Daily Botnet Statistics

Thursday, August 3, 2017

Suspected Bot List [2017-08-02]

detection period: 2017-08-02 00:00-23:59 UTC
number of suspected bots' IPs listed here: 41

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country code	IP address	Country
DE	213.153.68.129	Germany
ID	219.83.84.146	Indonesia
IN	203.115.99.218	India
LY	197.215.136.166	Libya
MO	116.193.10.34	Macau
MO	116.193.10.35	Macau
MX	189.211.198.181	Mexico
RU	90.188.95.206	Russian Federation
RU	91.197.234.102	Russian Federation
SG	112.140.184.136	Singapore
SG	112.140.184.139	Singapore
SG	112.140.184.147	Singapore
SG	112.140.187.82	Singapore
US	206.125.41.139	United States
ZA	196.46.23.122	South Africa

List from greylisting:

Botnet Statistics [2017-08-01]

detection period: 2017-08-01 00:00-23:59 UTC
total number of suspected botnet IPs: 860
number of botnet IPs notified to network operators: 833
number of spam blocked: 77796
recipient count of spam blocked: 1684180

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	WASU	89
2	CMNET	80
3	CHINANET-HB	80
4	UNICOM-ZJ	58
5	CHINANET-JS	51
6	UNICOM-HB	50
7	Baidu	35
8	EXMASTERS8	26
9	CHINANET-JX	20
10	PSINETA	16

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

1	China	550
2	United States	126
3	Czech Republic	26
4	Netherlands	19
5	Russian Federation	14
6	United Kingdom	14
7	Singapore	13
8	Viet Nam	12
9	Ukraine	8
10	Germany	7

Suspected Bot List [2017-08-01]

detection period: 2017-08-01 00:00-23:59 UTC
number of suspected bots' IPs listed here: 27