Custom Search

Tuesday, October 13, 2020

Botnet Statistics [2020-10-12]

detection period: 2020-10-12 00:00-23:59 UTC
total number of suspected botnet IPs: 35617
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 33253
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud1349
2VNPT-VN911
3VIETTEL-VN736
4Baidu652
5TENCENT-CN636
6HINET-NET532
7UNICOM-SD511
8UNICOM-HA497
9ALISOFT451
10TELKOMNET437

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China8595
2United States3627
3India2514
4Viet Nam2424
5Russian Federation1988
6Brazil1305
7Indonesia1266
8France900
9Thailand828
10Taiwan699

The top 10 TCP ports, ordered by number of connection attempts received are:

RankTCP port number# of connection attempts received
1445458228
2143283208
3123198224
42257816
533353407
62348548
7143345225
8338933296
94327798
1022215159

Suspected Bot List [2020-10-12]

detection period: 2020-10-12 00:00-23:59 UTC
number of suspected bots' IPs listed here: 2364

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry

List from TCP port scans:

Monday, October 12, 2020

Botnet Statistics [2020-10-11]

detection period: 2020-10-11 00:00-23:59 UTC
total number of suspected botnet IPs: 31841
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 29717
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud1443
2Baidu708
3TENCENT-CN664
4VNPT-VN550
5UNICOM-HA515
6UNICOM-SD508
7ALISOFT463
8VIETTEL-VN460
9HINET-NET457
10DIGITALOCEAN-192-241-128-0412

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China8775
2United States3376
3India1720
4Russian Federation1683
5Viet Nam1529
6Brazil1353
7Indonesia856
8France846
9Taiwan609
10Mauritius554

The top 10 TCP ports, ordered by number of connection attempts received are:

RankTCP port number# of connection attempts received
1143285157
2445203397
3123190305
41234160969
51433134333
62257596
733350249
82349870
9123030059
10102023397