Custom Search

Monday, December 1, 2014

Botnet Statistics for November 2014

detection period: 2014-11-01 00:00 - 2014-11-30 23:59 UTC
total number of suspected botnet IPs: 24724
number of blocked spams: 2466035
recipient count of blocked spams: 79787888

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1Taiwan16837
2China3589
3United States821
4Viet Nam401
5India344
6Russian Federation244
7South Korea197
8United Kingdom133
9Indonesia122
10Turkey111
11Brazil95
12Argentina85
13Arab Emirates82
14Ukraine75
15Chile75
16Hong Kong65
17Colombia62
18Poland61
19Saudi Arabia58
20South Africa57
21Spain57
22Iran56
23Italy51
24Mexico50
25Peru48

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

RankCountry# of blocked spams
1Taiwan1734456
2China175983
3United States159998
4Russian Federation49604
5Indonesia44679
6Brazil28073
7Hong Kong27074
8Iran26839
9Viet Nam24672
10Poland19723
11Saudi Arabia17487
12Bangladesh13286
13United Kingdom12204
14Ivory Coast9526
15South Korea9063
16India8754
17Malaysia8341
18Ukraine8017
19South Africa7731
20Iraq7394
21Turkey7172
22Germany6282
23Canada6126
24Lebanon4549
25Australia3713

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Suspected Bot List [2014-11-30]

detection period: 2014-11-30 00:00-23:59 UTC
number of suspected bots' IPs listed here: 31

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
BD203.76.147.70Bangladesh
CM195.24.217.58Cameroon
GB176.35.77.154United Kingdom
IN59.90.91.95India
IN59.176.110.228India
IN210.212.119.74India
IR82.99.220.219Iran
IR194.33.124.42Iran
IR212.33.199.152Iran
IT37.186.201.149Italy
IT95.227.105.203Italy
LB62.84.79.242Lebanon
PH58.69.100.234Philippines
RU193.107.19.105Russian Federation
TR88.247.164.136Turkey
US18.239.0.140United States
US18.243.0.30United States
US50.201.42.106United States
US68.188.75.219United States
US69.197.128.170United States
US75.134.10.103United States
US174.139.8.82United States
US204.152.209.156United States
VE190.202.116.101Venezuela
VE200.84.152.112Venezuela

List from greylisting:

Botnet Statistics [2014-11-30]

detection period: 2014-11-30 00:00-23:59 UTC
total number of suspected botnet IPs: 1326
number of botnet IPs notified to network operators: 1295
number of spam blocked: 94726
recipient count of spam blocked: 3228605

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1HINET-NET720
2CHINANET-GD136
3BROADRIVER70
4UNICOM-HA20
5UNICOM-SD16
6CHINANET-ZJ9
7CHINANET-AH8
8UNICOM-SC7
9UNICOM-HL7
10UNICOM-GD6

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1Taiwan725
2China305
3United States113
4Russian Federation22
5Indonesia18
6Iran14
7Brazil12
8Hong Kong10
9Viet Nam9
10Poland8