detection period: 2021-02-01 00:00-23:59 UTC
total number of suspected botnet IPs: 43792
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 40615
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | TencentCloud | 1942 |
| 2 | VNPT-VN | 1008 |
| 3 | HINET-NET | 966 |
| 4 | TENCENT-CN | 800 |
| 5 | VIETTEL-VN | 741 |
| 6 | KORNET | 661 |
| 7 | DIGITALOCEAN-192-241-128-0 | 647 |
| 8 | NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK | 581 |
| 9 | VE-CSVE-LACNIC | 563 |
| 10 | ALISOFT | 553 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | China | 9350 |
| 2 | United States | 5172 |
| 3 | India | 2708 |
| 4 | Russian Federation | 2463 |
| 5 | Viet Nam | 2449 |
| 6 | Brazil | 2002 |
| 7 | Indonesia | 1360 |
| 8 | Taiwan | 1330 |
| 9 | Hong Kong | 1095 |
| 10 | South Korea | 1050 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 1221 | 756426 |
| 2 | 445 | 317412 |
| 3 | 3689 | 92014 |
| 4 | 22 | 83681 |
| 5 | 20 | 79841 |
| 6 | 1112 | 63705 |
| 7 | 2345 | 57105 |
| 8 | 1433 | 35983 |
| 9 | 23 | 31118 |
| 10 | 1324 | 28439 |
No comments:
Post a Comment