Botnet Statistics [2020-06-29]

detection period: 2020-06-29 00:00-23:59 UTC
total number of suspected botnet IPs: 33657
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31482
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1448
2	VNPT-VN	1092
3	Baidu	1046
4	TENCENT-CN	776
5	HINET-NET	618
6	DIGITALOCEAN-192-241-128-0	587
7	VIETTEL-VN	569
8	ALISOFT	461
9	CHINANET-GD	373
10	CMNET	354

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8622
2	United States	3915
3	Viet Nam	2228
4	Brazil	1785
5	Russian Federation	1469
6	India	1416
7	Indonesia	957
8	France	951
9	Taiwan	789
10	Thailand	766

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	178256
2	3838	91743
3	2727	91215
4	2828	90825
5	3939	85301
6	2207	70144
7	22	52270
8	23	45661
9	1433	44224
10	2283	41289

Suspected Bot List [2020-06-29]

detection period: 2020-06-29 00:00-23:59 UTC
number of suspected bots' IPs listed here: 2175

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-28]

detection period: 2020-06-28 00:00-23:59 UTC
total number of suspected botnet IPs: 26215
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 24961
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1315
2	Baidu	939
3	TENCENT-CN	693
4	DIGITALOCEAN-192-241-128-0	581
5	VNPT-VN	524
6	HINET-NET	496
7	ALISOFT	382
8	CHINANET-JS	347
9	VIETTEL-VN	346
10	CHINANET-GD	335

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7718
2	United States	3304
3	Viet Nam	1261
4	Russian Federation	1253
5	Brazil	1168
6	India	912
7	France	836
8	Taiwan	666
9	Indonesia	613
10	South Korea	467

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	152725
2	3737	87609
3	3636	84090
4	1919	79322
5	2207	69510
6	3434	66294
7	1818	64459
8	2280	55276
9	2424	54461
10	1433	53335

Suspected Bot List [2020-06-28]

detection period: 2020-06-28 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1254

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-27]

detection period: 2020-06-27 00:00-23:59 UTC
total number of suspected botnet IPs: 29178
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 27851
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1326
2	Baidu	946
3	VNPT-VN	735
4	TENCENT-CN	690
5	HINET-NET	669
6	DIGITALOCEAN-192-241-128-0	602
7	VIETTEL-VN	410
8	ALISOFT	378
9	CHINANET-JS	347
10	CHINANET-GD	335

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7942
2	United States	3756
3	Viet Nam	1633
4	Brazil	1498
5	India	1437
6	Russian Federation	1271
7	France	854
8	Taiwan	826
9	Indonesia	689
10	Thailand	568

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	195021
2	1717	93877
3	3232	86708
4	1616	81943
5	1433	73157
6	2207	72358
7	23	54762
8	22	48098
9	22007	43828
10	2424	34713

Suspected Bot List [2020-06-27]

detection period: 2020-06-27 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1327

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-26]

detection period: 2020-06-26 00:00-23:59 UTC
total number of suspected botnet IPs: 28929
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 27524
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1296
2	Baidu	957
3	VNPT-VN	955
4	TENCENT-CN	698
5	VIETTEL-VN	516
6	HINET-NET	442
7	DIGITALOCEAN-192-241-128-0	411
8	ALISOFT	392
9	VE-CSVE-LACNIC	373
10	CHINANET-GD	336

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7734
2	United States	3744
3	Viet Nam	2000
4	Brazil	1434
5	Russian Federation	1316
6	India	1270
7	Indonesia	856
8	France	844
9	Taiwan	595
10	Thailand	504

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	258856
2	2207	165205
3	1414	111992
4	9902	96881
5	1515	91404
6	22	54928
7	1433	54687
8	110	50188
9	8484	35417
10	9422	35312

Suspected Bot List [2020-06-26]

detection period: 2020-06-26 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1405

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-25]

detection period: 2020-06-25 00:00-23:59 UTC
total number of suspected botnet IPs: 29818
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 28431
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1310
2	VNPT-VN	976
3	Baidu	955
4	TENCENT-CN	709
5	VIETTEL-VN	526
6	HINET-NET	426
7	DIGITALOCEAN-192-241-128-0	412
8	ALISOFT	381
9	MSFT	338
10	TELKOMNET	313

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7670
2	United States	3945
3	Viet Nam	2087
4	Brazil	1504
5	India	1453
6	Russian Federation	1347
7	Indonesia	892
8	France	850
9	Thailand	599
10	Taiwan	566

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	209087
2	1313	95211
3	2207	58244
4	22	56990
5	1433	56939
6	7122	51108
7	2736	49025
8	1994	48469
9	2259	48458
10	4924	46046

Suspected Bot List [2020-06-25]

detection period: 2020-06-25 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1387

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-24]

detection period: 2020-06-24 00:00-23:59 UTC
total number of suspected botnet IPs: 30293
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 28875
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1351
2	VNPT-VN	964
3	Baidu	949
4	DIGITALOCEAN-192-241-128-0	787
5	TENCENT-CN	716
6	VIETTEL-VN	561
7	CHINANET-JS	439
8	ALISOFT	411
9	HINET-NET	393
10	CHINANET-GD	337

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8141
2	United States	4056
3	Viet Nam	2142
4	Brazil	1508
5	India	1387
6	Russian Federation	1226
7	Indonesia	894
8	France	869
9	Thailand	596
10	Taiwan	544

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	463582
2	654	112004
3	22	57485
4	1433	52921
5	23	45267
6	6565	33978
7	1234	33863
8	6322	32547
9	6822	32309
10	5922	31577

Suspected Bot List [2020-06-24]

detection period: 2020-06-24 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1418

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-23]

detection period: 2020-06-23 00:00-23:59 UTC
total number of suspected botnet IPs: 31659
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30196
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1310
2	VNPT-VN	980
3	Baidu	971
4	TENCENT-CN	715
5	DIGITALOCEAN-192-241-128-0	699
6	VIETTEL-VN	505
7	CHINANET-JS	471
8	ALISOFT	467
9	HINET-NET	460
10	CMNET	372

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8470
2	United States	4013
3	Viet Nam	2089
4	Brazil	1598
5	India	1596
6	Russian Federation	1438
7	Indonesia	911
8	France	866
9	Thailand	681
10	Taiwan	599

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1900	497323
2	445	245606
3	7007	200555
4	7006	200158
5	7009	200093
6	7014	198550
7	7012	195178
8	7003	194797
9	7008	194514
10	7004	193572

Suspected Bot List [2020-06-23]

detection period: 2020-06-23 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1463

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-22]

detection period: 2020-06-22 00:00-23:59 UTC
total number of suspected botnet IPs: 31890
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30409
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1391
2	VNPT-VN	1207
3	Baidu	1018
4	TENCENT-CN	747
5	VIETTEL-VN	566
6	HINET-NET	517
7	CHINANET-JS	447
8	DIGITALOCEAN-162-243-0-0	430
9	ALISOFT	417
10	CHINANET-GD	384

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8350
2	United States	3773
3	Viet Nam	2408
4	Russian Federation	1636
5	India	1456
6	Brazil	1421
7	Indonesia	1015
8	France	892
9	Taiwan	658
10	Thailand	606

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	340084
2	999	112096
3	22	55844
4	1433	50175
5	666	36096
6	2525	35714
7	2232	35344
8	4949	33671
9	23	33087
10	3389	32684

Suspected Bot List [2020-06-22]

detection period: 2020-06-22 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1481

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-21]

detection period: 2020-06-21 00:00-23:59 UTC
total number of suspected botnet IPs: 29279
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 27941
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1372
2	Baidu	1043
3	TENCENT-CN	763
4	VNPT-VN	690
5	CHINANET-JS	473
6	HINET-NET	457
7	ALISOFT	454
8	DIGITALOCEAN-162-243-0-0	451
9	VIETTEL-VN	386
10	CHINANET-GD	374

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8417
2	United States	3547
3	Viet Nam	1620
4	Russian Federation	1561
5	Brazil	1275
6	India	1026
7	France	915
8	Indonesia	685
9	Taiwan	600
10	South Korea	469

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	135945
2	888	96891
3	444	55483
4	22	51828
5	666	41406
6	62	35748
7	1433	35728
8	522	35424
9	322	33810
10	23	33775

Suspected Bot List [2020-06-21]

detection period: 2020-06-21 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1338

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-20]

detection period: 2020-06-20 00:00-23:59 UTC
total number of suspected botnet IPs: 28359
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 26970
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1184
2	Baidu	933
3	VNPT-VN	888
4	TENCENT-CN	633
5	HINET-NET	500
6	CHINANET-JS	492
7	VIETTEL-VN	475
8	DIGITALOCEAN-162-243-0-0	451
9	VE-CSVE-LACNIC	374
10	ALISOFT	367

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7687
2	United States	3007
3	Viet Nam	1983
4	India	1457
5	Russian Federation	1442
6	Brazil	1229
7	France	821
8	Indonesia	793
9	Taiwan	634
10	South Korea	480

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	230873
2	777	71870
3	444	59047
4	22	50837
5	666	47304
6	23	47174
7	3389	37880
8	8484	35192
9	9292	34356
10	333	33332

Suspected Bot List [2020-06-20]

detection period: 2020-06-20 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1389

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-19]

detection period: 2020-06-19 00:00-23:59 UTC
total number of suspected botnet IPs: 30700
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29174
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1237
2	VNPT-VN	1234
3	Baidu	924
4	TENCENT-CN	653
5	VIETTEL-VN	592
6	HINET-NET	518
7	CHINANET-JS	488
8	DIGITALOCEAN-162-243-0-0	454
9	ALISOFT	408
10	CHINANET-GD	357

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7928
2	United States	3080
3	Viet Nam	2499
4	Russian Federation	1659
5	India	1579
6	Brazil	1404
7	Indonesia	950
8	France	856
9	Taiwan	655
10	Thailand	579

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	260491
2	555	104974
3	333	82008
4	23	71490
5	22	51563
6	1433	41952
7	5858	33832
8	777	33808
9	7474	33741
10	3389	32479

Suspected Bot List [2020-06-19]

detection period: 2020-06-19 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1526

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-18]

detection period: 2020-06-18 00:00-23:59 UTC
total number of suspected botnet IPs: 32746
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30987
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1274
2	VNPT-VN	1163
3	Baidu	941
4	TENCENT-CN	677
5	VIETTEL-VN	595
6	HINET-NET	485
7	ALISOFT	467
8	DIGITALOCEAN-162-243-0-0	461
9	CHINANET-AH	432
10	VE-CSVE-LACNIC	422

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8381
2	United States	3363
3	Viet Nam	2433
4	Russian Federation	1763
5	India	1597
6	Brazil	1466
7	Indonesia	1130
8	France	888
9	Egypt	807
10	Taiwan	639

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	622	223986
2	1004	199504
3	2024	193737
4	2021	193544
5	1777	191729
6	1920	179783
7	2022	179473
8	1933	178062
9	445	176550
10	1900	174378

Suspected Bot List [2020-06-18]

detection period: 2020-06-18 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1759

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-17]

detection period: 2020-06-17 00:00-23:59 UTC
total number of suspected botnet IPs: 32347
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30611
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1292
2	VNPT-VN	1077
3	Baidu	931
4	TENCENT-CN	684
5	VIETTEL-VN	599
6	HINET-NET	508
7	CHINANET-JS	496
8	ALISOFT	479
9	DIGITALOCEAN-162-243-0-0	450
10	CHINANET-AH	412

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8431
2	United States	3393
3	Viet Nam	2366
4	Russian Federation	1653
5	India	1612
6	Brazil	1447
7	Indonesia	1045
8	France	923
9	Taiwan	683
10	Egypt	618

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	1004	311595
2	3131	309095
3	622	298949
4	2021	250153
5	1922	245305
6	2022	240388
7	1920	239475
8	2020	238215
9	1900	231785
10	1933	229419

Suspected Bot List [2020-06-17]

detection period: 2020-06-17 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1736

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-16]

detection period: 2020-06-16 00:00-23:59 UTC
total number of suspected botnet IPs: 33095
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31356
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1307
2	VNPT-VN	1020
3	Baidu	907
4	TENCENT-CN	688
5	VIETTEL-VN	632
6	HINET-NET	559
7	ALISOFT	532
8	CHINANET-JS	473
9	DIGITALOCEAN-162-243-0-0	463
10	CHINANET-GD	393

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8232
2	United States	3744
3	Viet Nam	2330
4	Russian Federation	1683
5	India	1564
6	Brazil	1521
7	Indonesia	1123
8	France	898
9	Taiwan	710
10	Thailand	640

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	622	338584
2	1004	330164
3	1933	275523
4	2021	274607
5	1777	273408
6	2022	269691
7	1922	267541
8	1900	262576
9	2020	261506
10	1920	251942

Suspected Bot List [2020-06-16]

detection period: 2020-06-16 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1739

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-15]

detection period: 2020-06-15 00:00-23:59 UTC
total number of suspected botnet IPs: 33610
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31919
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1305
2	VNPT-VN	1009
3	Baidu	941
4	TENCENT-CN	709
5	VIETTEL-VN	644
6	HINET-NET	572
7	ALISOFT	523
8	DIGITALOCEAN-162-243-0-0	473
9	CHINANET-JS	459
10	VE-CSVE-LACNIC	384

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8257
2	United States	3780
3	Viet Nam	2307
4	Russian Federation	1764
5	India	1602
6	Brazil	1549
7	Indonesia	1137
8	France	900
9	Taiwan	726
10	Thailand	678

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	81	479235
2	1004	326888
3	622	324627
4	2021	269814
5	2024	262631
6	3131	258805
7	1920	258289
8	1922	250777
9	3031	248138
10	2022	242801

Suspected Bot List [2020-06-15]

detection period: 2020-06-15 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1691

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-14]

detection period: 2020-06-14 00:00-23:59 UTC
total number of suspected botnet IPs: 29658
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 28232
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1292
2	Baidu	969
3	TENCENT-CN	707
4	VNPT-VN	603
5	HINET-NET	592
6	DIGITALOCEAN-162-243-0-0	472
7	CHINANET-JS	457
8	ALISOFT	446
9	VIETTEL-VN	401
10	CHINANET-GD	356

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8071
2	United States	3381
3	Russian Federation	1553
4	Viet Nam	1531
5	Brazil	1326
6	India	1096
7	France	848
8	Taiwan	788
9	Indonesia	783
10	South Korea	536

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	81	466370
2	445	74583
3	23	65353
4	22	49614
5	1433	34916
6	3389	28105
7	7070	26420
8	5900	23138
9	6022	22968
10	2292	22124

Suspected Bot List [2020-06-14]

detection period: 2020-06-14 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1426

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-13]

detection period: 2020-06-13 00:00-23:59 UTC
total number of suspected botnet IPs: 28523
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 27161
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1193
2	Baidu	917
3	HINET-NET	694
4	VNPT-VN	667
5	TENCENT-CN	640
6	VIETTEL-VN	480
7	DIGITALOCEAN-162-243-0-0	475
8	CHINANET-JS	462
9	ALISOFT	398
10	VE-CSVE-LACNIC	395

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7647
2	United States	2931
3	Viet Nam	1731
4	Russian Federation	1456
5	India	1354
6	Brazil	1276
7	Taiwan	900
8	Indonesia	818
9	France	778
10	South Korea	500

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	442	767349
2	445	235182
3	3332	69918
4	1111	67261
5	22	49025
6	23	44683
7	3389	41206
8	5552	38528
9	6060	38244
10	4442	37641

Suspected Bot List [2020-06-13]

detection period: 2020-06-13 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1362

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-12]

detection period: 2020-06-12 00:00-23:59 UTC
total number of suspected botnet IPs: 30621
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29158
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1213
2	VNPT-VN	992
3	Baidu	933
4	HINET-NET	752
5	TENCENT-CN	655
6	VIETTEL-VN	582
7	DIGITALOCEAN-162-243-0-0	478
8	CHINANET-JS	461
9	CHINANET-GD	391
10	ALISOFT	357

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7690
2	United States	3292
3	Viet Nam	2271
4	India	1525
5	Russian Federation	1512
6	Brazil	1432
7	Indonesia	1030
8	Taiwan	962
9	France	795
10	Thailand	603

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	442	472072
2	445	256738
3	901	116735
4	902	116302
5	804	115318
6	808	115177
7	900	115102
8	903	114308
9	803	111783
10	800	111640

Suspected Bot List [2020-06-12]

detection period: 2020-06-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1463

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-11]

detection period: 2020-06-11 00:00-23:59 UTC
total number of suspected botnet IPs: 31455
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29969
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1201
2	VNPT-VN	1048
3	Baidu	943
4	HINET-NET	679
5	TENCENT-CN	660
6	VIETTEL-VN	646
7	DIGITALOCEAN-162-243-0-0	474
8	CHINANET-JS	443
9	CHINANET-GD	418
10	ALISOFT	376

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8201
2	United States	3136
3	Viet Nam	2384
4	Russian Federation	1631
5	India	1574
6	Brazil	1314
7	Indonesia	1100
8	Taiwan	879
9	France	822
10	Thailand	644

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	125998
2	22	51451
3	1433	48252
4	23	41419
5	9009	40191
6	6022	36529
7	3389	36432
8	203	28156
9	2282	23485
10	2992	22612

Suspected Bot List [2020-06-11]

detection period: 2020-06-11 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1486

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-10]

detection period: 2020-06-10 00:00-23:59 UTC
total number of suspected botnet IPs: 32985
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31403
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1217
2	VNPT-VN	1029
3	Baidu	968
4	HINET-NET	681
5	TENCENT-CN	673
6	VIETTEL-VN	615
7	DIGITALOCEAN-162-243-0-0	490
8	CHINANET-JS	488
9	ALISOFT	473
10	CHINANET-GD	421

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8973
2	United States	3386
3	Viet Nam	2298
4	Russian Federation	1755
5	India	1601
6	Brazil	1578
7	Indonesia	1073
8	Taiwan	839
9	France	807
10	Thailand	662

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	89587
2	22	59756
3	23	44700
4	9008	42260
5	1433	37485
6	9004	37391
7	6022	37037
8	2222	35300
9	9021	33328
10	3389	30155

Suspected Bot List [2020-06-10]

detection period: 2020-06-10 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1582

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-09]

detection period: 2020-06-09 00:00-23:59 UTC
total number of suspected botnet IPs: 32560
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 30967
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1242
2	VNPT-VN	1080
3	Baidu	924
4	HINET-NET	793
5	TENCENT-CN	681
6	VIETTEL-VN	642
7	DIGITALOCEAN-162-243-0-0	490
8	VE-CSVE-LACNIC	386
9	CHINANET-GD	374
10	ALISOFT	358

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8538
2	United States	3171
3	Viet Nam	2406
4	Russian Federation	1688
5	India	1577
6	Brazil	1486
7	Indonesia	1036
8	Taiwan	966
9	France	878
10	Thailand	666

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	126905
2	701	116522
3	603	116359
4	702	116352
5	606	115961
6	604	115910
7	601	114325
8	605	107749
9	602	105453
10	1433	58986

Suspected Bot List [2020-06-09]

detection period: 2020-06-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1593

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-08]

detection period: 2020-06-08 00:00-23:59 UTC
total number of suspected botnet IPs: 31513
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29952
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1266
2	VNPT-VN	1015
3	Baidu	942
4	HINET-NET	848
5	TENCENT-CN	721
6	VIETTEL-VN	609
7	DIGITALOCEAN-162-243-0-0	500
8	CHINANET-GD	400
9	ALISOFT	370
10	VE-CSVE-LACNIC	336

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	7845
2	United States	3116
3	Viet Nam	2310
4	Russian Federation	1722
5	India	1532
6	Brazil	1487
7	Taiwan	1073
8	Indonesia	1036
9	France	866
10	Thailand	652

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	110	228705
2	445	135145
3	600	113541
4	700	111588
5	1234	101215
6	22	57041
7	1433	56425
8	3389	48434
9	8021	39799
10	9023	37820

Suspected Bot List [2020-06-08]

detection period: 2020-06-08 00:00-23:59 UTC
number of suspected bots' IPs listed here: 1561

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country

List from greylisting:

country code	IP address	Country

List from SSH probes:

country code	IP address	Country

List from TCP port scans:

Botnet Statistics [2020-06-07]

detection period: 2020-06-07 00:00-23:59 UTC
total number of suspected botnet IPs: 30036
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 28648
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	TencentCloud	1284
2	Baidu	962
3	HINET-NET	833
4	TENCENT-CN	730
5	VNPT-VN	649
6	DIGITALOCEAN-162-243-0-0	500
7	CHINANET-JS	445
8	ALISOFT	424
9	VIETTEL-VN	392
10	CHINANET-GD	392

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8627
2	United States	3201
3	Viet Nam	1548
4	Russian Federation	1538
5	Brazil	1299
6	Taiwan	1056
7	India	1005
8	France	901
9	Indonesia	745
10	South Korea	497

The top 10 TCP ports, ordered by number of connection attempts received are:

Rank	TCP port number	# of connection attempts received
1	445	176070
2	3200	88445
3	22	62334
4	1433	30457
5	3389	30274
6	23	29799
7	2122	26447
8	8023	24271
9	6022	23032
10	50020	19595