detection period: 2026-07-08 00:00-23:59 UTC
total number of suspected botnet IPs: 21151
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20135
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | MSFT | 1426 |
| 2 | AL-3 | 1408 |
| 3 | GOOGLE-CLOUD | 1081 |
| 4 | INFRAWATCH | 1049 |
| 5 | PAN-22 | 959 |
| 6 | ASEPL-SG | 563 |
| 7 | VOLCANO-ENGINE | 511 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 375 |
| 10 | cloud | 285 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8639 |
| 2 | China | 3819 |
| 3 | United Kingdom | 1081 |
| 4 | Germany | 918 |
| 5 | Singapore | 823 |
| 6 | Netherlands | 605 |
| 7 | France | 465 |
| 8 | India | 365 |
| 9 | Indonesia | 356 |
| 10 | South Korea | 303 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 125382 |
| 2 | 8522 | 40731 |
| 3 | 9022 | 39822 |
| 4 | 1022 | 38945 |
| 5 | 422 | 37915 |
| 6 | 622 | 37821 |
| 7 | 6522 | 36408 |
| 8 | 1522 | 35988 |
| 9 | 922 | 35769 |
| 10 | 822 | 35611 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1522 |
| 2 | MSFT | 1364 |
| 3 | GOOGLE-CLOUD | 1064 |
| 4 | PAN-22 | 961 |
| 5 | INFRAWATCH | 858 |
| 6 | ASEPL-SG | 548 |
| 7 | VOLCANO-ENGINE | 463 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 381 |
| 10 | DE-ALPHA | 372 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8803 |
| 2 | China | 3625 |
| 3 | United Kingdom | 1107 |
| 4 | Singapore | 777 |
| 5 | Germany | 761 |
| 6 | Netherlands | 563 |
| 7 | France | 492 |
| 8 | Hong Kong | 295 |
| 9 | Indonesia | 265 |
| 10 | India | 254 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 139753 |
| 2 | 2222 | 39736 |
| 3 | 22 | 32992 |
| 4 | 422 | 31711 |
| 5 | 922 | 30515 |
| 6 | 6522 | 29887 |
| 7 | 8522 | 28399 |
| 8 | 1922 | 27800 |
| 9 | 1022 | 26968 |
| 10 | 1122 | 26542 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1494 |
| 2 | MSFT | 1418 |
| 3 | INFRAWATCH | 1112 |
| 4 | GOOGLE-CLOUD | 1074 |
| 5 | PAN-22 | 965 |
| 6 | ASEPL-SG | 537 |
| 7 | VOLCANO-ENGINE | 459 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 371 |
| 10 | DE-ALPHA | 363 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8547 |
| 2 | China | 3790 |
| 3 | United Kingdom | 1142 |
| 4 | Germany | 990 |
| 5 | Singapore | 788 |
| 6 | Netherlands | 544 |
| 7 | France | 468 |
| 8 | Hong Kong | 285 |
| 9 | Indonesia | 278 |
| 10 | India | 237 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 59051 |
| 2 | 22 | 38301 |
| 3 | 1433 | 31366 |
| 4 | 2122 | 27636 |
| 5 | 33222 | 19656 |
| 6 | 6001 | 16676 |
| 7 | 23 | 14625 |
| 8 | 5902 | 13386 |
| 9 | 10000 | 13150 |
| 10 | 30011 | 11361 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1446 |
| 2 | MSFT | 1394 |
| 3 | GOOGLE-CLOUD | 1047 |
| 4 | PAN-22 | 962 |
| 5 | INFRAWATCH | 806 |
| 6 | ASEPL-SG | 559 |
| 7 | VOLCANO-ENGINE | 464 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | cloud | 323 |
| 10 | DE-ALPHA | 322 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9080 |
| 2 | China | 4103 |
| 3 | Germany | 889 |
| 4 | Singapore | 807 |
| 5 | United Kingdom | 711 |
| 6 | Netherlands | 535 |
| 7 | France | 470 |
| 8 | South Korea | 316 |
| 9 | India | 305 |
| 10 | Hong Kong | 304 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 66244 |
| 2 | 8015 | 53588 |
| 3 | 22 | 53003 |
| 4 | 888 | 37213 |
| 5 | 2078 | 37029 |
| 6 | 2222 | 34335 |
| 7 | 1433 | 33030 |
| 8 | 2122 | 32299 |
| 9 | 9011 | 29873 |
| 10 | 8082 | 29182 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1408 |
| 2 | MSFT | 1367 |
| 3 | INFRAWATCH | 1133 |
| 4 | GOOGLE-CLOUD | 1055 |
| 5 | PAN-22 | 963 |
| 6 | ASEPL-SG | 571 |
| 7 | VOLCANO-ENGINE | 473 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | cloud | 325 |
| 10 | DE-ALPHA | 322 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8241 |
| 2 | China | 4042 |
| 3 | United Kingdom | 1097 |
| 4 | Germany | 948 |
| 5 | Singapore | 830 |
| 6 | Netherlands | 557 |
| 7 | France | 478 |
| 8 | India | 352 |
| 9 | South Korea | 316 |
| 10 | Hong Kong | 308 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 6371 | 117601 |
| 2 | 5900 | 71036 |
| 3 | 5640 | 62819 |
| 4 | 6911 | 61271 |
| 5 | 7348 | 59257 |
| 6 | 9294 | 55041 |
| 7 | 2684 | 54438 |
| 8 | 8015 | 54177 |
| 9 | 14177 | 51657 |
| 10 | 11382 | 48021 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1540 |
| 2 | MSFT | 1417 |
| 3 | INFRAWATCH | 1116 |
| 4 | GOOGLE-CLOUD | 1079 |
| 5 | PAN-22 | 965 |
| 6 | ASEPL-SG | 510 |
| 7 | VOLCANO-ENGINE | 466 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 373 |
| 10 | cloud | 293 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9255 |
| 2 | China | 3924 |
| 3 | United Kingdom | 1113 |
| 4 | Germany | 815 |
| 5 | Singapore | 770 |
| 6 | Netherlands | 568 |
| 7 | France | 476 |
| 8 | Hong Kong | 341 |
| 9 | South Korea | 312 |
| 10 | India | 300 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 6879 | 133373 |
| 2 | 9665 | 96327 |
| 3 | 4771 | 69795 |
| 4 | 4683 | 69551 |
| 5 | 5900 | 65386 |
| 6 | 888 | 65376 |
| 7 | 8015 | 57532 |
| 8 | 12007 | 50323 |
| 9 | 2078 | 48866 |
| 10 | 13490 | 42977 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1435 |
| 2 | MSFT | 1379 |
| 3 | INFRAWATCH | 1075 |
| 4 | GOOGLE-CLOUD | 1064 |
| 5 | PAN-22 | 964 |
| 6 | ASEPL-SG | 551 |
| 7 | VOLCANO-ENGINE | 470 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 379 |
| 10 | UNICOM | 359 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9045 |
| 2 | China | 7734 |
| 3 | United Kingdom | 849 |
| 4 | Singapore | 808 |
| 5 | Germany | 786 |
| 6 | Netherlands | 572 |
| 7 | France | 492 |
| 8 | South Korea | 331 |
| 9 | Hong Kong | 328 |
| 10 | India | 312 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 2282 | 84318 |
| 2 | 888 | 74481 |
| 3 | 5900 | 60973 |
| 4 | 8015 | 60432 |
| 5 | 2078 | 53679 |
| 6 | 9901 | 49198 |
| 7 | 2122 | 47310 |
| 8 | 2222 | 44780 |
| 9 | 8088 | 40596 |
| 10 | 7777 | 33791 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1438 |
| 2 | MSFT | 1423 |
| 3 | INFRAWATCH | 1075 |
| 4 | GOOGLE-CLOUD | 1044 |
| 5 | PAN-22 | 961 |
| 6 | ASEPL-SG | 575 |
| 7 | VOLCANO-ENGINE | 475 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 382 |
| 10 | DE-ALPHA | 278 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8460 |
| 2 | China | 3980 |
| 3 | United Kingdom | 994 |
| 4 | Germany | 867 |
| 5 | Singapore | 803 |
| 6 | France | 561 |
| 7 | Netherlands | 554 |
| 8 | India | 358 |
| 9 | South Korea | 349 |
| 10 | Hong Kong | 337 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 2282 | 84415 |
| 2 | 888 | 74806 |
| 3 | 9443 | 60425 |
| 4 | 2122 | 51959 |
| 5 | 5900 | 50633 |
| 6 | 8015 | 50594 |
| 7 | 2078 | 49555 |
| 8 | 8088 | 45554 |
| 9 | 2222 | 44750 |
| 10 | 25 | 34357 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1436 |
| 2 | MSFT | 1399 |
| 3 | INFRAWATCH | 1137 |
| 4 | GOOGLE-CLOUD | 1045 |
| 5 | PAN-22 | 960 |
| 6 | ASEPL-SG | 574 |
| 7 | VOLCANO-ENGINE | 479 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 378 |
| 10 | DE-ALPHA | 323 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8933 |
| 2 | China | 3915 |
| 3 | United Kingdom | 1075 |
| 4 | Germany | 965 |
| 5 | Singapore | 813 |
| 6 | Netherlands | 581 |
| 7 | France | 563 |
| 8 | South Korea | 365 |
| 9 | India | 362 |
| 10 | Hong Kong | 336 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 2282 | 65544 |
| 2 | 888 | 63247 |
| 3 | 9443 | 51779 |
| 4 | 3306 | 48689 |
| 5 | 5900 | 48407 |
| 6 | 2122 | 43054 |
| 7 | 8015 | 42059 |
| 8 | 8088 | 41619 |
| 9 | 2078 | 31909 |
| 10 | 2222 | 31282 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1436 |
| 2 | MSFT | 1429 |
| 3 | GOOGLE-CLOUD | 1066 |
| 4 | PAN-22 | 962 |
| 5 | INFRAWATCH | 840 |
| 6 | ASEPL-SG | 559 |
| 7 | VOLCANO-ENGINE | 489 |
| 8 | FR-ONYPHE-20191111 | 400 |
| 9 | CENSY | 378 |
| 10 | DE-ALPHA | 345 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8736 |
| 2 | China | 3947 |
| 3 | Singapore | 831 |
| 4 | United Kingdom | 741 |
| 5 | Germany | 629 |
| 6 | France | 602 |
| 7 | Netherlands | 574 |
| 8 | India | 375 |
| 9 | Hong Kong | 340 |
| 10 | Indonesia | 337 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 51248 |
| 2 | 4464 | 37941 |
| 3 | 12409 | 28770 |
| 4 | 9443 | 24264 |
| 5 | 3306 | 23752 |
| 6 | 7194 | 22506 |
| 7 | 888 | 20608 |
| 8 | 8712 | 20517 |
| 9 | 23 | 19756 |
| 10 | 8015 | 19539 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1455 |
| 2 | MSFT | 1433 |
| 3 | GOOGLE-CLOUD | 1048 |
| 4 | PAN-22 | 963 |
| 5 | INFRAWATCH | 779 |
| 6 | ASEPL-SG | 592 |
| 7 | VOLCANO-ENGINE | 454 |
| 8 | FR-ONYPHE-20191111 | 400 |
| 9 | CENSY | 377 |
| 10 | DE-ALPHA | 320 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8961 |
| 2 | China | 3797 |
| 3 | Singapore | 785 |
| 4 | Germany | 632 |
| 5 | United Kingdom | 622 |
| 6 | Netherlands | 574 |
| 7 | France | 554 |
| 8 | Hong Kong | 313 |
| 9 | South Korea | 296 |
| 10 | India | 277 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 14069 | 91356 |
| 2 | 4179 | 80079 |
| 3 | 5357 | 75610 |
| 4 | 7777 | 75211 |
| 5 | 5900 | 72396 |
| 6 | 3306 | 65641 |
| 7 | 13593 | 58091 |
| 8 | 9443 | 51496 |
| 9 | 8088 | 47721 |
| 10 | 2095 | 46742 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1419 |
| 2 | MSFT | 1400 |
| 3 | GOOGLE-CLOUD | 1049 |
| 4 | PAN-22 | 958 |
| 5 | INFRAWATCH | 868 |
| 6 | ASEPL-SG | 592 |
| 7 | VOLCANO-ENGINE | 452 |
| 8 | FR-ONYPHE-20191111 | 411 |
| 9 | CENSY | 378 |
| 10 | cloud | 339 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8036 |
| 2 | China | 3829 |
| 3 | Singapore | 768 |
| 4 | United Kingdom | 636 |
| 5 | Germany | 607 |
| 6 | Netherlands | 572 |
| 7 | France | 511 |
| 8 | South Korea | 327 |
| 9 | Hong Kong | 307 |
| 10 | India | 281 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 2272 | 117114 |
| 2 | 7777 | 114462 |
| 3 | 5900 | 92461 |
| 4 | 5357 | 66704 |
| 5 | 1122 | 56442 |
| 6 | 2095 | 53989 |
| 7 | 3306 | 53801 |
| 8 | 9443 | 50604 |
| 9 | 8015 | 48316 |
| 10 | 58603 | 47563 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | MSFT | 1391 |
| 2 | AL-3 | 1366 |
| 3 | INFRAWATCH | 1063 |
| 4 | GOOGLE-CLOUD | 1039 |
| 5 | PAN-22 | 962 |
| 6 | ASEPL-SG | 546 |
| 7 | VOLCANO-ENGINE | 457 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 375 |
| 10 | DE-ALPHA | 341 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8322 |
| 2 | China | 3779 |
| 3 | Germany | 804 |
| 4 | United Kingdom | 755 |
| 5 | Singapore | 748 |
| 6 | Netherlands | 526 |
| 7 | France | 497 |
| 8 | South Korea | 331 |
| 9 | Hong Kong | 325 |
| 10 | India | 299 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 7777 | 128151 |
| 2 | 2272 | 104552 |
| 3 | 5900 | 102871 |
| 4 | 2095 | 83713 |
| 5 | 8082 | 81573 |
| 6 | 5357 | 74107 |
| 7 | 8015 | 72875 |
| 8 | 9443 | 69773 |
| 9 | 8085 | 64968 |
| 10 | 1122 | 64886 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1454 |
| 2 | MSFT | 1384 |
| 3 | GOOGLE-CLOUD | 1044 |
| 4 | INFRAWATCH | 1034 |
| 5 | PAN-22 | 964 |
| 6 | ASEPL-SG | 522 |
| 7 | VOLCANO-ENGINE | 467 |
| 8 | FR-ONYPHE-20191111 | 447 |
| 9 | CENSY | 378 |
| 10 | DE-ALPHA | 332 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8602 |
| 2 | China | 3920 |
| 3 | Germany | 795 |
| 4 | United Kingdom | 758 |
| 5 | Singapore | 711 |
| 6 | Netherlands | 564 |
| 7 | France | 480 |
| 8 | South Korea | 356 |
| 9 | India | 328 |
| 10 | Hong Kong | 309 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 7777 | 99033 |
| 2 | 5900 | 90155 |
| 3 | 1122 | 62022 |
| 4 | 8082 | 59665 |
| 5 | 2095 | 56383 |
| 6 | 5357 | 54497 |
| 7 | 9443 | 52349 |
| 8 | 8015 | 52218 |
| 9 | 9022 | 47100 |
| 10 | 8085 | 43389 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1421 |
| 2 | MSFT | 1416 |
| 3 | GOOGLE-CLOUD | 1065 |
| 4 | PAN-22 | 960 |
| 5 | INFRAWATCH | 925 |
| 6 | ASEPL-SG | 551 |
| 7 | VOLCANO-ENGINE | 467 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 384 |
| 10 | cloud | 307 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8353 |
| 2 | China | 3869 |
| 3 | Singapore | 798 |
| 4 | Germany | 741 |
| 5 | United Kingdom | 609 |
| 6 | Netherlands | 552 |
| 7 | France | 504 |
| 8 | South Korea | 365 |
| 9 | India | 351 |
| 10 | Hong Kong | 322 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 83029 |
| 2 | 7777 | 73793 |
| 3 | 1122 | 59518 |
| 4 | 9022 | 49357 |
| 5 | 2000 | 47578 |
| 6 | 8082 | 47297 |
| 7 | 5357 | 42620 |
| 8 | 9443 | 39687 |
| 9 | 2222 | 34618 |
| 10 | 8015 | 34582 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1402 |
| 2 | MSFT | 1400 |
| 3 | GOOGLE-CLOUD | 1054 |
| 4 | PAN-22 | 962 |
| 5 | INFRAWATCH | 914 |
| 6 | ASEPL-SG | 541 |
| 7 | VOLCANO-ENGINE | 460 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 377 |
| 10 | CMNET | 287 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8622 |
| 2 | China | 3871 |
| 3 | Singapore | 773 |
| 4 | United Kingdom | 620 |
| 5 | Netherlands | 588 |
| 6 | Germany | 545 |
| 7 | France | 492 |
| 8 | India | 348 |
| 9 | South Korea | 329 |
| 10 | Hong Kong | 298 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 2271 | 110876 |
| 2 | 5900 | 104585 |
| 3 | 1122 | 61547 |
| 4 | 9022 | 44642 |
| 5 | 7777 | 43423 |
| 6 | 8082 | 35227 |
| 7 | 8807 | 30786 |
| 8 | 8825 | 29441 |
| 9 | 8015 | 28337 |
| 10 | 5357 | 27850 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1433 |
| 2 | MSFT | 1411 |
| 3 | INFRAWATCH | 1079 |
| 4 | GOOGLE-CLOUD | 1070 |
| 5 | PAN-22 | 959 |
| 6 | ASEPL-SG | 564 |
| 7 | VOLCANO-ENGINE | 464 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 381 |
| 10 | cloud | 310 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8142 |
| 2 | China | 3807 |
| 3 | Singapore | 816 |
| 4 | United Kingdom | 738 |
| 5 | Netherlands | 584 |
| 6 | Germany | 505 |
| 7 | France | 489 |
| 8 | South Korea | 348 |
| 9 | India | 328 |
| 10 | Hong Kong | 303 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 134822 |
| 2 | 2271 | 90948 |
| 3 | 1122 | 56538 |
| 4 | 9022 | 42276 |
| 5 | 8807 | 29895 |
| 6 | 8825 | 29208 |
| 7 | 8888 | 28339 |
| 8 | 22 | 28216 |
| 9 | 8812 | 26317 |
| 10 | 5901 | 24110 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1448 |
| 2 | MSFT | 1421 |
| 3 | GOOGLE-CLOUD | 1050 |
| 4 | PAN-22 | 961 |
| 5 | INFRAWATCH | 833 |
| 6 | ASEPL-SG | 536 |
| 7 | VOLCANO-ENGINE | 464 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 381 |
| 10 | cloud | 284 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8799 |
| 2 | China | 3853 |
| 3 | Singapore | 840 |
| 4 | United Kingdom | 816 |
| 5 | Netherlands | 598 |
| 6 | France | 485 |
| 7 | Hong Kong | 325 |
| 8 | South Korea | 320 |
| 9 | India | 295 |
| 10 | Indonesia | 251 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 146520 |
| 2 | 1122 | 61176 |
| 3 | 9443 | 57381 |
| 4 | 8015 | 51003 |
| 5 | 8082 | 50468 |
| 6 | 5357 | 46367 |
| 7 | 9022 | 46020 |
| 8 | 2095 | 41051 |
| 9 | 2000 | 40767 |
| 10 | 8085 | 38776 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1542 |
| 2 | MSFT | 1412 |
| 3 | INFRAWATCH | 1054 |
| 4 | GOOGLE-CLOUD | 1046 |
| 5 | PAN-22 | 959 |
| 6 | ASEPL-SG | 547 |
| 7 | VOLCANO-ENGINE | 466 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 382 |
| 10 | cloud | 311 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8216 |
| 2 | China | 3915 |
| 3 | Singapore | 809 |
| 4 | United Kingdom | 739 |
| 5 | Netherlands | 586 |
| 6 | Germany | 495 |
| 7 | France | 476 |
| 8 | Hong Kong | 320 |
| 9 | India | 306 |
| 10 | South Korea | 290 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 156924 |
| 2 | 1122 | 60377 |
| 3 | 9443 | 56968 |
| 4 | 8082 | 48390 |
| 5 | 54321 | 44269 |
| 6 | 8015 | 42805 |
| 7 | 5357 | 42044 |
| 8 | 7777 | 41110 |
| 9 | 9011 | 39450 |
| 10 | 8085 | 39300 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1505 |
| 2 | MSFT | 1412 |
| 3 | GOOGLE-CLOUD | 1071 |
| 4 | INFRAWATCH | 1034 |
| 5 | PAN-22 | 960 |
| 6 | ASEPL-SG | 651 |
| 7 | VOLCANO-ENGINE | 473 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 380 |
| 10 | cloud | 335 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 8342 |
| 2 | China | 3923 |
| 3 | Singapore | 901 |
| 4 | United Kingdom | 726 |
| 5 | Germany | 658 |
| 6 | Netherlands | 584 |
| 7 | France | 471 |
| 8 | South Korea | 327 |
| 9 | India | 323 |
| 10 | Hong Kong | 312 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 159405 |
| 2 | 1122 | 60632 |
| 3 | 23 | 50374 |
| 4 | 9443 | 46875 |
| 5 | 54321 | 44757 |
| 6 | 8822 | 41718 |
| 7 | 8082 | 40112 |
| 8 | 8015 | 37124 |
| 9 | 5901 | 34529 |
| 10 | 5357 | 33549 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | AL-3 | 1454 |
| 2 | MSFT | 1426 |
| 3 | GOOGLE-CLOUD | 1057 |
| 4 | PAN-22 | 961 |
| 5 | INFRAWATCH | 945 |
| 6 | ASEPL-SG | 572 |
| 7 | VOLCANO-ENGINE | 481 |
| 8 | FR-ONYPHE-20191111 | 447 |
| 9 | CENSY | 379 |
| 10 | cloud | 311 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9091 |
| 2 | China | 4008 |
| 3 | Singapore | 869 |
| 4 | United Kingdom | 705 |
| 5 | Netherlands | 592 |
| 6 | Germany | 589 |
| 7 | France | 480 |
| 8 | India | 342 |
| 9 | Hong Kong | 316 |
| 10 | South Korea | 314 |
| Rank | TCP port number | # of connection attempts received |
|---|---|---|
| 1 | 5900 | 128572 |
| 2 | 23 | 80692 |
| 3 | 1122 | 58216 |
| 4 | 54321 | 43085 |
| 5 | 9443 | 36325 |
| 6 | 8822 | 34399 |
| 7 | 5901 | 33363 |
| 8 | 8082 | 28957 |
| 9 | 10000 | 28817 |
| 10 | 22 | 28428 |
| Rank | Network | # of suspected botnet IPs |
|---|---|---|
| 1 | MSFT | 1492 |
| 2 | AL-3 | 1450 |
| 3 | INFRAWATCH | 1113 |
| 4 | GOOGLE-CLOUD | 1090 |
| 5 | PAN-22 | 960 |
| 6 | ASEPL-SG | 522 |
| 7 | VOLCANO-ENGINE | 484 |
| 8 | FR-ONYPHE-20191111 | 446 |
| 9 | CENSY | 381 |
| 10 | cloud | 316 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|---|---|
| 1 | United States | 9266 |
| 2 | China | 4367 |
| 3 | United Kingdom | 846 |
| 4 | Singapore | 783 |
| 5 | Netherlands | 625 |
| 6 | Germany | 551 |
| 7 | France | 485 |
| 8 | Hong Kong | 412 |
| 9 | South Korea | 376 |
| 10 | India | 357 |