Botnet Statistics [2020-04-29]

detection period: 2020-04-29 00:00-23:59 UTC
total number of suspected botnet IPs: 35722
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 33455
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1120
2	VNPT-VN	1045
3	Baidu	864
4	VIETTEL-VN	753
5	DIGITALOCEAN-162-243-0-0	734
6	TENCENT-CN	665
7	HINET-NET	618
8	VODACOM-06062012	510
9	TELKOMNET	406
10	CHINANET-JS	398

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7733
2	United States	4440
3	Viet Nam	2480
4	Russian Federation	2136
5	Indonesia	1275
6	India	1237
7	France	1032
8	Thailand	807
9	Taiwan	788
10	South Korea	617

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1024	532660
2	105	195284
3	600	188120
4	104	169403
5	123	164621
6	106	164232
7	8220	145965
8	2008	144496
9	60	135449
10	107	133640

Suspected Bot List [2020-04-29]

detection period: 2020-04-29 00:00-23:59 UTC
number of suspected bots' IPs listed here: 2267

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-28]

detection period: 2020-04-28 00:00-23:59 UTC
total number of suspected botnet IPs: 34756
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 33103
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	1146
2	TencentCloud	1142
3	Baidu	907
4	VIETTEL-VN	739
5	TENCENT-CN	676
6	HINET-NET	675
7	TELKOMNET	442
8	DIGITALOCEAN-162-243-0-0	403
9	CHINANET-JS	389
10	CMNET	370

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7878
2	United States	4028
3	Viet Nam	2593
4	Russian Federation	2090
5	Indonesia	1262
6	India	1179
7	France	1033
8	Taiwan	871
9	Thailand	746
10	South Korea	603

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1024	556800
2	123	162537
3	445	119989
4	6021	94718
5	9000	92903
6	4022	78396
7	22	75650
8	7777	63952
9	5900	53577
10	222	51566

Suspected Bot List [2020-04-28]

detection period: 2020-04-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1653

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-27]

detection period: 2020-04-27 00:00-23:59 UTC
total number of suspected botnet IPs: 33828
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 32181
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1190
2	VNPT-VN	1123
3	Baidu	938
4	VIETTEL-VN	717
5	TENCENT-CN	708
6	HINET-NET	597
7	TELKOMNET	430
8	DIGITALOCEAN-162-243-0-0	404
9	CHINANET-JS	400
10	CHINANET-GD	377

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7935
2	United States	4086
3	Viet Nam	2513
4	Russian Federation	2040
5	Indonesia	1200
6	India	1171
7	France	1034
8	Taiwan	741
9	Thailand	717
10	South Korea	611

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1024	574898
2	445	185224
3	123	158881
4	7222	86601
5	9000	70637
6	4022	69620
7	7777	63842
8	22	61027
9	4444	58291
10	23	55691

Suspected Bot List [2020-04-27]

detection period: 2020-04-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1647

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-26]

detection period: 2020-04-26 00:00-23:59 UTC
total number of suspected botnet IPs: 33367
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31842
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1222
2	Baidu	992
3	TENCENT-CN	735
4	VNPT-VN	732
5	HINET-NET	639
6	VIETTEL-VN	560
7	ALISOFT	447
8	CHINANET-GD	441
9	CHINANET-JS	422
10	DIGITALOCEAN-162-243-0-0	403

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8428
2	United States	4234
3	Russian Federation	1948
4	Viet Nam	1882
5	France	1054
6	India	1040
7	Indonesia	986
8	Taiwan	814
9	South Korea	641
10	Thailand	559

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1024	580130
2	123	162873
3	4022	86647
4	222	79067
5	7777	66983
6	445	63410
7	9000	63227
8	4444	61277
9	22	59677
10	5900	54800

Suspected Bot List [2020-04-26]

detection period: 2020-04-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1525

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-25]

detection period: 2020-04-25 00:00-23:59 UTC
total number of suspected botnet IPs: 32523
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30978
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1157
2	Baidu	960
3	VNPT-VN	776
4	TENCENT-CN	677
5	VIETTEL-VN	656
6	HINET-NET	654
7	CHINANET-JS	481
8	ALISOFT	434
9	DIGITALOCEAN-162-243-0-0	406
10	CHINANET-GD	398

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8098
2	United States	3893
3	Viet Nam	2028
4	Russian Federation	1900
5	India	1080
6	Indonesia	1007
7	France	992
8	Taiwan	849
9	South Korea	593
10	Hong Kong	564

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1024	583517
2	123	165069
3	2048	103904
4	4022	83439
5	7777	69127
6	445	61593
7	4444	61522
8	3389	60143
9	9000	58384
10	5900	55765

Suspected Bot List [2020-04-25]

detection period: 2020-04-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1545

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-24]

detection period: 2020-04-24 00:00-23:59 UTC
total number of suspected botnet IPs: 34830
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 33160
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1181
2	VNPT-VN	1040
3	Baidu	1005
4	HINET-NET	818
5	TENCENT-CN	720
6	VIETTEL-VN	713
7	ALISOFT	446
8	CHINANET-GD	432
9	CHINANET-JS	425
10	MSFT	408

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8753
2	United States	4193
3	Viet Nam	2368
4	Russian Federation	1990
5	India	1220
6	Indonesia	1076
7	Taiwan	1005
8	France	978
9	Thailand	734
10	South Korea	665

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1024	552263
2	2048	266397
3	4000	248924
4	7000	231153
5	8000	209623
6	3000	205210
7	2000	195405
8	5000	189541
9	1000	172371
10	25	163615

Suspected Bot List [2020-04-24]

detection period: 2020-04-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1670

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-23]

detection period: 2020-04-23 00:00-23:59 UTC
total number of suspected botnet IPs: 32404
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30812
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1116
2	Baidu	911
3	VNPT-VN	854
4	TENCENT-CN	650
5	VIETTEL-VN	648
6	HINET-NET	578
7	DIGITALOCEAN-162-243-0-0	414
8	CHINANET-GD	407
9	ALISOFT	405
10	CMNET	385

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7683
2	United States	4060
3	Russian Federation	2171
4	Viet Nam	2075
5	India	1099
6	Indonesia	1040
7	France	941
8	Taiwan	741
9	Thailand	733
10	South Korea	541

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1000	1392976
2	4000	1365406
3	2000	1331829
4	6000	1316604
5	3000	1275860
6	5000	1233912
7	8000	1162045
8	7000	1038577
9	6001	963101
10	1024	170198

Suspected Bot List [2020-04-23]

detection period: 2020-04-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1592

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-22]

detection period: 2020-04-22 00:00-23:59 UTC
total number of suspected botnet IPs: 33943
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 32238
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1162
2	VNPT-VN	1138
3	Baidu	958
4	VIETTEL-VN	760
5	TENCENT-CN	698
6	HINET-NET	564
7	ALISOFT	419
8	CHINANET-GD	414
9	DIGITALOCEAN-162-243-0-0	409
10	CHINANET-JS	406

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8383
2	United States	3768
3	Viet Nam	2523
4	Russian Federation	2052
5	India	1158
6	Indonesia	1146
7	France	984
8	Thailand	884
9	Taiwan	745
10	South Korea	584

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1000	1397735
2	8000	1383124
3	5000	1317055
4	7000	1304276
5	3000	1246555
6	6000	1188056
7	4000	1140108
8	2000	1125808
9	6001	543467
10	2048	211867

Suspected Bot List [2020-04-22]

detection period: 2020-04-22 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1705

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-21]

detection period: 2020-04-21 00:00-23:59 UTC
total number of suspected botnet IPs: 35651
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 33914
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	VNPT-VN	1358
2	TencentCloud	1306
3	Baidu	1059
4	TENCENT-CN	823
5	VIETTEL-VN	780
6	HINET-NET	585
7	CHINANET-GD	473
8	ALISOFT	470
9	DIGITALOCEAN-162-243-0-0	416
10	CMNET	395

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	9119
2	United States	3971
3	Viet Nam	2800
4	Russian Federation	2147
5	India	1195
6	Indonesia	1144
7	France	1000
8	Thailand	920
9	Taiwan	773
10	South Korea	622

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2000	1707423
2	8000	1691302
3	1000	1637236
4	5000	1589001
5	4000	1587024
6	7000	1547759
7	3000	1397550
8	6000	1324693
9	2048	226159
10	123	142346

Suspected Bot List [2020-04-21]

detection period: 2020-04-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1737

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-20]

detection period: 2020-04-20 00:00-23:59 UTC
total number of suspected botnet IPs: 33570
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31889
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1273
2	VNPT-VN	1083
3	Baidu	1048
4	TENCENT-CN	784
5	VIETTEL-VN	609
6	HINET-NET	558
7	ALISOFT	435
8	DIGITALOCEAN-162-243-0-0	430
9	CHINANET-GD	427
10	CHINANET-JS	381

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8470
2	United States	3973
3	Viet Nam	2298
4	Russian Federation	2001
5	India	1113
6	Indonesia	993
7	France	937
8	Taiwan	732
9	Thailand	680
10	South Korea	604

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	8000	1029400
2	1000	1003499
3	4000	988306
4	2000	954609
5	5000	938646
6	7000	922864
7	3000	784014
8	6000	782585
9	2048	230155
10	1024	156409

Suspected Bot List [2020-04-20]

detection period: 2020-04-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1681

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-19]

detection period: 2020-04-19 00:00-23:59 UTC
total number of suspected botnet IPs: 30474
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29136
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1309
2	Baidu	1059
3	TENCENT-CN	825
4	VNPT-VN	644
5	HINET-NET	522
6	VIETTEL-VN	456
7	DIGITALOCEAN-162-243-0-0	436
8	CHINANET-JS	407
9	CHINANET-GD	402
10	CMNET	367

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8275
2	United States	3956
3	Russian Federation	1889
4	Viet Nam	1547
5	France	991
6	India	875
7	Indonesia	711
8	Taiwan	687
9	South Korea	573
10	Hong Kong	534

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2048	226080
2	123	153077
3	1024	120302
4	6002	117363
5	4022	112658
6	5900	97986
7	10000	94705
8	3622	89715
9	3522	79742
10	8899	73760

Suspected Bot List [2020-04-19]

detection period: 2020-04-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1338

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-18]

detection period: 2020-04-18 00:00-23:59 UTC
total number of suspected botnet IPs: 31145
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29683
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1220
2	Baidu	981
3	VNPT-VN	787
4	TENCENT-CN	741
5	HINET-NET	549
6	VIETTEL-VN	505
7	DIGITALOCEAN-162-243-0-0	438
8	MSFT	435
9	CHINANET-JS	429
10	CHINANET-GD	395

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8275
2	United States	4074
3	Russian Federation	1804
4	Viet Nam	1764
5	India	953
6	France	938
7	Indonesia	791
8	Taiwan	715
9	South Korea	584
10	Thailand	557

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2048	243133
2	123	166286
3	1024	130248
4	445	102419
5	5900	100257
6	4022	86652
7	22	60873
8	222	59120
9	7777	56858
10	3389	52316

Suspected Bot List [2020-04-18]

detection period: 2020-04-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1462

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-17]

detection period: 2020-04-17 00:00-23:59 UTC
total number of suspected botnet IPs: 32560
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31021
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1205
2	VNPT-VN	1020
3	Baidu	975
4	TENCENT-CN	738
5	VIETTEL-VN	674
6	HINET-NET	591
7	CHINANET-GD	453
8	DIGITALOCEAN-162-243-0-0	443
9	CHINANET-JS	427
10	ALISOFT	402

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8274
2	United States	4040
3	Viet Nam	2268
4	Russian Federation	1989
5	India	1019
6	France	963
7	Indonesia	874
8	Taiwan	778
9	Thailand	668
10	South Korea	608

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2048	183439
2	123	171588
3	1024	134795
4	5900	101119
5	6000	97578
6	445	96940
7	23	78850
8	22	73223
9	4022	72176
10	222	65673

Suspected Bot List [2020-04-17]

detection period: 2020-04-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1539

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-16]

detection period: 2020-04-16 00:00-23:59 UTC
total number of suspected botnet IPs: 33740
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 32149
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1260
2	Baidu	984
3	VNPT-VN	930
4	TENCENT-CN	754
5	VIETTEL-VN	686
6	HINET-NET	640
7	CHINANET-GD	439
8	DIGITALOCEAN-162-243-0-0	438
9	CHINANET-JS	412
10	ALISOFT	409

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8336
2	United States	4062
3	Viet Nam	2174
4	Russian Federation	2171
5	India	1067
6	Indonesia	1034
7	France	959
8	Taiwan	809
9	Thailand	751
10	South Korea	584

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2048	162889
2	1024	161629
3	123	154545
4	5900	102850
5	445	83311
6	4022	79040
7	22	64155
8	7777	63466
9	4444	51797
10	23	50794

Suspected Bot List [2020-04-16]

detection period: 2020-04-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1591

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-15]

detection period: 2020-04-15 00:00-23:59 UTC
total number of suspected botnet IPs: 31673
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30137
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1104
2	VNPT-VN	971
3	Baidu	896
4	VIETTEL-VN	675
5	TENCENT-CN	672
6	HINET-NET	608
7	DIGITALOCEAN-162-243-0-0	447
8	CHINANET-JS	421
9	CHINANET-GD	408
10	ALISOFT	356

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7556
2	United States	3748
3	Viet Nam	2229
4	Russian Federation	1959
5	India	1020
6	Indonesia	991
7	France	896
8	Taiwan	781
9	Thailand	773
10	South Korea	592

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	123	197803
2	1024	166556
3	445	161995
4	5900	114171
5	10000	111406
6	7000	105100
7	3422	102663
8	4022	98681
9	3122	76711
10	7777	72430

Suspected Bot List [2020-04-15]

detection period: 2020-04-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1536

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-14]

detection period: 2020-04-14 00:00-23:59 UTC
total number of suspected botnet IPs: 33731
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31990
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1116
2	VNPT-VN	1055
3	Baidu	909
4	VIETTEL-VN	686
5	TENCENT-CN	669
6	HINET-NET	609
7	DIGITALOCEAN-162-243-0-0	449
8	CHINANET-GD	420
9	CHINANET-JS	409
10	ALISOFT	387

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8011
2	United States	3660
3	Viet Nam	2398
4	Russian Federation	2152
5	India	1119
6	Indonesia	1043
7	France	924
8	Taiwan	793
9	Thailand	780
10	South Korea	617

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2048	225761
2	123	191695
3	445	166379
4	1024	162924
5	5900	107728
6	2822	105803
7	2922	105345
8	2622	104074
9	4022	95480
10	2722	95070

Suspected Bot List [2020-04-14]

detection period: 2020-04-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1741

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-13]

detection period: 2020-04-13 00:00-23:59 UTC
total number of suspected botnet IPs: 35310
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 33593
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1184
2	VNPT-VN	1111
3	Baidu	947
4	VIETTEL-VN	797
5	TENCENT-CN	710
6	HINET-NET	680
7	CHINANET-JS	456
8	DIGITALOCEAN-162-243-0-0	453
9	ALISOFT	439
10	CHINANET-GD	427

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8216
2	United States	4076
3	Viet Nam	2553
4	Russian Federation	2186
5	India	1152
6	Indonesia	1069
7	France	1004
8	Taiwan	880
9	Thailand	736
10	South Korea	681

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	7070	328972
2	1224	303039
3	2048	295910
4	123	198369
5	1024	164486
6	445	152005
7	6000	140696
8	8288	133529
9	5900	116464
10	2422	112333

Suspected Bot List [2020-04-13]

detection period: 2020-04-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1717

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-12]

detection period: 2020-04-12 00:00-23:59 UTC
total number of suspected botnet IPs: 33038
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31453
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1214
2	Baidu	967
3	VNPT-VN	806
4	TENCENT-CN	724
5	HINET-NET	676
6	VIETTEL-VN	616
7	DIGITALOCEAN-162-243-0-0	453
8	CHINANET-JS	430
9	ALISOFT	422
10	CHINANET-GD	414

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8053
2	United States	3937
3	Viet Nam	2022
4	Russian Federation	1999
5	India	1030
6	France	982
7	Taiwan	897
8	Indonesia	872
9	South Korea	642
10	Thailand	563

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	1249919
2	7070	361274
3	2048	294454
4	1024	186948
5	123	173843
6	6000	114437
7	4022	114417
8	1110	105948
9	6006	97470
10	1622	96639

Suspected Bot List [2020-04-12]

detection period: 2020-04-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1585

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-11]

detection period: 2020-04-11 00:00-23:59 UTC
total number of suspected botnet IPs: 30277
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 28833
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1138
2	Baidu	916
3	VNPT-VN	789
4	TENCENT-CN	689
5	HINET-NET	620
6	VIETTEL-VN	560
7	ALISOFT	499
8	DIGITALOCEAN-162-243-0-0	445
9	CHINANET-JS	424
10	CHINANET-GD	395

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7727
2	United States	3683
3	Viet Nam	1920
4	Russian Federation	1702
5	France	951
6	India	940
7	Taiwan	813
8	Indonesia	739
9	South Korea	592
10	Thailand	562

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	7070	792720
2	5038	564118
3	2048	245577
4	1024	220421
5	4022	205769
6	123	123826
7	22	84347
8	445	76397
9	7777	70557
10	1322	66081

Suspected Bot List [2020-04-11]

detection period: 2020-04-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1444

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-10]

detection period: 2020-04-10 00:00-23:59 UTC
total number of suspected botnet IPs: 30607
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29124
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1185
2	Baidu	948
3	VNPT-VN	861
4	TENCENT-CN	703
5	HINET-NET	555
6	VIETTEL-VN	492
7	DIGITALOCEAN-162-243-0-0	457
8	CHINANET-JS	402
9	ALISOFT	392
10	CHINANET-GD	385

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7690
2	United States	3678
3	Russian Federation	1924
4	Viet Nam	1914
5	India	1011
6	France	960
7	Taiwan	728
8	Thailand	700
9	Indonesia	676
10	South Korea	600

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	1572708
2	7070	336563
3	1234	196060
4	2048	160961
5	123	152346
6	1024	141454
7	4022	85870
8	445	84833
9	7000	83040
10	7777	64948

Suspected Bot List [2020-04-10]

detection period: 2020-04-10 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1483

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-09]

detection period: 2020-04-09 00:00-23:59 UTC
total number of suspected botnet IPs: 32587
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31035
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1230
2	Baidu	972
3	VNPT-VN	919
4	TENCENT-CN	726
5	HINET-NET	601
6	VIETTEL-VN	585
7	ALISOFT	474
8	DIGITALOCEAN-162-243-0-0	454
9	CHINANET-GD	428
10	CHINANET-JS	390

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8084
2	United States	3870
3	Viet Nam	2043
4	Russian Federation	2013
5	India	1062
6	France	1027
7	Indonesia	968
8	Taiwan	782
9	Thailand	664
10	South Korea	638

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2048	166178
2	5038	159083
3	1024	141835
4	123	109386
5	445	95201
6	4022	74755
7	23	70895
8	7777	67041
9	4444	60986
10	22	59269

Suspected Bot List [2020-04-09]

detection period: 2020-04-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1552

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-08]

detection period: 2020-04-08 00:00-23:59 UTC
total number of suspected botnet IPs: 31637
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29991
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1099
2	Baidu	935
3	VNPT-VN	918
4	TENCENT-CN	655
5	HINET-NET	644
6	VIETTEL-VN	597
7	ALISOFT	496
8	DIGITALOCEAN-162-243-0-0	454
9	CHINANET-GD	418
10	CHINANET-JS	379

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7637
2	United States	3642
3	Russian Federation	2030
4	Viet Nam	2029
5	India	1069
6	Indonesia	934
7	France	888
8	Taiwan	844
9	Thailand	721
10	South Korea	574

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	367328
2	7070	193690
3	2048	179654
4	123	158050
5	1024	157087
6	5486	121625
7	8888	98323
8	445	97733
9	9999	87534
10	4444	86318

Suspected Bot List [2020-04-08]

detection period: 2020-04-08 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1646

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-04-07]

detection period: 2020-04-07 00:00-23:59 UTC
total number of suspected botnet IPs: 31688
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30009
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1115
2	Baidu	944
3	VNPT-VN	848
4	TENCENT-CN	664
5	VIETTEL-VN	662
6	HINET-NET	625
7	DIGITALOCEAN-7	455
8	CHINANET-JS	398
9	CHINANET-GD	390
10	KORNET	347

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7611
2	United States	3594
3	Viet Nam	2064
4	Russian Federation	2039
5	India	1083
6	Indonesia	1023
7	France	909
8	Taiwan	831
9	Thailand	690
10	South Korea	621

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	228328
2	1024	205180
3	2048	173795
4	123	154759
5	4022	83117
6	445	71879
7	4444	70980
8	7777	70967
9	22	64432
10	1250	62789