Custom Search

Saturday, October 10, 2020

Botnet Statistics [2020-10-09]

detection period: 2020-10-09 00:00-23:59 UTC
total number of suspected botnet IPs: 35115
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 32905
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud1345
2VIETTEL-VN995
3VNPT-VN870
4Baidu680
5TENCENT-CN636
6HINET-NET612
7UNICOM-SD527
8UNICOM-HA523
9ALISOFT454
10VE-CSVE-LACNIC422

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China8563
2United States3219
3Viet Nam2628
4India2628
5Russian Federation1967
6Brazil1631
7Indonesia1168
8France826
9Thailand800
10Taiwan786

The top 10 TCP ports, ordered by number of connection attempts received are:

RankTCP port number# of connection attempts received
1445517748
21234160485
3143148926
4123101211
5143384024
62262864
72346243
833345148
94128121
1066625931

Suspected Bot List [2020-10-09]

detection period: 2020-10-09 00:00-23:59 UTC
number of suspected bots' IPs listed here: 2210

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry

List from TCP port scans:

Friday, October 9, 2020

Botnet Statistics [2020-10-08]

detection period: 2020-10-08 00:00-23:59 UTC
total number of suspected botnet IPs: 49126
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 46922
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1VIETTEL-VN14373
2TencentCloud1342
3VNPT-VN1007
4HINET-NET690
5Baidu689
6TENCENT-CN643
7UNICOM-HA494
8UNICOM-SD476
9ALISOFT451
10TELKOMNET446

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1Viet Nam16119
2China8416
3United States3240
4India2727
5Russian Federation1949
6Brazil1700
7Indonesia1263
8Taiwan884
9France860
10Thailand804

The top 10 TCP ports, ordered by number of connection attempts received are:

RankTCP port number# of connection attempts received
1445774203
21234160349
32373273
4143365752
52257925
633344944
72533566
8338926450
94015668
10202015654