Custom Search

Sunday, June 30, 2019

Botnet Statistics [2019-06-29]

detection period: 2019-06-29 00:00-23:59 UTC
total number of suspected botnet IPs: 12644
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 11960
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1DO-13272
2TENCENT-CN258
3TencentCloud247
4GLOBAL-FRAG-NETWORKS243
5Baidu224
6KORNET180
7HINET-NET163
8VNPT-VN154
9DIGITALOCEAN-8151
10OVH146

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1United States2294
2China2288
3France638
4India531
5Brazil507
6Russian Federation414
7Viet Nam405
8South Korea384
9Indonesia343
10Italy244

Suspected Bot List [2019-06-29]

detection period: 2019-06-29 00:00-23:59 UTC
number of suspected bots' IPs listed here: 684

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
ES83.52.255.131Spain
FR87.90.109.61France
FR164.177.29.65France
FR176.130.149.145France

List from TCP port scans:

Saturday, June 29, 2019

Botnet Statistics [2019-06-28]

detection period: 2019-06-28 00:00-23:59 UTC
total number of suspected botnet IPs: 13726
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 13000
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TENCENT-CN358
2TencentCloud345
3DO-13278
4Baidu236
5VNPT-VN234
6GLOBAL-FRAG-NETWORKS232
7KORNET183
8PSYCHZ-NETWORKS175
9HINET-NET165
10DIGITALOCEAN-8159

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1United States2582
2China2502
3France652
4India608
5Brazil528
6Viet Nam515
7Russian Federation416
8Indonesia399
9South Korea382
10Singapore269

Suspected Bot List [2019-06-28]

detection period: 2019-06-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 726

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
CA51.79.129.235Canada
CA51.79.130.164Canada
NL185.244.25.235Netherlands

List from TCP port scans:

Friday, June 28, 2019

Botnet Statistics [2019-06-27]

detection period: 2019-06-27 00:00-23:59 UTC
total number of suspected botnet IPs: 13837
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 13096
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TENCENT-CN456
2TencentCloud392
3DO-13280
4Baidu239
5KORNET199
6VNPT-VN185
7HINET-NET176
8OVH155
9CHINANET-GD133
10VIETTEL-VN130

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2642
2United States2290
3France680
4India593
5Brazil586
6Viet Nam486
7South Korea404
8Russian Federation402
9Indonesia391
10Italy258

Suspected Bot List [2019-06-27]

detection period: 2019-06-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 741

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry

List from TCP port scans:

Thursday, June 27, 2019

Botnet Statistics [2019-06-26]

detection period: 2019-06-26 00:00-23:59 UTC
total number of suspected botnet IPs: 13021
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 12274
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TENCENT-CN369
2TencentCloud339
3DO-13268
4VNPT-VN235
5Baidu217
6KORNET207
7HINET-NET157
8OVH139
9VIETTEL-VN132
10DIGITALOCEAN-8126

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2340
2United States2021
3France630
4India557
5Brazil552
6Viet Nam517
7Russian Federation407
8Indonesia396
9South Korea391
10Italy247

Suspected Bot List [2019-06-26]

detection period: 2019-06-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 747

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
NL185.244.25.254Netherlands
PK39.38.16.37Pakistan
SN154.125.91.13Senegal
ZA102.165.35.243South Africa

List from TCP port scans:

Wednesday, June 26, 2019

Botnet Statistics [2019-06-25]

detection period: 2019-06-25 00:00-23:59 UTC
total number of suspected botnet IPs: 13234
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 12441
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TENCENT-CN363
2TencentCloud333
3DO-13270
4VNPT-VN221
5Baidu208
6KORNET204
7HINET-NET176
8OVH141
9DIGITALOCEAN-8125
10CHINANET-GD119

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2360
2United States2067
3France632
4Brazil563
5India551
6Viet Nam487
7Russian Federation436
8Indonesia403
9South Korea377
10Italy250

Suspected Bot List [2019-06-25]

detection period: 2019-06-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 793

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry

List from TCP port scans:

Tuesday, June 25, 2019

Botnet Statistics [2019-06-24]

detection period: 2019-06-24 00:00-23:59 UTC
total number of suspected botnet IPs: 13922
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 13092
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TENCENT-CN385
2TencentCloud361
3DO-13283
4Baidu216
5VNPT-VN212
6KORNET195
7HINET-NET162
8OVH157
9VIETTEL-VN134
10DIGITALOCEAN-8130

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2493
2United States2235
3France697
4India577
5Brazil572
6Viet Nam499
7Russian Federation425
8Indonesia416
9South Korea395
10Italy284

Suspected Bot List [2019-06-24]

detection period: 2019-06-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 830

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
EG41.129.41.124Egypt
FR176.139.183.139France

List from TCP port scans:

Monday, June 24, 2019

Botnet Statistics [2019-06-23]

detection period: 2019-06-23 00:00-23:59 UTC
total number of suspected botnet IPs: 11801
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 11136
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TENCENT-CN326
2TencentCloud312
3DO-13218
4Baidu201
5KORNET172
6HINET-NET145
7VNPT-VN139
8OVH137
9DIGITALOCEAN-8130
10CHINANET-GD115

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2156
2United States1853
3France623
4Brazil507
5India464
6Russian Federation401
7South Korea350
8Viet Nam335
9Indonesia276
10Italy220

Suspected Bot List [2019-06-23]

detection period: 2019-06-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 665

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
CM195.24.207.252Cameroon

List from TCP port scans:

Sunday, June 23, 2019

Botnet Statistics [2019-06-22]

detection period: 2019-06-22 00:00-23:59 UTC
total number of suspected botnet IPs: 12831
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 12145
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TENCENT-CN382
2TencentCloud348
3DO-13250
4Baidu221
5KORNET198
6VNPT-VN187
7HINET-NET162
8OVH142
9VIETTEL-VN131
10DIGITALOCEAN-8130

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2418
2United States1936
3France613
4Brazil533
5India509
6Viet Nam456
7Russian Federation447
8South Korea373
9Indonesia342
10Singapore222

Suspected Bot List [2019-06-22]

detection period: 2019-06-22 00:00-23:59 UTC
number of suspected bots' IPs listed here: 686

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
CA51.79.52.6Canada
FR176.159.245.52France

List from TCP port scans:

Saturday, June 22, 2019

Botnet Statistics [2019-06-21]

detection period: 2019-06-21 00:00-23:59 UTC
total number of suspected botnet IPs: 13173
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 12462
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TENCENT-CN388
2TencentCloud360
3DO-13267
4VNPT-VN240
5Baidu227
6KORNET212
7HINET-NET187
8OVH149
9TELKOMNET148
10DIGITALOCEAN-8146

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2441
2United States1993
3France651
4India565
5Brazil544
6Viet Nam536
7Indonesia454
8Russian Federation447
9South Korea397
10Hong Kong251

Suspected Bot List [2019-06-21]

detection period: 2019-06-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 711

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
FR176.135.172.128France

List from TCP port scans:

Friday, June 21, 2019

Botnet Statistics [2019-06-20]

detection period: 2019-06-20 00:00-23:59 UTC
total number of suspected botnet IPs: 13424
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 12739
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TENCENT-CN399
2TencentCloud357
3DO-13290
4VNPT-VN258
5KORNET229
6Baidu229
7HINET-NET216
8VIETTEL-VN170
9OVH154
10DIGITALOCEAN-8141

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2367
2United States2053
3France681
4India635
5Viet Nam594
6Brazil511
7Indonesia464
8Russian Federation450
9South Korea412
10Taiwan258

Suspected Bot List [2019-06-20]

detection period: 2019-06-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 685

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry

List from TCP port scans:

Thursday, June 20, 2019

Botnet Statistics [2019-06-19]

detection period: 2019-06-19 00:00-23:59 UTC
total number of suspected botnet IPs: 13898
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 12978
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TENCENT-CN412
2TencentCloud396
3DO-13317
4VNPT-VN269
5KORNET236
6Baidu233
7HINET-NET191
8OVH148
9DIGITALOCEAN-8140
10VIETTEL-VN138

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2510
2United States2142
3France661
4India647
5Viet Nam583
6Brazil565
7Indonesia430
8Russian Federation429
9South Korea424
10Singapore255

Suspected Bot List [2019-06-19]

detection period: 2019-06-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 920

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
FR176.139.183.139France
PT93.108.198.160Portugal
TN41.231.56.98Tunisia

List from TCP port scans:

Wednesday, June 19, 2019

Botnet Statistics [2019-06-18]

detection period: 2019-06-18 00:00-23:59 UTC
total number of suspected botnet IPs: 13940
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 13203
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TENCENT-CN412
2PSYCHZ-NETWORKS408
3TencentCloud394
4DO-13269
5VNPT-VN245
6Baidu217
7HINET-NET206
8KORNET200
9VIETTEL-VN138
10DIGITALOCEAN-8135

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2544
2United States2500
3France635
4Brazil586
5India566
6Viet Nam544
7Russian Federation467
8Indonesia435
9South Korea392
10Taiwan251

Suspected Bot List [2019-06-18]

detection period: 2019-06-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 737

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry

List from TCP port scans:

Tuesday, June 18, 2019

Botnet Statistics [2019-06-17]

detection period: 2019-06-17 00:00-23:59 UTC
total number of suspected botnet IPs: 14308
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 13538
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud412
2TENCENT-CN310
3DO-13297
4PSYCHZ-NETWORKS255
5Baidu244
6VNPT-VN233
7KORNET224
8HINET-NET174
9NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK160
10OVH156

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1United States2536
2China2488
3France705
4Brazil590
5India553
6Viet Nam508
7Russian Federation429
8Indonesia424
9South Korea410
10Singapore249

Suspected Bot List [2019-06-17]

detection period: 2019-06-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 770

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
ZA156.155.136.254South Africa

List from TCP port scans:

Monday, June 17, 2019

Botnet Statistics [2019-06-16]

detection period: 2019-06-16 00:00-23:59 UTC
total number of suspected botnet IPs: 12013
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 11305
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud414
2TENCENT-CN302
3HINET-NET281
4DO-13266
5Baidu236
6KORNET191
7AT-88-Z165
8OVH146
9NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK146
10VNPT-VN134

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2435
2United States2084
3France606
4Brazil461
5India392
6Russian Federation371
7South Korea356
8Viet Nam336
9Taiwan316
10Indonesia301

Suspected Bot List [2019-06-16]

detection period: 2019-06-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 708

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
JP133.242.17.196Japan
SE83.216.109.154Sweden

List from TCP port scans:

Sunday, June 16, 2019

Botnet Statistics [2019-06-15]

detection period: 2019-06-15 00:00-23:59 UTC
total number of suspected botnet IPs: 11297
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 10693
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud415
2HINET-NET284
3TENCENT-CN281
4DO-13242
5Baidu219
6VNPT-VN181
7AT-88-Z173
8KORNET154
9OVH151
10NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK134

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2165
2United States1881
3France626
4Brazil437
5India436
6Viet Nam416
7Russian Federation342
8Taiwan324
9South Korea315
10Indonesia302

Suspected Bot List [2019-06-15]

detection period: 2019-06-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 604

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
ES81.37.133.214Spain
MA196.206.82.227Morocco
NL185.244.25.105Netherlands

List from TCP port scans:

Saturday, June 15, 2019

Botnet Statistics [2019-06-14]

detection period: 2019-06-14 00:00-23:59 UTC
total number of suspected botnet IPs: 11660
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 11037
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud419
2TENCENT-CN299
3HINET-NET280
4DO-13249
5Baidu223
6VNPT-VN220
7KORNET158
8OVH152
9NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK139
1002.558.157/0001-62111

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2169
2United States1825
3France627
4Brazil495
5India478
6Viet Nam469
7Russian Federation409
8Indonesia367
9South Korea315
10Taiwan314

Suspected Bot List [2019-06-14]

detection period: 2019-06-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 623

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry

List from TCP port scans:

Friday, June 14, 2019

Botnet Statistics [2019-06-13]

detection period: 2019-06-13 00:00-23:59 UTC
total number of suspected botnet IPs: 12148
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 11490
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud414
2TENCENT-CN302
3HINET-NET299
4DO-13250
5Baidu223
6VNPT-VN206
7KORNET170
8OVH149
9NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK147
10VIETTEL-VN141

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2231
2United States1819
3France642
4India531
5Viet Nam487
6Brazil473
7Russian Federation410
8Indonesia392
9Taiwan347
10South Korea342

Suspected Bot List [2019-06-13]

detection period: 2019-06-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 658

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
RU83.149.226.11Russian Federation

List from TCP port scans:

Thursday, June 13, 2019

Botnet Statistics [2019-06-12]

detection period: 2019-06-12 00:00-23:59 UTC
total number of suspected botnet IPs: 12619
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 11965
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud419
2TENCENT-CN309
3DO-13260
4HINET-NET244
5VNPT-VN237
6Baidu226
7KORNET184
8OVH154
9NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK149
1002.558.157/0001-62136

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2214
2United States1852
3France662
4Brazil569
5India549
6Viet Nam497
7Russian Federation447
8Indonesia438
9South Korea353
10Taiwan287

Suspected Bot List [2019-06-12]

detection period: 2019-06-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 654

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry

List from TCP port scans:

Wednesday, June 12, 2019

Botnet Statistics [2019-06-11]

detection period: 2019-06-11 00:00-23:59 UTC
total number of suspected botnet IPs: 13604
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 12846
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud439
2TENCENT-CN313
3HINET-NET266
4DO-13252
5Baidu232
6VNPT-VN224
7KORNET213
8NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK161
9OVH149
10TELKOMNET145

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2339
2United States1844
3France681
4Brazil618
5India583
6Indonesia533
7Viet Nam518
8Russian Federation511
9South Korea392
10Taiwan319

Suspected Bot List [2019-06-11]

detection period: 2019-06-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 758

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
LY41.208.71.156Libya

List from TCP port scans:

Tuesday, June 11, 2019

Botnet Statistics [2019-06-10]

detection period: 2019-06-10 00:00-23:59 UTC
total number of suspected botnet IPs: 16228
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15356
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud448
2TENCENT-CN333
3HINET-NET297
4DO-13284
5Baidu250
6VNPT-VN232
7KORNET202
8TELKOMNET174
9NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK170
10OVH159

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2509
2United States2113
3Brazil851
4India768
5France731
6Indonesia697
7Russian Federation692
8Viet Nam526
9South Korea395
10Taiwan355

Suspected Bot List [2019-06-10]

detection period: 2019-06-10 00:00-23:59 UTC
number of suspected bots' IPs listed here: 872

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
CA51.79.130.164Canada

List from TCP port scans:

Monday, June 10, 2019

Botnet Statistics [2019-06-09]

detection period: 2019-06-09 00:00-23:59 UTC
total number of suspected botnet IPs: 12573
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 11849
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud407
2HINET-NET383
3TENCENT-CN305
4Baidu243
5DO-13237
6KORNET182
7OVH151
8NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK135
9VNPT-VN129
1002.558.157/0001-62114

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2251
2United States1747
3France681
4Brazil591
5India474
6Russian Federation457
7Taiwan426
8South Korea362
9Indonesia354
10Viet Nam312

Suspected Bot List [2019-06-09]

detection period: 2019-06-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 724

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
ES217.127.237.153Spain
PL109.241.71.16Poland

List from TCP port scans:

Sunday, June 9, 2019

Botnet Statistics [2019-06-08]

detection period: 2019-06-08 00:00-23:59 UTC
total number of suspected botnet IPs: 12247
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 11567
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud411
2HINET-NET346
3TENCENT-CN306
4DO-13250
5Baidu245
6KORNET193
7VNPT-VN172
8OVH155
9NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK142
10ALISOFT107

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2284
2United States1807
3France697
4India527
5Brazil507
6Russian Federation421
7Viet Nam414
8Taiwan399
9South Korea363
10Indonesia303

Suspected Bot List [2019-06-08]

detection period: 2019-06-08 00:00-23:59 UTC
number of suspected bots' IPs listed here: 680

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
CA51.79.130.164Canada
NG41.203.76.254Nigeria

List from TCP port scans:

Saturday, June 8, 2019

Botnet Statistics [2019-06-07]

detection period: 2019-06-07 00:00-23:59 UTC
total number of suspected botnet IPs: 11319
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 10713
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud338
2HINET-NET318
3TENCENT-CN268
4DO-13237
5Baidu230
6VNPT-VN220
7KORNET204
8OVH139
9VIETTEL-VN121
10NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK121

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China1989
2United States1724
3France672
4India535
5Viet Nam469
6Brazil438
7Russian Federation421
8South Korea361
9Taiwan356
10Indonesia258

Suspected Bot List [2019-06-07]

detection period: 2019-06-07 00:00-23:59 UTC
number of suspected bots' IPs listed here: 606

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
DE116.203.132.47Germany
ES80.28.234.134Spain
ES88.10.39.183Spain
NL185.244.25.105Netherlands
PL178.235.7.61Poland
ZA196.2.73.190South Africa

List from TCP port scans:

Friday, June 7, 2019

Botnet Statistics [2019-06-06]

detection period: 2019-06-06 00:00-23:59 UTC
total number of suspected botnet IPs: 11470
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 10828
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud366
2HINET-NET310
3TENCENT-CN266
4DO-13241
5Baidu235
6VNPT-VN228
7KORNET215
8VIETTEL-VN149
9OVH138
10NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK129

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2025
2United States1684
3France666
4Viet Nam524
5India507
6Brazil482
7Russian Federation441
8South Korea374
9Taiwan348
10Indonesia238

Suspected Bot List [2019-06-06]

detection period: 2019-06-06 00:00-23:59 UTC
number of suspected bots' IPs listed here: 642

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
CA51.79.130.164Canada

List from TCP port scans:

Thursday, June 6, 2019

Botnet Statistics [2019-06-05]

detection period: 2019-06-05 00:00-23:59 UTC
total number of suspected botnet IPs: 11969
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 11285
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud388
2HINET-NET357
3TENCENT-CN286
4DO-13239
5Baidu236
6VNPT-VN218
7KORNET203
8AT-88-Z174
9OVH141
10NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK140

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2169
2United States1953
3France709
4Viet Nam479
5India475
6Brazil464
7Russian Federation435
8Taiwan401
9South Korea354
10Indonesia250

Suspected Bot List [2019-06-05]

detection period: 2019-06-05 00:00-23:59 UTC
number of suspected bots' IPs listed here: 684

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
KR211.184.117.131South Korea

List from TCP port scans:

Wednesday, June 5, 2019

Botnet Statistics [2019-06-04]

detection period: 2019-06-04 00:00-23:59 UTC
total number of suspected botnet IPs: 12282
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 11582
number of spam blocked: 1
recipient count of spam blocked: 1

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud398
2HINET-NET347
3TENCENT-CN293
4DO-13246
5Baidu245
6VNPT-VN224
7KORNET217
8OVH148
9NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK139
10VIETTEL-VN122

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2241
2United States1798
3France703
4India505
5Viet Nam493
6Brazil472
7Russian Federation467
8Taiwan386
9South Korea370
10Indonesia292

Suspected Bot List [2019-06-04]

detection period: 2019-06-04 00:00-23:59 UTC
number of suspected bots' IPs listed here: 700

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
JP210.152.84.13Japan
TN102.152.19.81Tunisia

List from TCP port scans:

Tuesday, June 4, 2019

Botnet Statistics [2019-06-03]

detection period: 2019-06-03 00:00-23:59 UTC
total number of suspected botnet IPs: 12307
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 11631
number of spam blocked: 4
recipient count of spam blocked: 4

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud410
2HINET-NET329
3TENCENT-CN291
4Baidu244
5DO-13243
6VNPT-VN227
7KORNET196
8OVH149
9VIETTEL-VN142
10NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK141

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2249
2United States1901
3France697
4India581
5Viet Nam530
6Brazil507
7Russian Federation415
8Taiwan367
9South Korea360
10Indonesia293

Suspected Bot List [2019-06-03]

detection period: 2019-06-03 00:00-23:59 UTC
number of suspected bots' IPs listed here: 676

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry
ES5.205.164.29Spain
JP61.126.41.124Japan
TN41.231.56.98Tunisia

List from TCP port scans:

Monday, June 3, 2019

Botnet Statistics [2019-06-02]

detection period: 2019-06-02 00:00-23:59 UTC
total number of suspected botnet IPs: 11857
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 11174
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud410
2HINET-NET340
3TENCENT-CN300
4DO-13261
5Baidu244
6KORNET177
7OVH154
8NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK153
9AT-88-Z130
10VNPT-VN122

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2264
2United States1914
3France701
4Brazil466
5India435
6Russian Federation401
7Taiwan387
8South Korea335
9Viet Nam306
10Indonesia276

Suspected Bot List [2019-06-02]

detection period: 2019-06-02 00:00-23:59 UTC
number of suspected bots' IPs listed here: 683

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry

List from TCP port scans:

Sunday, June 2, 2019

Botnet Statistics [2019-06-01]

detection period: 2019-06-01 00:00-23:59 UTC
total number of suspected botnet IPs: 11376
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 10772
number of spam blocked: 3
recipient count of spam blocked: 3

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud400
2HINET-NET316
3TENCENT-CN285
4Baidu237
5DO-13234
6VNPT-VN175
7AT-88-Z172
8KORNET161
9NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK149
10OVH139

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China2204
2United States1979
3France625
4India496
5Brazil440
6Viet Nam394
7Russian Federation357
8Taiwan356
9South Korea318
10Indonesia255