Botnet Statistics [2019-11-29]

detection period: 2019-11-29 00:00-23:59 UTC
total number of suspected botnet IPs: 19342
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18671
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	722
2	TENCENT-CN	594
3	Baidu	589
4	VNPT-VN	300
5	KORNET	286
6	CHINANET-JS	280
7	HINET-NET	236
8	DO-13	226
9	VIETTEL-VN	205
10	CMNET	199

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5515
2	United States	2177
3	India	913
4	Viet Nam	754
5	Russian Federation	747
6	France	733
7	Brazil	649
8	Indonesia	570
9	South Korea	460
10	Singapore	379

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	22	48206
2	445	34209
3	222	24151
4	23	24039
5	1433	20131
6	3389	19136
7	26	18465
8	5288	12343
9	644	10753
10	643	10304

Suspected Bot List [2019-11-29]

detection period: 2019-11-29 00:00-23:59 UTC
number of suspected bots' IPs listed here: 671

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
LK	112.135.227.245	Sri Lanka

List from TCP port scans:

Botnet Statistics [2019-11-28]

detection period: 2019-11-28 00:00-23:59 UTC
total number of suspected botnet IPs: 21097
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20312
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	748
2	Baidu	616
3	TENCENT-CN	595
4	KORNET	324
5	VNPT-VN	320
6	CHINANET-JS	286
7	HINET-NET	267
8	VIETTEL-VN	234
9	CMNET	230
10	DO-13	221

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6252
2	United States	2209
3	India	953
4	Viet Nam	820
5	Russian Federation	792
6	France	775
7	Brazil	651
8	Indonesia	614
9	South Korea	508
10	Thailand	412

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	8022	54156
2	445	47995
3	22	41243
4	23	28413
5	222	26618
6	1433	17677
7	26	15908
8	999	10144
9	3389	9305
10	2622	9052

Suspected Bot List [2019-11-28]

detection period: 2019-11-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 785

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
EG	102.185.254.180	Egypt
KE	197.237.26.212	Kenya

List from TCP port scans:

Botnet Statistics [2019-11-27]

detection period: 2019-11-27 00:00-23:59 UTC
total number of suspected botnet IPs: 18701
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17955
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	682
2	Baidu	599
3	TENCENT-CN	557
4	VNPT-VN	312
5	KORNET	287
6	CHINANET-JS	275
7	HINET-NET	232
8	CMNET	217
9	VIETTEL-VN	211
10	TELKOMNET	211

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4834
2	United States	1968
3	India	887
4	Viet Nam	793
5	Brazil	727
6	Russian Federation	703
7	France	697
8	Indonesia	548
9	Thailand	488
10	South Korea	469

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	38623
2	22	36935
3	3129	29452
4	23	26237
5	2277	22269
6	26	18208
7	1433	14302
8	222	13277
9	999	9617
10	2200	7496

Suspected Bot List [2019-11-27]

detection period: 2019-11-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 746

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-11-26]

detection period: 2019-11-26 00:00-23:59 UTC
total number of suspected botnet IPs: 20260
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19510
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	708
2	Baidu	598
3	TENCENT-CN	564
4	HINET-NET	371
5	VNPT-VN	333
6	KORNET	288
7	CHINANET-JS	248
8	VIETTEL-VN	230
9	TELKOMNET	208
10	DIGITALOCEAN-12	206

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4991
2	United States	1940
3	Brazil	1039
4	India	997
5	Viet Nam	853
6	Russian Federation	802
7	Thailand	760
8	France	722
9	Indonesia	560
10	South Korea	472

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	67662
2	22	36454
3	23	30224
4	2622	27760
5	3129	22548
6	26	18050
7	1433	17539
8	32022	16238
9	2277	12508
10	999	9199

Suspected Bot List [2019-11-26]

detection period: 2019-11-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 750

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
CA	51.79.18.171	Canada
ES	88.9.204.226	Spain

List from TCP port scans:

Botnet Statistics [2019-11-25]

detection period: 2019-11-25 00:00-23:59 UTC
total number of suspected botnet IPs: 20373
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19608
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	726
2	Baidu	615
3	TENCENT-CN	572
4	HINET-NET	408
5	VNPT-VN	375
6	KORNET	301
7	CHINANET-JS	270
8	TELKOMNET	248
9	CMNET	239
10	VIETTEL-VN	236

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5213
2	United States	1932
3	India	954
4	Viet Nam	930
5	Brazil	841
6	Russian Federation	790
7	France	748
8	Thailand	739
9	Indonesia	660
10	South Korea	492

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	4022	463946
2	445	42332
3	22	35328
4	23	34823
5	10558	20000
6	26	18301
7	1433	16858
8	999	11611
9	9122	10670
10	3389	7384

Suspected Bot List [2019-11-25]

detection period: 2019-11-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 765

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
TN	41.231.56.98	Tunisia
ZA	102.132.250.152	South Africa

List from TCP port scans:

Botnet Statistics [2019-11-24]

detection period: 2019-11-24 00:00-23:59 UTC
total number of suspected botnet IPs: 18730
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18049
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	743
2	Baidu	632
3	TENCENT-CN	600
4	HINET-NET	354
5	KORNET	324
6	CMNET	234
7	CHINANET-JS	227
8	DO-13	201
9	DIGITALOCEAN-12	200
10	VNPT-VN	195

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5093
2	United States	2032
3	France	787
4	Russian Federation	784
5	Brazil	751
6	India	692
7	Viet Nam	583
8	South Korea	519
9	Thailand	466
10	Taiwan	447

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	4022	263774
2	445	38856
3	23	30235
4	22	23999
5	5038	22897
6	999	18625
7	26	17019
8	1433	12266
9	2200	9531
10	1596	8741

Suspected Bot List [2019-11-24]

detection period: 2019-11-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 681

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
ES	81.39.113.148	Spain
ES	150.214.168.161	Spain
IN	42.104.97.231	India

List from TCP port scans:

Botnet Statistics [2019-11-23]

detection period: 2019-11-23 00:00-23:59 UTC
total number of suspected botnet IPs: 21153
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20363
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	753
2	Baidu	636
3	TENCENT-CN	614
4	HINET-NET	465
5	KORNET	368
6	VNPT-VN	261
7	CMNET	244
8	CHINANET-JS	238
9	DO-13	221
10	ACEVILLEPTELTD-SG	209

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5240
2	United States	2102
3	Brazil	1100
4	India	1028
5	France	857
6	Thailand	794
7	Russian Federation	786
8	Viet Nam	720
9	South Korea	577
10	Taiwan	570

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	21	119093
2	445	61768
3	23	34368
4	22	26191
5	6666	22905
6	26	18570
7	999	18419
8	2220	18071
9	1433	13427
10	10222	9362

Suspected Bot List [2019-11-23]

detection period: 2019-11-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 790

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
GR	150.140.135.211	Greece
IN	42.104.97.242	India
NG	41.87.80.26	Nigeria

List from TCP port scans:

Botnet Statistics [2019-11-21]

detection period: 2019-11-21 00:00-23:59 UTC
total number of suspected botnet IPs: 18247
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17549
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	637
2	Baidu	595
3	TENCENT-CN	545
4	HINET-NET	420
5	VNPT-VN	314
6	KORNET	313
7	CMNET	227
8	DIGITALOCEAN-12	206
9	CHINANET-JS	204
10	VIETTEL-VN	202

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4652
2	United States	1931
3	India	903
4	Viet Nam	810
5	France	805
6	Russian Federation	692
7	Brazil	594
8	Taiwan	522
9	South Korea	512
10	Indonesia	512

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	144554
2	23	31051
3	22	27613
4	999	13994
5	2225	13887
6	2226	11707
7	26	11693
8	1433	10907
9	633	7506
10	4000	7453

Suspected Bot List [2019-11-21]

detection period: 2019-11-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 698

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
IN	43.241.120.83	India
TN	41.231.56.98	Tunisia

List from TCP port scans:

Botnet Statistics [2019-11-20]

detection period: 2019-11-20 00:00-23:59 UTC
total number of suspected botnet IPs: 19286
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18510
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	658
2	Baidu	604
3	TENCENT-CN	563
4	KORNET	344
5	VNPT-VN	328
6	HINET-NET	311
7	CMNET	249
8	CHINANET-JS	243
9	TELKOMNET	214
10	DIGITALOCEAN-12	203

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4966
2	United States	2033
3	Viet Nam	887
4	India	865
5	France	852
6	Russian Federation	784
7	Brazil	640
8	Indonesia	612
9	South Korea	562
10	Thailand	424

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	123371
2	23	38200
3	22	24265
4	999	15406
5	1433	13771
6	26	12584
7	3389	9692
8	2200	8236
9	4000	7591
10	3333	6857

Suspected Bot List [2019-11-20]

detection period: 2019-11-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 777

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
ID	103.219.112.1	Indonesia
IN	42.104.97.238	India
TN	41.231.5.110	Tunisia
ZA	155.93.250.147	South Africa
ZA	160.119.142.20	South Africa

List from TCP port scans:

Botnet Statistics [2019-11-19]

detection period: 2019-11-19 00:00-23:59 UTC
total number of suspected botnet IPs: 20631
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19852
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-HA	1039
2	TencentCloud	589
3	Baidu	566
4	TENCENT-CN	532
5	VNPT-VN	355
6	KORNET	311
7	HINET-NET	292
8	CMNET	254
9	CHINANET-JS	231
10	CHINANET-GD	231

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5895
2	United States	1926
3	Brazil	1030
4	Viet Nam	916
5	India	896
6	Russian Federation	776
7	France	747
8	Thailand	632
9	Indonesia	582
10	South Korea	515

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	23	53516
2	445	48584
3	22	32200
4	1433	17436
5	26	16707
6	3333	8592
7	7001	7974
8	3389	7930
9	8888	7671
10	2224	7313

Suspected Bot List [2019-11-19]

detection period: 2019-11-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 715

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
MX	189.232.105.10	Mexico

List from TCP port scans:

Botnet Statistics [2019-11-18]

detection period: 2019-11-18 00:00-23:59 UTC
total number of suspected botnet IPs: 21907
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21192
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-HA	1248
2	TencentCloud	586
3	Baidu	560
4	TENCENT-CN	532
5	VNPT-VN	358
6	HINET-NET	356
7	KORNET	300
8	VIETTEL-VN	254
9	TELKOMNET	237
10	CMNET	222

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5997
2	United States	1915
3	Brazil	1345
4	India	978
5	Viet Nam	964
6	Russian Federation	825
7	Thailand	781
8	France	719
9	Indonesia	639
10	South Korea	507

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	157353
2	23	59390
3	22	23102
4	1433	20692
5	1122	14916
6	22622	12741
7	2277	12195
8	26	11878
9	22322	8543
10	3389	6913

Suspected Bot List [2019-11-18]

detection period: 2019-11-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 715

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-11-17]

detection period: 2019-11-17 00:00-23:59 UTC
total number of suspected botnet IPs: 19459
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18825
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-HA	1093
2	TencentCloud	609
3	Baidu	583
4	TENCENT-CN	541
5	HINET-NET	379
6	KORNET	299
7	CHINANET-JS	229
8	CMNET	213
9	VNPT-VN	211
10	DIGITALOCEAN-12	205

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5707
2	United States	1969
3	Brazil	1053
4	France	766
5	Russian Federation	701
6	India	698
7	Thailand	688
8	Viet Nam	625
9	South Korea	492
10	Taiwan	466

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	282847
2	23	50504
3	22	21767
4	10021	13319
5	1433	10817
6	26	10018
7	2224	9072
8	2223	8531
9	2290	7487
10	2200	6928

Suspected Bot List [2019-11-17]

detection period: 2019-11-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 634

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
NG	41.87.80.26	Nigeria
UNKNOWN	185.254.120.41	UNKNOWN
ZA	155.93.250.147	South Africa

List from TCP port scans:

Botnet Statistics [2019-11-16]

detection period: 2019-11-16 00:00-23:59 UTC
total number of suspected botnet IPs: 18135
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17409
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	590
2	Baidu	587
3	TENCENT-CN	538
4	UNICOM-HA	462
5	HINET-NET	452
6	KORNET	303
7	VNPT-VN	246
8	CMNET	226
9	CHINANET-JS	210
10	DIGITALOCEAN-12	204

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4978
2	United States	1992
3	Brazil	734
4	India	731
5	France	727
6	Russian Federation	649
7	Viet Nam	633
8	Taiwan	559
9	South Korea	491
10	Indonesia	404

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	340719
2	23	37304
3	22	29472
4	1433	14249
5	20	11571
6	26	8409
7	3389	7175
8	2200	7167
9	221	6574
10	632	6224

Suspected Bot List [2019-11-16]

detection period: 2019-11-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 726

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
ID	202.162.220.202	Indonesia
NG	196.45.48.48	Nigeria

List from TCP port scans:

Botnet Statistics [2019-11-15]

detection period: 2019-11-15 00:00-23:59 UTC
total number of suspected botnet IPs: 18092
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17410
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	596
2	Baidu	593
3	TENCENT-CN	535
4	HINET-NET	330
5	VNPT-VN	295
6	KORNET	289
7	CMNET	266
8	CHINANET-JS	232
9	CHINANET-GD	218
10	UNICOM-HA	214

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5156
2	United States	2057
3	India	772
4	France	709
5	Russian Federation	701
6	Viet Nam	680
7	Indonesia	527
8	South Korea	468
9	Taiwan	438
10	Brazil	436

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	372392
2	23	29187
3	22	27229
4	1433	10453
5	2212	9992
6	26	9614
7	2200	8967
8	3389	8221
9	632	7234
10	633	6662

Suspected Bot List [2019-11-15]

detection period: 2019-11-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 682

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
UNKNOWN	185.254.120.41	UNKNOWN
ZA	160.119.141.196	South Africa

List from TCP port scans:

Botnet Statistics [2019-11-14]

detection period: 2019-11-14 00:00-23:59 UTC
total number of suspected botnet IPs: 18861
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18150
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	609
2	Baidu	606
3	TENCENT-CN	543
4	HINET-NET	391
5	UNICOM-HA	385
6	VNPT-VN	326
7	KORNET	303
8	CMNET	238
9	VIETTEL-VN	228
10	CHINANET-JS	219

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5164
2	United States	1990
3	India	848
4	Russian Federation	775
5	Viet Nam	752
6	France	736
7	Brazil	618
8	Indonesia	543
9	South Korea	495
10	Taiwan	482

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	23	38736
2	445	37875
3	22	35219
4	21	28672
5	123	18710
6	3389	13201
7	26	13060
8	223	12865
9	1433	11417
10	220	11185

Suspected Bot List [2019-11-14]

detection period: 2019-11-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 711

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
ES	79.158.108.108	Spain
IN	42.104.97.231	India

List from TCP port scans:

Botnet Statistics [2019-11-13]

detection period: 2019-11-13 00:00-23:59 UTC
total number of suspected botnet IPs: 20187
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19463
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-HA	1297
2	Baidu	619
3	TencentCloud	612
4	TENCENT-CN	552
5	HINET-NET	512
6	KORNET	310
7	VNPT-VN	303
8	VIETTEL-VN	255
9	CMNET	231
10	CHINANET-JS	208

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	6188
2	United States	1985
3	India	853
4	Viet Nam	796
5	France	772
6	Russian Federation	749
7	Brazil	662
8	Taiwan	615
9	Indonesia	525
10	South Korea	490

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	123	67211
2	23	44514
3	22	38930
4	445	27141
5	1433	13455
6	2280	11767
7	2200	9120
8	1597	7850
9	635	7671
10	1599	7629

Suspected Bot List [2019-11-13]

detection period: 2019-11-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 724

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
ES	88.1.126.116	Spain
NG	41.87.80.26	Nigeria
UNKNOWN	185.254.120.41	UNKNOWN
UNKNOWN	185.254.120.45	UNKNOWN

List from TCP port scans:

Botnet Statistics [2019-11-12]

detection period: 2019-11-12 00:00-23:59 UTC
total number of suspected botnet IPs: 20775
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20051
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	UNICOM-HA	2462
2	Baidu	643
3	TencentCloud	624
4	TENCENT-CN	585
5	KORNET	339
6	VNPT-VN	314
7	CMNET	262
8	HINET-NET	257
9	CHINANET-JS	231
10	TELKOMNET	218

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7373
2	United States	2065
3	France	805
4	Viet Nam	722
5	Russian Federation	692
6	India	678
7	Brazil	616
8	Indonesia	551
9	South Korea	520
10	Singapore	360

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	123	67541
2	23	46377
3	22	40050
4	445	35547
5	2200	9756
6	1433	9242
7	635	8601
8	1599	8151
9	2211	7905
10	633	7679

Suspected Bot List [2019-11-12]

detection period: 2019-11-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 724

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-11-11]

detection period: 2019-11-11 00:00-23:59 UTC
total number of suspected botnet IPs: 19438
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18683
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	Baidu	678
2	TencentCloud	667
3	TENCENT-CN	626
4	KORNET	346
5	CMNET	286
6	HINET-NET	284
7	VNPT-VN	278
8	DIGITALOCEAN-12	245
9	DO-13	237
10	CHINANET-JS	237

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	5349
2	United States	2351
3	France	858
4	India	781
5	Russian Federation	770
6	Viet Nam	726
7	Indonesia	567
8	South Korea	540
9	Brazil	478
10	Singapore	370

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	123	77251
2	23	41227
3	445	39512
4	22	34087
5	2200	13474
6	1433	12816
7	3389	10609
8	1599	9217
9	634	9208
10	635	8947

Suspected Bot List [2019-11-11]

detection period: 2019-11-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 755

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
TN	41.226.0.114	Tunisia

List from TCP port scans:

Botnet Statistics [2019-11-10]

detection period: 2019-11-10 00:00-23:59 UTC
total number of suspected botnet IPs: 16464
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15824
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	Baidu	667
2	TencentCloud	633
3	TENCENT-CN	618
4	KORNET	336
5	CMNET	262
6	HINET-NET	234
7	DO-13	222
8	DIGITALOCEAN-12	215
9	CHINANET-JS	204
10	OVH	177

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4833
2	United States	2051
3	France	812
4	Russian Federation	652
5	South Korea	510
6	India	501
7	Viet Nam	452
8	Brazil	413
9	Indonesia	390
10	Singapore	341

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	88661
2	23	28893
3	123	28000
4	22	24040
5	2200	15883
6	1433	10856
7	3389	9573
8	2202	7915
9	5900	6348
10	1000	5925

Suspected Bot List [2019-11-10]

detection period: 2019-11-10 00:00-23:59 UTC
number of suspected bots' IPs listed here: 640

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
UNKNOWN	185.254.120.41	UNKNOWN
ZA	196.24.44.6	South Africa

List from TCP port scans:

Botnet Statistics [2019-11-09]

detection period: 2019-11-09 00:00-23:59 UTC
total number of suspected botnet IPs: 16900
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16214
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	Baidu	681
2	TencentCloud	665
3	TENCENT-CN	625
4	KORNET	313
5	CMNET	269
6	DO-13	253
7	DIGITALOCEAN-12	229
8	CHINANET-JS	192
9	VNPT-VN	188
10	OVH	183

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4846
2	United States	2154
3	France	869
4	Russian Federation	630
5	India	627
6	Viet Nam	521
7	South Korea	496
8	Brazil	423
9	Indonesia	382
10	Singapore	342

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	47860
2	23	29111
3	5900	24063
4	22	18997
5	2022	11907
6	1433	10400
7	3389	8139
8	30022	8007
9	9000	7875
10	3989	7234

Suspected Bot List [2019-11-09]

detection period: 2019-11-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 686

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
KE	197.248.100.50	Kenya

List from TCP port scans:

Botnet Statistics [2019-11-08]

detection period: 2019-11-08 00:00-23:59 UTC
total number of suspected botnet IPs: 16869
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16220
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	Baidu	620
2	TencentCloud	610
3	TENCENT-CN	593
4	KORNET	323
5	DO-13	287
6	CMNET	260
7	VNPT-VN	221
8	DIGITALOCEAN-12	220
9	HINET-NET	197
10	ALISOFT	194

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4778
2	United States	2117
3	France	790
4	India	672
5	Russian Federation	628
6	Viet Nam	583
7	South Korea	514
8	Brazil	492
9	Indonesia	478
10	Singapore	338

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	45881
2	22	21267
3	23	18542
4	9000	13129
5	1433	8850
6	3389	8267
7	2022	7452
8	5900	7281
9	22222	6264
10	1000	5612

Suspected Bot List [2019-11-08]

detection period: 2019-11-08 00:00-23:59 UTC
number of suspected bots' IPs listed here: 649

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2019-11-07]

detection period: 2019-11-07 00:00-23:59 UTC
total number of suspected botnet IPs: 17316
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16680
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	Baidu	634
2	TencentCloud	600
3	TENCENT-CN	592
4	KORNET	350
5	DO-13	283
6	VNPT-VN	248
7	CMNET	242
8	HINET-NET	225
9	DIGITALOCEAN-12	208
10	ALISOFT	202

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4815
2	United States	2099
3	France	827
4	India	699
5	Russian Federation	692
6	Viet Nam	645
7	South Korea	524
8	Indonesia	507
9	Brazil	487
10	Singapore	321

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	37974
2	22222	30299
3	23	21437
4	22	19986
5	22011	14317
6	9000	10158
7	1433	10006
8	3389	9604
9	999	7733
10	990	7165

Suspected Bot List [2019-11-07]

detection period: 2019-11-07 00:00-23:59 UTC
number of suspected bots' IPs listed here: 636

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country
KR	203.237.114.108	South Korea
MX	189.232.63.153	Mexico

List from TCP port scans:

Botnet Statistics [2019-11-06]

detection period: 2019-11-06 00:00-23:59 UTC
total number of suspected botnet IPs: 17547
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16900
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	Baidu	626
2	TencentCloud	606
3	TENCENT-CN	599
4	KORNET	334
5	DO-13	270
6	VNPT-VN	267
7	CMNET	240
8	DIGITALOCEAN-12	219
9	HINET-NET	213
10	AT-88-Z	207

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	4685
2	United States	2390
3	France	827
4	India	712
5	Russian Federation	695
6	Viet Nam	683
7	Brazil	530
8	South Korea	509
9	Indonesia	509
10	Singapore	322

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	3022	35565
2	5038	27832
3	22	18423
4	23	18069
5	445	15204
6	222	10152
7	9000	9939
8	3389	8812
9	1433	8594
10	1000	8337