detection period: 2026-06-17 00:00-23:59 UTC
total number of suspected botnet IPs: 21723
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20610
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | MSFT | 1492 |
| 2 | AL-3 | 1450 |
| 3 | INFRAWATCH | 1113 |
| 4 | GOOGLE-CLOUD | 1090 |
| 5 | PAN-22 | 960 |
| 6 | ASEPL-SG | 522 |
| 7 | VOLCANO-ENGINE | 484 |
| 8 | FR-ONYPHE-20191111 | 446 |
| 9 | CENSY | 381 |
| 10 | cloud | 316 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9266 |
| 2 | China | 4367 |
| 3 | United Kingdom | 846 |
| 4 | Singapore | 783 |
| 5 | Netherlands | 625 |
| 6 | Germany | 551 |
| 7 | France | 485 |
| 8 | Hong Kong | 412 |
| 9 | South Korea | 376 |
| 10 | India | 357 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 150199 |
| 2 | 23 | 89925 |
| 3 | 1122 | 59024 |
| 4 | 54321 | 45443 |
| 5 | 9999 | 42221 |
| 6 | 9443 | 31161 |
| 7 | 8822 | 28306 |
| 8 | 22 | 28231 |
| 9 | 10000 | 26311 |
| 10 | 8015 | 21060 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | MSFT | 1527 |
| 2 | AL-3 | 1492 |
| 3 | GOOGLE-CLOUD | 1096 |
| 4 | INFRAWATCH | 964 |
| 5 | PAN-22 | 963 |
| 6 | ASEPL-SG | 550 |
| 7 | VOLCANO-ENGINE | 499 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 380 |
| 10 | cloud | 362 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 10427 |
| 2 | China | 4346 |
| 3 | Singapore | 928 |
| 4 | United Kingdom | 775 |
| 5 | Netherlands | 613 |
| 6 | Germany | 591 |
| 7 | France | 507 |
| 8 | Hong Kong | 489 |
| 9 | India | 411 |
| 10 | South Korea | 353 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 152697 |
| 2 | 23 | 126642 |
| 3 | 1122 | 58718 |
| 4 | 1234 | 50749 |
| 5 | 54321 | 46520 |
| 6 | 202 | 42106 |
| 7 | 22 | 34324 |
| 8 | 8822 | 28332 |
| 9 | 8728 | 26110 |
| 10 | 10000 | 25315 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1467 |
| 2 | MSFT | 1391 |
| 3 | INFRAWATCH | 1126 |
| 4 | GOOGLE-CLOUD | 1049 |
| 5 | PAN-22 | 962 |
| 6 | ASEPL-SG | 677 |
| 7 | VOLCANO-ENGINE | 481 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 382 |
| 10 | FR-ONYPHE-20221109 | 240 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8031 |
| 2 | China | 3653 |
| 3 | Singapore | 1002 |
| 4 | United Kingdom | 815 |
| 5 | Netherlands | 562 |
| 6 | Germany | 533 |
| 7 | France | 502 |
| 8 | Hong Kong | 316 |
| 9 | Indonesia | 308 |
| 10 | South Korea | 297 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 130462 |
| 2 | 2269 | 65759 |
| 3 | 202 | 54479 |
| 4 | 1122 | 51505 |
| 5 | 54321 | 38104 |
| 6 | 22025 | 35695 |
| 7 | 22 | 29688 |
| 8 | 8822 | 27665 |
| 9 | 8728 | 27140 |
| 10 | 23122 | 24674 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | MSFT | 1479 |
| 2 | AL-3 | 1468 |
| 3 | INFRAWATCH | 1083 |
| 4 | GOOGLE-CLOUD | 1038 |
| 5 | PAN-22 | 959 |
| 6 | ASEPL-SG | 560 |
| 7 | VOLCANO-ENGINE | 495 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 375 |
| 10 | cloud | 352 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8892 |
| 2 | China | 4123 |
| 3 | Singapore | 863 |
| 4 | United Kingdom | 817 |
| 5 | Netherlands | 579 |
| 6 | Germany | 547 |
| 7 | France | 492 |
| 8 | Hong Kong | 298 |
| 9 | Indonesia | 297 |
| 10 | South Korea | 237 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 164419 |
| 2 | 12975 | 108732 |
| 3 | 12661 | 76379 |
| 4 | 13405 | 65538 |
| 5 | 2269 | 63931 |
| 6 | 202 | 53074 |
| 7 | 12951 | 50430 |
| 8 | 14391 | 43214 |
| 9 | 13968 | 41703 |
| 10 | 22025 | 40725 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1443 |
| 2 | MSFT | 1432 |
| 3 | GOOGLE-CLOUD | 1051 |
| 4 | PAN-22 | 960 |
| 5 | INFRAWATCH | 868 |
| 6 | ASEPL-SG | 577 |
| 7 | VOLCANO-ENGINE | 485 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 375 |
| 10 | cloud | 306 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8377 |
| 2 | China | 4088 |
| 3 | Singapore | 901 |
| 4 | United Kingdom | 836 |
| 5 | Netherlands | 597 |
| 6 | France | 529 |
| 7 | Indonesia | 317 |
| 8 | Hong Kong | 312 |
| 9 | Germany | 303 |
| 10 | South Korea | 284 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 159577 |
| 2 | 2269 | 64363 |
| 3 | 6023 | 62971 |
| 4 | 13265 | 44055 |
| 5 | 9663 | 36786 |
| 6 | 6707 | 36465 |
| 7 | 4855 | 35755 |
| 8 | 8822 | 33319 |
| 9 | 3495 | 30284 |
| 10 | 6435 | 28385 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1448 |
| 2 | MSFT | 1427 |
| 3 | INFRAWATCH | 1063 |
| 4 | GOOGLE-CLOUD | 1047 |
| 5 | PAN-22 | 962 |
| 6 | ASEPL-SG | 566 |
| 7 | VOLCANO-ENGINE | 523 |
| 8 | FR-ONYPHE-20191111 | 447 |
| 9 | CENSY | 375 |
| 10 | cloud | 313 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8667 |
| 2 | China | 4190 |
| 3 | Singapore | 898 |
| 4 | United Kingdom | 791 |
| 5 | Germany | 619 |
| 6 | Netherlands | 609 |
| 7 | France | 528 |
| 8 | Indonesia | 412 |
| 9 | India | 402 |
| 10 | South Korea | 365 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 134871 |
| 2 | 5901 | 30442 |
| 3 | 22 | 29950 |
| 4 | 6002 | 23966 |
| 5 | 222 | 19318 |
| 6 | 2203 | 18331 |
| 7 | 13870 | 18197 |
| 8 | 2269 | 17354 |
| 9 | 2222 | 17352 |
| 10 | 888 | 16743 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1542 |
| 2 | MSFT | 1409 |
| 3 | INFRAWATCH | 1068 |
| 4 | GOOGLE-CLOUD | 1061 |
| 5 | PAN-22 | 962 |
| 6 | ASEPL-SG | 612 |
| 7 | VOLCANO-ENGINE | 497 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 381 |
| 10 | cloud | 339 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9185 |
| 2 | China | 4127 |
| 3 | Singapore | 838 |
| 4 | United Kingdom | 779 |
| 5 | Netherlands | 579 |
| 6 | Germany | 566 |
| 7 | France | 477 |
| 8 | India | 366 |
| 9 | South Korea | 347 |
| 10 | Hong Kong | 335 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 98645 |
| 2 | 5901 | 38857 |
| 3 | 9011 | 35656 |
| 4 | 22 | 28199 |
| 5 | 222 | 22048 |
| 6 | 23 | 21122 |
| 7 | 9402 | 20572 |
| 8 | 2222 | 20358 |
| 9 | 888 | 19551 |
| 10 | 8015 | 19195 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1575 |
| 2 | MSFT | 1487 |
| 3 | GOOGLE-CLOUD | 1052 |
| 4 | PAN-22 | 961 |
| 5 | INFRAWATCH | 865 |
| 6 | ASEPL-SG | 606 |
| 7 | VOLCANO-ENGINE | 499 |
| 8 | FR-ONYPHE-20191111 | 447 |
| 9 | CENSY | 374 |
| 10 | cloud | 337 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8837 |
| 2 | China | 3772 |
| 3 | Singapore | 832 |
| 4 | Germany | 620 |
| 5 | Netherlands | 560 |
| 6 | United Kingdom | 553 |
| 7 | France | 487 |
| 8 | India | 367 |
| 9 | Hong Kong | 331 |
| 10 | South Korea | 326 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 143577 |
| 2 | 2255 | 80252 |
| 3 | 4444 | 47236 |
| 4 | 6022 | 45981 |
| 5 | 5901 | 38281 |
| 6 | 22024 | 36814 |
| 7 | 30 | 31613 |
| 8 | 22 | 29419 |
| 9 | 8222 | 28735 |
| 10 | 9402 | 26308 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1637 |
| 2 | MSFT | 1438 |
| 3 | GOOGLE-CLOUD | 1051 |
| 4 | INFRAWATCH | 1022 |
| 5 | PAN-22 | 962 |
| 6 | ASEPL-SG | 533 |
| 7 | VOLCANO-ENGINE | 501 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 375 |
| 10 | cloud | 301 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9588 |
| 2 | China | 3442 |
| 3 | United Kingdom | 782 |
| 4 | Singapore | 746 |
| 5 | Germany | 640 |
| 6 | Netherlands | 620 |
| 7 | France | 497 |
| 8 | South Korea | 366 |
| 9 | India | 345 |
| 10 | Hong Kong | 340 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 201432 |
| 2 | 2255 | 87254 |
| 3 | 6022 | 60980 |
| 4 | 1111 | 53654 |
| 5 | 6000 | 37039 |
| 6 | 22024 | 36631 |
| 7 | 822 | 32430 |
| 8 | 8222 | 30678 |
| 9 | 22 | 27487 |
| 10 | 9402 | 26952 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1618 |
| 2 | MSFT | 1436 |
| 3 | INFRAWATCH | 1147 |
| 4 | GOOGLE-CLOUD | 1067 |
| 5 | PAN-22 | 961 |
| 6 | ASEPL-SG | 612 |
| 7 | VOLCANO-ENGINE | 518 |
| 8 | FR-ONYPHE-20191111 | 447 |
| 9 | CENSY | 363 |
| 10 | cloud | 346 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8843 |
| 2 | China | 3326 |
| 3 | Singapore | 846 |
| 4 | United Kingdom | 815 |
| 5 | Germany | 573 |
| 6 | Netherlands | 542 |
| 7 | France | 470 |
| 8 | Hong Kong | 306 |
| 9 | Indonesia | 289 |
| 10 | South Korea | 258 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 221610 |
| 2 | 2255 | 87184 |
| 3 | 6022 | 59477 |
| 4 | 6000 | 47377 |
| 5 | 1111 | 41975 |
| 6 | 9011 | 40740 |
| 7 | 22 | 31614 |
| 8 | 8222 | 28723 |
| 9 | 7422 | 27004 |
| 10 | 7722 | 25945 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1653 |
| 2 | MSFT | 1422 |
| 3 | GOOGLE-CLOUD | 1038 |
| 4 | PAN-22 | 961 |
| 5 | INFRAWATCH | 879 |
| 6 | ASEPL-SG | 607 |
| 7 | VOLCANO-ENGINE | 505 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 351 |
| 10 | AT-88-Z | 319 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9432 |
| 2 | China | 3383 |
| 3 | Singapore | 891 |
| 4 | United Kingdom | 875 |
| 5 | Netherlands | 604 |
| 6 | France | 483 |
| 7 | Hong Kong | 313 |
| 8 | Indonesia | 265 |
| 9 | Germany | 265 |
| 10 | South Korea | 255 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 234607 |
| 2 | 6022 | 93011 |
| 3 | 9011 | 44181 |
| 4 | 2122 | 39090 |
| 5 | 55522 | 37583 |
| 6 | 8888 | 36337 |
| 7 | 922 | 32367 |
| 8 | 22 | 31710 |
| 9 | 8222 | 28327 |
| 10 | 5001 | 27420 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1630 |
| 2 | MSFT | 1385 |
| 3 | GOOGLE-CLOUD | 1043 |
| 4 | PAN-22 | 960 |
| 5 | INFRAWATCH | 920 |
| 6 | ASEPL-SG | 699 |
| 7 | VOLCANO-ENGINE | 516 |
| 8 | FR-ONYPHE-20191111 | 447 |
| 9 | CENSY | 356 |
| 10 | AT-88-Z | 312 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8371 |
| 2 | China | 3523 |
| 3 | Singapore | 955 |
| 4 | United Kingdom | 908 |
| 5 | Netherlands | 589 |
| 6 | France | 478 |
| 7 | Hong Kong | 314 |
| 8 | Germany | 307 |
| 9 | Indonesia | 272 |
| 10 | South Korea | 245 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 206900 |
| 2 | 6022 | 125517 |
| 3 | 2122 | 53629 |
| 4 | 55522 | 42164 |
| 5 | 4321 | 38616 |
| 6 | 922 | 38303 |
| 7 | 5001 | 30075 |
| 8 | 2024 | 29142 |
| 9 | 22 | 28408 |
| 10 | 8022 | 27403 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1626 |
| 2 | MSFT | 1354 |
| 3 | GOOGLE-CLOUD | 1061 |
| 4 | PAN-22 | 964 |
| 5 | INFRAWATCH | 705 |
| 6 | ASEPL-SG | 577 |
| 7 | VOLCANO-ENGINE | 507 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 351 |
| 10 | AT-88-Z | 282 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8258 |
| 2 | China | 3294 |
| 3 | Singapore | 946 |
| 4 | United Kingdom | 680 |
| 5 | Netherlands | 589 |
| 6 | France | 483 |
| 7 | Germany | 325 |
| 8 | Hong Kong | 307 |
| 9 | Indonesia | 290 |
| 10 | South Korea | 227 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 183213 |
| 2 | 6022 | 109163 |
| 3 | 2122 | 55302 |
| 4 | 4321 | 38636 |
| 5 | 55522 | 36980 |
| 6 | 22 | 28364 |
| 7 | 12222 | 27958 |
| 8 | 2024 | 25145 |
| 9 | 5001 | 24348 |
| 10 | 8022 | 23909 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1868 |
| 2 | MSFT | 1725 |
| 3 | INFRAWATCH | 1152 |
| 4 | GOOGLE-CLOUD | 1040 |
| 5 | PAN-22 | 971 |
| 6 | ASEPL-SG | 746 |
| 7 | cloud | 544 |
| 8 | VOLCANO-ENGINE | 528 |
| 9 | FR-ONYPHE-20191111 | 447 |
| 10 | CENSY | 380 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 10331 |
| 2 | China | 3923 |
| 3 | Singapore | 1049 |
| 4 | United Kingdom | 914 |
| 5 | Germany | 648 |
| 6 | Netherlands | 630 |
| 7 | France | 484 |
| 8 | Indonesia | 359 |
| 9 | Hong Kong | 356 |
| 10 | South Korea | 285 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 175020 |
| 2 | 2265 | 74270 |
| 3 | 6022 | 50576 |
| 4 | 5922 | 37761 |
| 5 | 2023 | 25325 |
| 6 | 23 | 23781 |
| 7 | 4714 | 22727 |
| 8 | 5001 | 22448 |
| 9 | 4708 | 22161 |
| 10 | 1322 | 21484 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1869 |
| 2 | MSFT | 1495 |
| 3 | INFRAWATCH | 1169 |
| 4 | GOOGLE-CLOUD | 1060 |
| 5 | PAN-22 | 963 |
| 6 | ASEPL-SG | 667 |
| 7 | VOLCANO-ENGINE | 534 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 372 |
| 10 | cloud | 309 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8982 |
| 2 | China | 3874 |
| 3 | Singapore | 1193 |
| 4 | United Kingdom | 912 |
| 5 | Netherlands | 602 |
| 6 | Germany | 597 |
| 7 | France | 501 |
| 8 | Hong Kong | 379 |
| 9 | Indonesia | 364 |
| 10 | Brazil | 284 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 174834 |
| 2 | 2265 | 74413 |
| 3 | 2023 | 39898 |
| 4 | 5001 | 24762 |
| 5 | 6022 | 23738 |
| 6 | 8899 | 22903 |
| 7 | 4714 | 22482 |
| 8 | 4708 | 21873 |
| 9 | 7105 | 20908 |
| 10 | 7422 | 20675 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1703 |
| 2 | MSFT | 1406 |
| 3 | INFRAWATCH | 1092 |
| 4 | GOOGLE-CLOUD | 1046 |
| 5 | PAN-22 | 961 |
| 6 | ASEPL-SG | 603 |
| 7 | VOLCANO-ENGINE | 510 |
| 8 | FR-ONYPHE-20191111 | 400 |
| 9 | CENSY | 375 |
| 10 | cloud | 319 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9295 |
| 2 | China | 3719 |
| 3 | Singapore | 1014 |
| 4 | United Kingdom | 814 |
| 5 | Netherlands | 599 |
| 6 | Germany | 552 |
| 7 | France | 467 |
| 8 | Hong Kong | 334 |
| 9 | Indonesia | 288 |
| 10 | South Korea | 232 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 162450 |
| 2 | 2265 | 74268 |
| 3 | 2023 | 36396 |
| 4 | 5001 | 30224 |
| 5 | 2000 | 26118 |
| 6 | 8015 | 25356 |
| 7 | 2222 | 22467 |
| 8 | 4714 | 22401 |
| 9 | 8022 | 21781 |
| 10 | 4708 | 21573 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1795 |
| 2 | MSFT | 1393 |
| 3 | INFRAWATCH | 1178 |
| 4 | GOOGLE-CLOUD | 1050 |
| 5 | PAN-22 | 962 |
| 6 | ASEPL-SG | 656 |
| 7 | VOLCANO-ENGINE | 506 |
| 8 | FR-ONYPHE-20191111 | 400 |
| 9 | CENSY | 375 |
| 10 | CMNET | 228 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8637 |
| 2 | China | 3623 |
| 3 | Singapore | 996 |
| 4 | United Kingdom | 834 |
| 5 | Netherlands | 598 |
| 6 | Germany | 590 |
| 7 | France | 466 |
| 8 | Hong Kong | 358 |
| 9 | Indonesia | 306 |
| 10 | South Korea | 261 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 158896 |
| 2 | 2265 | 46664 |
| 3 | 2023 | 41857 |
| 4 | 5001 | 30243 |
| 5 | 7777 | 29149 |
| 6 | 8010 | 26878 |
| 7 | 23 | 24062 |
| 8 | 8015 | 23027 |
| 9 | 4714 | 22404 |
| 10 | 8022 | 22393 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1810 |
| 2 | MSFT | 1412 |
| 3 | INFRAWATCH | 1162 |
| 4 | GOOGLE-CLOUD | 1045 |
| 5 | PAN-22 | 962 |
| 6 | ASEPL-SG | 701 |
| 7 | VOLCANO-ENGINE | 505 |
| 8 | FR-ONYPHE-20191111 | 400 |
| 9 | CENSY | 377 |
| 10 | cloud | 310 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9006 |
| 2 | China | 3643 |
| 3 | Singapore | 1061 |
| 4 | United Kingdom | 940 |
| 5 | Netherlands | 641 |
| 6 | Germany | 634 |
| 7 | France | 486 |
| 8 | Hong Kong | 376 |
| 9 | Indonesia | 299 |
| 10 | South Korea | 256 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 140809 |
| 2 | 4122 | 41589 |
| 3 | 2023 | 38686 |
| 4 | 2211 | 34595 |
| 5 | 8999 | 33538 |
| 6 | 8010 | 32303 |
| 7 | 7777 | 27193 |
| 8 | 5001 | 26801 |
| 9 | 23 | 24526 |
| 10 | 8015 | 24095 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1841 |
| 2 | MSFT | 1435 |
| 3 | GOOGLE-CLOUD | 1062 |
| 4 | PAN-22 | 961 |
| 5 | INFRAWATCH | 720 |
| 6 | ASEPL-SG | 717 |
| 7 | VOLCANO-ENGINE | 509 |
| 8 | FR-ONYPHE-20191111 | 400 |
| 9 | CENSY | 371 |
| 10 | cloud | 296 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9599 |
| 2 | China | 3799 |
| 3 | Singapore | 1091 |
| 4 | United Kingdom | 660 |
| 5 | Netherlands | 638 |
| 6 | France | 480 |
| 7 | Germany | 392 |
| 8 | Hong Kong | 369 |
| 9 | Indonesia | 320 |
| 10 | South Korea | 266 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 237800 |
| 2 | 2211 | 42385 |
| 3 | 4122 | 38191 |
| 4 | 8999 | 35428 |
| 5 | 8010 | 35346 |
| 6 | 1722 | 32980 |
| 7 | 7777 | 30440 |
| 8 | 8001 | 29488 |
| 9 | 8015 | 29427 |
| 10 | 5001 | 27858 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1735 |
| 2 | MSFT | 1428 |
| 3 | GOOGLE-CLOUD | 1051 |
| 4 | PAN-22 | 966 |
| 5 | ASEPL-SG | 636 |
| 6 | VOLCANO-ENGINE | 506 |
| 7 | FR-ONYPHE-20191111 | 407 |
| 8 | CENSY | 375 |
| 9 | cloud | 302 |
| 10 | CMNET | 244 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8889 |
| 2 | China | 3801 |
| 3 | Singapore | 1023 |
| 4 | France | 479 |
| 5 | Hong Kong | 368 |
| 6 | Germany | 340 |
| 7 | Netherlands | 323 |
| 8 | Indonesia | 293 |
| 9 | South Korea | 286 |
| 10 | Viet Nam | 240 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 251056 |
| 2 | 9999 | 42802 |
| 3 | 2211 | 41367 |
| 4 | 8010 | 38113 |
| 5 | 8999 | 37991 |
| 6 | 8001 | 33328 |
| 7 | 1722 | 32473 |
| 8 | 7102 | 29321 |
| 9 | 8007 | 29163 |
| 10 | 4714 | 28711 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1623 |
| 2 | MSFT | 1450 |
| 3 | GOOGLE-CLOUD | 1050 |
| 4 | PAN-22 | 960 |
| 5 | ASEPL-SG | 611 |
| 6 | VOLCANO-ENGINE | 485 |
| 7 | FR-ONYPHE-20191111 | 448 |
| 8 | CENSY | 378 |
| 9 | cloud | 302 |
| 10 | CMNET | 243 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9406 |
| 2 | China | 3529 |
| 3 | Singapore | 1013 |
| 4 | France | 475 |
| 5 | Hong Kong | 372 |
| 6 | Netherlands | 357 |
| 7 | Indonesia | 332 |
| 8 | Germany | 319 |
| 9 | United Kingdom | 287 |
| 10 | South Korea | 280 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 284039 |
| 2 | 22 | 38857 |
| 3 | 2021 | 37951 |
| 4 | 8999 | 37602 |
| 5 | 8001 | 37458 |
| 6 | 8010 | 35949 |
| 7 | 2211 | 35024 |
| 8 | 7022 | 32795 |
| 9 | 8015 | 30048 |
| 10 | 4714 | 29463 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1777 |
| 2 | MSFT | 1438 |
| 3 | GOOGLE-CLOUD | 1050 |
| 4 | PAN-22 | 960 |
| 5 | ASEPL-SG | 618 |
| 6 | INFRAWATCH | 568 |
| 7 | VOLCANO-ENGINE | 495 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 378 |
| 10 | cloud | 306 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9045 |
| 2 | China | 3750 |
| 3 | Singapore | 978 |
| 4 | Netherlands | 613 |
| 5 | Germany | 590 |
| 6 | France | 489 |
| 7 | Hong Kong | 357 |
| 8 | Indonesia | 333 |
| 9 | Brazil | 318 |
| 10 | United Kingdom | 284 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 349840 |
| 2 | 2021 | 67295 |
| 3 | 2211 | 48795 |
| 4 | 22021 | 31604 |
| 5 | 4714 | 30318 |
| 6 | 23 | 26905 |
| 7 | 5005 | 26714 |
| 8 | 1122 | 26150 |
| 9 | 1722 | 24936 |
| 10 | 22 | 23273 |