Custom Search

Tuesday, August 1, 2017

Botnet Statistics for July 2017

detection period: 2017-07-01 00:00 - 2017-07-31 23:59 UTC
total number of suspected botnet IPs: 14247
number of blocked spams: 1837281
recipient count of blocked spams: 47254349

The top 25 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry# of suspected botnet IPs
1China9585
2United States1892
3Viet Nam410
4Russian Federation352
5Netherlands279
6Hong Kong220
7Poland175
8Taiwan153
9United Kingdom127
10India123
11Ukraine105
12Germany82
13Brazil62
14Italy58
15Bulgaria48
16South Korea36
17Luxembourg26
18France26
19Iran25
20Thailand22
21Turkey21
22Japan21
23Indonesia20
24Pakistan19
25Romania18

The top 25 countries (as defined by the 2-character country code), ordered by number of blocked spams are:

RankCountry# of blocked spams
1China613754
2United States269711
3South Korea224198
4Russian Federation140136
5Brazil119112
6Hong Kong60609
7India54742
8Poland52136
9South Africa45935
10Azerbaijan43274
11Venezuela26953
12Saint Kitts And Nevis25631
13Netherlands21149
14Ukraine18477
15Germany12998
16Thailand12162
17Norway11475
18Singapore10578
19Canada8170
20Viet Nam7012
21Czech Republic5268
22Tunisia5254
23France4590
24Romania4017
25Colombia4014

The top 25 countries (as defined by the 2-character country code), ordered by recipient count of blocked spams are:

Botnet Statistics [2017-07-31]

detection period: 2017-07-31 00:00-23:59 UTC
total number of suspected botnet IPs: 721
number of botnet IPs notified to network operators: 672
number of spam blocked: 60444
recipient count of spam blocked: 1295254

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1CMNET99
2WASU64
3UNICOM-ZJ40
4Baidu35
5HOST4GEEKS26
6CHINANET-HN25
7CHINANET-JX23
8CHINANET-JS21
9PSINETA16
10UK-RAPIDSWITCH-2009110215

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1China396
2United States122
3Poland29
4Hong Kong27
5United Kingdom17
6Netherlands16
7Taiwan11
8India11
9Viet Nam8
10Russian Federation8

Suspected Bot List [2017-07-31]

detection period: 2017-07-31 00:00-23:59 UTC
number of suspected bots' IPs listed here: 49

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry
IN203.115.99.218India
MO116.193.10.34Macau
RU91.197.234.102Russian Federation
TH122.155.33.12Thailand
US206.125.41.139United States
ZA196.46.23.122South Africa

List from greylisting: