bots IP [2018-09-14]
Suspected Bots IP [2018-09-15]
Suspected Bots IP [2018-09-16]
Suspected Bots IP [2018-09-17]
Suspected Bots IP [2018-09-18]
Suspected Bots IP [2018-09-19]
Suspected Bots IP [2018-09-20]
Suspected Bots IP [2018-09-21]
Suspected Bots IP [2018-09-22]
Suspected Bots IP [2018-09-23]
Suspected Bots IP [2018-09-24]
Suspected Bots IP [2018-09-25]
Suspected Bots IP [2018-09-26]
Suspected Bots IP [2018-09-27]
Suspected Bots IP [2018-09-28]
Suspected Bots IP [2018-09-29]
Suspected Bots IP [2018-09-30]

Botnet Statistics for October 2018

detection period: 2018-10-01 00:00 - 2018-10-31 23:59 UTC
total number of suspected botnet IPs: 30662
number of blocked spams: 184030
recipient count of blocked spams: 5086189

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	6165
2	United States	3657
3	Russian Federation	1882
4	Brazil	1752
5	Viet Nam	1598
6	Indonesia	1465
7	India	1084
8	Taiwan	1036
9	South Korea	646
10	Hong Kong	572
11	Turkey	563
12	France	553
13	Ukraine	491
14	Thailand	473
15	Italy	426
16	Mexico	401
17	Venezuela	384
18	Germany	373
19	United Kingdom	364
20	Iran	360
21	Netherlands	343
22	Sweden	303
23	Canada	300
24	Egypt	240
25	Colombia	230

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	147425
2	South Korea	12449
3	Spain	12167
4	Netherlands	5067
5	Colombia	4486
6	Canada	1311
7	United States	636
8	France	226
9	India	76
10	ZZ	26
11	Viet Nam	21
12	Indonesia	15
13	Germany	9
14	Bangladesh	8
15	Romania	7
16	Tunisia	6
17	Portugal	6
18	Brazil	6
19	Taiwan	5
20	Mexico	5
21	United Kingdom	5
22	Turkey	4
23	Philippines	4
24	Italy	4
25	Poland	3

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics for September 2018

detection period: 2018-09-01 00:00 - 2018-09-30 23:59 UTC
total number of suspected botnet IPs: 21714
number of blocked spams: 200946
recipient count of blocked spams: 5988768

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country	# of suspected botnet IPs
1	China	4494
2	United States	2428
3	Russian Federation	1318
4	Brazil	1236
5	Viet Nam	1136
6	Indonesia	918
7	India	843
8	Taiwan	723
9	France	456
10	South Korea	450
11	Thailand	396
12	Turkey	391
13	Ukraine	363
14	Italy	343
15	Hong Kong	305
16	United Kingdom	278
17	Mexico	269
18	Netherlands	266
19	Germany	261
20	Venezuela	259
21	Iran	230
22	Egypt	216
23	Canada	216
24	Colombia	184
25	South Africa	174

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

Rank	Country	# of blocked spams
1	China	144897
2	South Korea	19561
3	United States	11091
4	Colombia	8564
5	Spain	6817
6	Argentina	4465
7	Russian Federation	2506
8	United Kingdom	2135
9	Poland	335
10	Estonia	298
11	India	58
12	ZZ	28
13	Pakistan	22
14	Brazil	15
15	France	13
16	Viet Nam	10
17	Netherlands	8
18	Italy	8
19	Indonesia	6
20	Portugal	5
21	Nigeria	5
22	Iraq	5
23	Tunisia	4
24	Iran	4
25	Canada	4

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2018-11-04]

detection period: 2018-11-04 00:00-23:59 UTC
total number of suspected botnet IPs: 1942
number of botnet IPs notified to network operators: 1774
number of spam blocked: 8885
recipient count of spam blocked: 129146

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CMPak-KHI-IGW	61
2	DIGITALOCEAN-8	45
3	CHINANET-GD	36
4	HINET-NET	34
5	CHINANET-JS	31
6	VNPT-VNNIC-VN	28
7	VE-CSVE-LACNIC	25
8	UNKNOWN	23
9	CMNET	23
10	002.558.157/0001-62	23

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	366
2	United States	232
3	Russian Federation	129
4	Brazil	96
5	India	76
6	Viet Nam	75
7	Pakistan	69
8	France	62
9	Taiwan	58
10	Indonesia	56

Suspected Bot List [2018-11-04]

detection period: 2018-11-04 00:00-23:59 UTC
number of suspected bots' IPs listed here: 168

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-03]

detection period: 2018-11-03 00:00-23:59 UTC
total number of suspected botnet IPs: 1895
number of botnet IPs notified to network operators: 1708
number of spam blocked: 3921
recipient count of spam blocked: 117630

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	CMPak-KHI-IGW	54
2	DIGITALOCEAN-8	52
3	VNPT-VNNIC-VN	47
4	HINET-NET	44
5	TELKOMNET	30
6	CHINANET-GD	28
7	CMNET	24
8	VE-CSVE-LACNIC	22
9	WHG-NETWORKS	21
10	TencentCloud	20

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	327
2	United States	224
3	Russian Federation	128
4	Viet Nam	100
5	India	74
6	Indonesia	73
7	Brazil	68
8	Pakistan	65
9	Taiwan	58
10	France	51

Suspected Bot List [2018-11-03]

detection period: 2018-11-03 00:00-23:59 UTC
number of suspected bots' IPs listed here: 187

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-02]

detection period: 2018-11-02 00:00-23:59 UTC
total number of suspected botnet IPs: 1887
number of botnet IPs notified to network operators: 1709
number of spam blocked: 4188
recipient count of spam blocked: 125640

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	58
2	DIGITALOCEAN-8	41
3	HINET-NET	32
4	CMPak-KHI-IGW	30
5	TELKOMNET	28
6	AMAZON-2011L	28
7	VE-CSVE-LACNIC	25
8	TencentCloud	25
9	AT-88-Z	22
10	WHG-NETWORKS	21

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	332
2	United States	247
3	Russian Federation	129
4	Viet Nam	123
5	India	99
6	Indonesia	83
7	Brazil	75
8	United Kingdom	47
9	Taiwan	46
10	France	44

Suspected Bot List [2018-11-02]

detection period: 2018-11-02 00:00-23:59 UTC
number of suspected bots' IPs listed here: 178

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-11-01]

detection period: 2018-11-01 00:00-23:59 UTC
total number of suspected botnet IPs: 1921
number of botnet IPs notified to network operators: 1775
number of spam blocked: 2999
recipient count of spam blocked: 89865

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VNNIC-VN	54
2	CHINANET-JS	38
3	CHINANET-GD	38
4	HINET-NET	35
5	DIGITALOCEAN-8	33
6	CMPak-KHI-IGW	32
7	AT-88-Z	29
8	CMNET	25
9	TencentCloud	24
10	AMAZON-2011L	24

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	400
2	United States	262
3	Viet Nam	117
4	Russian Federation	117
5	Brazil	88
6	India	82
7	Taiwan	54
8	Indonesia	48
9	United Kingdom	45
10	France	45

Suspected Bot List [2018-11-01]

detection period: 2018-11-01 00:00-23:59 UTC
number of suspected bots' IPs listed here: 146

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

Botnet Statistics [2018-10-31]

detection period: 2018-10-31 00:00-23:59 UTC
total number of suspected botnet IPs: 1672
number of botnet IPs notified to network operators: 1514
number of spam blocked: 4787
recipient count of spam blocked: 143494

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	DIGITALOCEAN-8	38
2	VNPT-VNNIC-VN	35
3	HINET-NET	34
4	CHINANET-JS	32
5	CHINANET-GD	28
6	002.558.157/0001-62	27
7	CMNET	25
8	TELKOMNET	24
9	TencentCloud	20
10	LogicWeb-Inc	19

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	344
2	United States	221
3	Russian Federation	92
4	Brazil	90
5	Viet Nam	66
6	Taiwan	54
7	Indonesia	54
8	India	50
9	South Korea	43
10	Netherlands	40