Botnet Statistics [2020-05-30]

detection period: 2020-05-30 00:00-23:59 UTC
total number of suspected botnet IPs: 28801
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 27480
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1164
2	Baidu	863
3	VNPT-VN	706
4	TENCENT-CN	662
5	HINET-NET	553
6	DIGITALOCEAN-162-243-0-0	539
7	VIETTEL-VN	446
8	CHINANET-GD	381
9	ALISOFT	378
10	CHINANET-JS	354

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7955
2	United States	3146
3	Viet Nam	1654
4	Russian Federation	1571
5	India	1315
6	Brazil	1287
7	France	831
8	Indonesia	788
9	Taiwan	712
10	South Korea	558

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	789	1487147
2	2001	269251
3	122	208504
4	666	207519
5	1212	201989
6	7023	194048
7	2121	175317
8	3131	165603
9	3022	115837
10	445	95493

Suspected Bot List [2020-05-30]

detection period: 2020-05-30 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1321

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-29]

detection period: 2020-05-29 00:00-23:59 UTC
total number of suspected botnet IPs: 30433
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 28974
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1175
2	VNPT-VN	978
3	Baidu	876
4	TENCENT-CN	679
5	HINET-NET	615
6	VIETTEL-VN	601
7	DIGITALOCEAN-162-243-0-0	536
8	CHINANET-GD	400
9	VE-CSVE-LACNIC	396
10	ALISOFT	391

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7822
2	United States	3121
3	Viet Nam	2181
4	Russian Federation	1706
5	Brazil	1463
6	India	1421
7	Indonesia	969
8	France	841
9	Taiwan	794
10	Thailand	630

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1212	639186
2	666	629540
3	122	616123
4	2121	505714
5	3131	484361
6	2001	245868
7	6969	212724
8	445	141252
9	3022	135590
10	2022	103322

Suspected Bot List [2020-05-29]

detection period: 2020-05-29 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1459

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-28]

detection period: 2020-05-28 00:00-23:59 UTC
total number of suspected botnet IPs: 30443
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29017
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1200
2	VNPT-VN	1007
3	Baidu	896
4	TENCENT-CN	689
5	HINET-NET	629
6	VIETTEL-VN	618
7	DIGITALOCEAN-162-243-0-0	551
8	CHINANET-GD	418
9	ALISOFT	391
10	CHINANET-JS	360

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7917
2	United States	3285
3	Viet Nam	2202
4	Russian Federation	1788
5	Brazil	1458
6	India	1274
7	Indonesia	897
8	France	843
9	Taiwan	775
10	Thailand	653

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	666	399706
2	122	396106
3	1212	390558
4	2121	327020
5	3131	308127
6	3022	142897
7	6969	132915
8	768	131209
9	110	103191
10	2022	72439

Suspected Bot List [2020-05-28]

detection period: 2020-05-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1426

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-27]

detection period: 2020-05-27 00:00-23:59 UTC
total number of suspected botnet IPs: 30722
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29324
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1214
2	VNPT-VN	1011
3	Baidu	896
4	TENCENT-CN	707
5	VIETTEL-VN	660
6	HINET-NET	657
7	DIGITALOCEAN-162-243-0-0	555
8	ALISOFT	418
9	CMNET	404
10	CHINANET-GD	384

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7895
2	United States	3275
3	Viet Nam	2289
4	Russian Federation	1766
5	Brazil	1434
6	India	1259
7	Indonesia	991
8	France	860
9	Taiwan	803
10	Thailand	642

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	666	529984
2	122	491907
3	1212	474152
4	2121	422205
5	3131	385915
6	768	276167
7	1100	172468
8	6969	167238
9	2026	150951
10	3022	144114

Suspected Bot List [2020-05-27]

detection period: 2020-05-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1398

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-26]

detection period: 2020-05-26 00:00-23:59 UTC
total number of suspected botnet IPs: 30109
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 28718
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1219
2	VNPT-VN	963
3	Baidu	889
4	TENCENT-CN	699
5	VIETTEL-VN	643
6	HINET-NET	600
7	CHINANET-GD	415
8	CMNET	409
9	VE-CSVE-LACNIC	400
10	DIGITALOCEAN-162-243-0-0	385

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7844
2	United States	3015
3	Viet Nam	2164
4	Russian Federation	1875
5	Brazil	1418
6	India	1230
7	France	876
8	Indonesia	835
9	Taiwan	757
10	Thailand	659

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1100	1235151
2	2029	989783
3	2028	966058
4	2026	958949
5	2027	954537
6	6666	428794
7	6161	406346
8	6060	378009
9	768	277117
10	3022	144401

Suspected Bot List [2020-05-26]

detection period: 2020-05-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1391

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-25]

detection period: 2020-05-25 00:00-23:59 UTC
total number of suspected botnet IPs: 30473
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29133
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1253
2	VNPT-VN	966
3	Baidu	915
4	TENCENT-CN	726
5	HINET-NET	625
6	VIETTEL-VN	602
7	DIGITALOCEAN-162-243-0-0	540
8	CMNET	431
9	CHINANET-GD	411
10	ALISOFT	400

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8151
2	United States	3307
3	Viet Nam	2231
4	Russian Federation	1781
5	Brazil	1431
6	India	1112
7	France	885
8	Taiwan	791
9	Thailand	654
10	Indonesia	646

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	768	267834
2	2026	123876
3	322	120398
4	1100	104392
5	445	104378
6	2027	100851
7	1803	92831
8	2028	84752
9	333	65746
10	2029	65458

Suspected Bot List [2020-05-25]

detection period: 2020-05-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1340

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-24]

detection period: 2020-05-24 00:00-23:59 UTC
total number of suspected botnet IPs: 29668
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 28349
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1275
2	Baidu	947
3	TENCENT-CN	751
4	HINET-NET	683
5	DIGITALOCEAN-162-243-0-0	559
6	VNPT-VN	541
7	ALISOFT	493
8	CMNET	449
9	CHINANET-GD	428
10	KORNET	420

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8290
2	United States	3428
3	Russian Federation	1600
4	Viet Nam	1500
5	Brazil	1342
6	India	961
7	France	932
8	Taiwan	876
9	South Korea	683
10	Indonesia	621

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1100	1622164
2	2026	1297393
3	2029	1288189
4	2027	1238355
5	2028	1220914
6	6666	559989
7	6161	551354
8	6060	510789
9	768	277408
10	333	150110

Suspected Bot List [2020-05-24]

detection period: 2020-05-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1319

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-23]

detection period: 2020-05-23 00:00-23:59 UTC
total number of suspected botnet IPs: 28547
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 27187
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1114
2	Baidu	867
3	HINET-NET	733
4	VNPT-VN	719
5	TENCENT-CN	656
6	DIGITALOCEAN-162-243-0-0	560
7	KORNET	538
8	VIETTEL-VN	462
9	CHINANET-GD	401
10	CMNET	381

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7405
2	United States	2998
3	Viet Nam	1737
4	Russian Federation	1511
5	Brazil	1240
6	India	1139
7	Taiwan	933
8	France	837
9	South Korea	825
10	Indonesia	673

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1280	578045
2	5038	550590
3	768	278468
4	777	180128
5	333	150334
6	2000	111867
7	445	110980
8	2236	92011
9	322	77739
10	2218	71728

Suspected Bot List [2020-05-23]

detection period: 2020-05-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1360

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-22]

detection period: 2020-05-22 00:00-23:59 UTC
total number of suspected botnet IPs: 30650
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29143
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1141
2	VNPT-VN	1003
3	Baidu	881
4	TENCENT-CN	682
5	HINET-NET	672
6	VIETTEL-VN	610
7	DIGITALOCEAN-162-243-0-0	581
8	CMNET	399
9	VE-CSVE-LACNIC	382
10	CHINANET-GD	381

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7669
2	United States	3122
3	Viet Nam	2336
4	Russian Federation	1864
5	India	1292
6	Taiwan	865
7	France	857
8	Indonesia	834
9	Thailand	670
10	South Korea	570

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	536047
2	1280	253259
3	777	230739
4	445	158791
5	333	150801
6	2000	107744
7	2219	93900
8	1024	92855
9	2216	79904
10	3382	65760

Suspected Bot List [2020-05-22]

detection period: 2020-05-22 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1507

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-21]

detection period: 2020-05-21 00:00-23:59 UTC
total number of suspected botnet IPs: 31201
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29654
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1169
2	VNPT-VN	1057
3	Baidu	899
4	VIETTEL-VN	720
5	TENCENT-CN	680
6	HINET-NET	665
7	DIGITALOCEAN-162-243-0-0	569
8	CMNET	438
9	ALISOFT	410
10	CHINANET-GD	390

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7924
2	United States	3274
3	Viet Nam	2498
4	Russian Federation	1856
5	India	1304
6	Taiwan	860
7	France	843
8	Indonesia	783
9	Thailand	765
10	South Korea	506

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	521741
2	1110	356500
3	1113	318028
4	1112	310890
5	622	298205
6	1111	292543
7	2022	263060
8	62	256860
9	2021	250942
10	2023	244825

Suspected Bot List [2020-05-21]

detection period: 2020-05-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1547

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-20]

detection period: 2020-05-20 00:00-23:59 UTC
total number of suspected botnet IPs: 32189
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30531
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1175
2	VNPT-VN	1055
3	Baidu	890
4	HINET-NET	772
5	VIETTEL-VN	728
6	TENCENT-CN	697
7	DIGITALOCEAN-162-243-0-0	585
8	ALISOFT	475
9	CMNET	462
10	KORNET	402

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8056
2	United States	3356
3	Viet Nam	2470
4	Russian Federation	1863
5	India	1242
6	Indonesia	992
7	Taiwan	975
8	France	866
9	Thailand	745
10	South Korea	648

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	5038	578270
2	1024	341131
3	622	295234
4	62	271882
5	1113	260076
6	1112	244855
7	1111	241807
8	2024	237196
9	1110	232880
10	2023	197053

Suspected Bot List [2020-05-20]

detection period: 2020-05-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1658

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-19]

detection period: 2020-05-19 00:00-23:59 UTC
total number of suspected botnet IPs: 32520
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30910
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1175
2	VNPT-VN	970
3	Baidu	940
4	HINET-NET	878
5	TENCENT-CN	707
6	VIETTEL-VN	678
7	DIGITALOCEAN-162-243-0-0	589
8	ALISOFT	463
9	CMNET	451
10	CHINANET-GD	410

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8491
2	United States	3454
3	Viet Nam	2255
4	Russian Federation	1871
5	India	1314
6	Taiwan	1102
7	Indonesia	989
8	France	920
9	Thailand	660
10	South Korea	546

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	622	397387
2	1110	375940
3	62	374342
4	1112	364452
5	1113	362247
6	1111	357015
7	1024	344211
8	2022	333038
9	2025	316249
10	2024	298148

Suspected Bot List [2020-05-19]

detection period: 2020-05-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1610

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-18]

detection period: 2020-05-18 00:00-23:59 UTC
total number of suspected botnet IPs: 33960
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 32292
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1483
2	TencentCloud	1235
3	VNPT-VN	1083
4	Baidu	958
5	VIETTEL-VN	732
6	TENCENT-CN	729
7	DIGITALOCEAN-162-243-0-0	591
8	CMNET	464
9	TELKOMNET	413
10	CHINANET-GD	409

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8308
2	United States	3599
3	Viet Nam	2445
4	Russian Federation	1843
5	Taiwan	1751
6	India	1278
7	Indonesia	1147
8	France	925
9	Thailand	760
10	South Korea	615

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1111	313379
2	1113	294440
3	1110	289047
4	62	280961
5	1112	273197
6	622	259395
7	2021	255902
8	2023	233515
9	2024	226733
10	2022	218021

Suspected Bot List [2020-05-18]

detection period: 2020-05-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1668

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-17]

detection period: 2020-05-17 00:00-23:59 UTC
total number of suspected botnet IPs: 32243
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30768
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1701
2	TencentCloud	1265
3	Baidu	968
4	TENCENT-CN	732
5	VNPT-VN	637
6	DIGITALOCEAN-162-243-0-0	600
7	VIETTEL-VN	533
8	KORNET	504
9	CMNET	435
10	ALISOFT	424

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8265
2	United States	3742
3	Taiwan	2032
4	Russian Federation	1751
5	Viet Nam	1628
6	India	982
7	France	925
8	Indonesia	818
9	South Korea	742
10	Thailand	499

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2000	115326
2	445	94908
3	3382	67731
4	3005	64299
5	22	55933
6	1110	49731
7	1113	45629
8	2021	43684
9	2024	42511
10	1111	41966

Suspected Bot List [2020-05-17]

detection period: 2020-05-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1475

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-16]

detection period: 2020-05-16 00:00-23:59 UTC
total number of suspected botnet IPs: 31380
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29886
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1459
2	TencentCloud	1121
3	Baidu	886
4	VNPT-VN	793
5	TENCENT-CN	649
6	VIETTEL-VN	619
7	DIGITALOCEAN-162-243-0-0	606
8	KORNET	452
9	MSFT	409
10	CHINANET-GD	404

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7553
2	United States	3959
3	Viet Nam	1941
4	Taiwan	1761
5	Russian Federation	1629
6	India	1137
7	France	866
8	Indonesia	853
9	South Korea	716
10	Thailand	475

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	622	411743
2	1111	397400
3	1110	365328
4	62	360846
5	1113	357291
6	1112	350261
7	2022	340607
8	2024	329072
9	2025	315816
10	2023	288488

Suspected Bot List [2020-05-16]

detection period: 2020-05-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1494

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-15]

detection period: 2020-05-15 00:00-23:59 UTC
total number of suspected botnet IPs: 33063
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31455
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1457
2	TencentCloud	1129
3	VNPT-VN	1025
4	Baidu	904
5	VIETTEL-VN	745
6	TENCENT-CN	661
7	DIGITALOCEAN-162-243-0-0	605
8	KORNET	452
9	ALISOFT	447
10	CHINANET-JS	378

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7678
2	United States	3696
3	Viet Nam	2398
4	Russian Federation	1730
5	Taiwan	1725
6	India	1238
7	Indonesia	1073
8	France	876
9	South Korea	694
10	Thailand	664

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	62	375829
2	1110	351984
3	1113	329050
4	1112	328302
5	1111	309195
6	622	288765
7	2024	247849
8	2022	237571
9	2021	231770
10	2025	220337

Suspected Bot List [2020-05-15]

detection period: 2020-05-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1505

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-14]

detection period: 2020-05-14 00:00-23:59 UTC
total number of suspected botnet IPs: 33063
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31455
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1417
2	TencentCloud	1143
3	VNPT-VN	982
4	Baidu	917
5	VIETTEL-VN	773
6	TENCENT-CN	686
7	DIGITALOCEAN-162-243-0-0	586
8	KORNET	420
9	ALISOFT	420
10	CHINANET-GD	391

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7777
2	United States	3501
3	Viet Nam	2381
4	Russian Federation	1808
5	Taiwan	1718
6	India	1276
7	Indonesia	1059
8	France	893
9	Thailand	746
10	South Korea	652

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	115	171086
2	114	153526
3	102	152224
4	107	150294
5	445	149748
6	104	148908
7	101	143667
8	100	142450
9	109	140304
10	112	137432

Suspected Bot List [2020-05-14]

detection period: 2020-05-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1608

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-13]

detection period: 2020-05-13 00:00-23:59 UTC
total number of suspected botnet IPs: 34430
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 32787
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1553
2	TencentCloud	1181
3	VNPT-VN	1117
4	Baidu	938
5	VIETTEL-VN	823
6	TENCENT-CN	703
7	DIGITALOCEAN-162-243-0-0	617
8	KORNET	426
9	ALISOFT	425
10	CHINANET-GD	409

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8087
2	United States	3588
3	Viet Nam	2614
4	Russian Federation	1872
5	Taiwan	1862
6	India	1299
7	Indonesia	1131
8	France	940
9	Thailand	721
10	South Korea	696

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2012	199670
2	106	194637
3	2018	180538
4	100	171086
5	2019	171061
6	2016	170257
7	107	165630
8	101	164127
9	105	163938
10	114	162479

Suspected Bot List [2020-05-13]

detection period: 2020-05-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1643

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-12]

detection period: 2020-05-12 00:00-23:59 UTC
total number of suspected botnet IPs: 35397
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 33717
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1685
2	TencentCloud	1172
3	VNPT-VN	1127
4	Baidu	955
5	VIETTEL-VN	789
6	TENCENT-CN	713
7	DIGITALOCEAN-162-243-0-0	616
8	CHINANET-AH	551
9	ALISOFT	454
10	TELKOMNET	438

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8549
2	United States	3678
3	Viet Nam	2636
4	Taiwan	1993
5	Russian Federation	1906
6	India	1456
7	Indonesia	1240
8	France	919
9	Thailand	781
10	Brazil	633

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	2013	214048
2	2015	211503
3	102	205494
4	2017	200793
5	103	182748
6	101	172119
7	2016	165936
8	104	164084
9	114	159854
10	1024	159658

Suspected Bot List [2020-05-12]

detection period: 2020-05-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1680

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-11]

detection period: 2020-05-11 00:00-23:59 UTC
total number of suspected botnet IPs: 34372
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 32788
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1243
2	HINET-NET	1159
3	VNPT-VN	1137
4	Baidu	971
5	VIETTEL-VN	761
6	TENCENT-CN	742
7	DIGITALOCEAN-162-243-0-0	630
8	ALISOFT	488
9	TELKOMNET	418
10	CHINANET-JS	417

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8396
2	United States	3848
3	Viet Nam	2583
4	Russian Federation	1733
5	India	1507
6	Taiwan	1406
7	Indonesia	1237
8	France	940
9	Brazil	693
10	Thailand	533

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	114	237107
2	105	205969
3	115	199527
4	100	198509
5	107	193773
6	101	189676
7	106	184654
8	108	175349
9	123	173361
10	109	170075

Suspected Bot List [2020-05-11]

detection period: 2020-05-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1584

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-10]

detection period: 2020-05-10 00:00-23:59 UTC
total number of suspected botnet IPs: 32533
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30971
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1253
2	HINET-NET	1105
3	Baidu	1000
4	TENCENT-CN	768
5	VNPT-VN	691
6	DIGITALOCEAN-162-243-0-0	632
7	VIETTEL-VN	555
8	ALISOFT	507
9	CMNET	416
10	CHINANET-GD	408

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8504
2	United States	4045
3	Viet Nam	1784
4	Russian Federation	1756
5	Taiwan	1363
6	India	1017
7	France	957
8	Indonesia	866
9	South Korea	562
10	Thailand	483

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	114	279608
2	108	266245
3	113	218514
4	112	214175
5	109	203723
6	115	201602
7	2016	173416
8	2013	170211
9	1024	169179
10	123	167051

Suspected Bot List [2020-05-10]

detection period: 2020-05-10 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1562

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-09]

detection period: 2020-05-09 00:00-23:59 UTC
total number of suspected botnet IPs: 30400
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 28885
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1098
2	Baidu	788
3	VNPT-VN	761
4	HINET-NET	724
5	TENCENT-CN	657
6	DIGITALOCEAN-162-243-0-0	652
7	VIETTEL-VN	540
8	CHINANET-JS	401
9	CHINANET-GD	369
10	ALISOFT	354

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7653
2	United States	3555
3	Viet Nam	1909
4	Russian Federation	1737
5	India	1117
6	Taiwan	917
7	Indonesia	911
8	France	887
9	Thailand	503
10	South Korea	496

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1024	164656
2	123	163101
3	1038	109312
4	1036	108350
5	1040	106674
6	1039	106415
7	1042	101746
8	1037	100879
9	1041	100415
10	4022	98562

Suspected Bot List [2020-05-09]

detection period: 2020-05-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1515

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-05-08]

detection period: 2020-05-08 00:00-23:59 UTC
total number of suspected botnet IPs: 32629
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31035
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1090
2	VNPT-VN	993
3	Baidu	788
4	TENCENT-CN	665
5	DIGITALOCEAN-162-243-0-0	654
6	HINET-NET	579
7	VIETTEL-VN	530
8	CHINANET-JS	410
9	CHINANET-GD	391
10	VE-CSVE-LACNIC	376

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7773
2	United States	3573
3	Viet Nam	2175
4	Russian Federation	2007
5	India	1252
6	Indonesia	901
7	France	890
8	Brazil	782
9	Taiwan	747
10	Thailand	662

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1024	162408
2	123	161115
3	1031	106612
4	1035	104919
5	1033	104192
6	1034	101986
7	1032	101688
8	4022	90465
9	445	84354
10	22027	73115