Custom Search

Tuesday, November 3, 2020

Botnet Statistics [2020-11-02]

detection period: 2020-11-02 00:00-23:59 UTC
total number of suspected botnet IPs: 36149
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 33853
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud1490
2VNPT-VN1028
3VIETTEL-VN776
4TENCENT-CN692
5Baidu683
6HINET-NET676
7DIGITALOCEAN-192-241-128-0609
8TELKOMNET465
9VE-CSVE-LACNIC457
10ALISOFT419

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China8439
2United States3817
3Viet Nam2594
4India2423
5Russian Federation2054
6Brazil1381
7Indonesia1303
8Taiwan862
9France848
10Thailand815

The top 10 TCP ports, ordered by number of connection attempts received are:

RankTCP port number# of connection attempts received
1445438779
22345982
32244532
420038726
5143334433
6338919436
722889191
811008265
9217534
106007443

Suspected Bot List [2020-11-02]

detection period: 2020-11-02 00:00-23:59 UTC
number of suspected bots' IPs listed here: 2296

IP addresses listed here all exhibit strange network behavior. As I could not notify the victims for various reasons (no working abuse contact, mailbox over quota, etc.), I list them here instead. I have to emphasize that those are just *suspected* to be malware-infected computers.

List from fake open relays:

country codeIP addressCountry

List from greylisting:


country codeIP addressCountry

List from SSH probes:

country codeIP addressCountry

List from TCP port scans:

Monday, November 2, 2020

Botnet Statistics [2020-11-01]

detection period: 2020-11-01 00:00-23:59 UTC
total number of suspected botnet IPs: 33268
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 31184
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by number of suspected botnet IPs are:

RankNetwork# of suspected botnet IPs
1TencentCloud1558
2Baidu747
3TENCENT-CN727
4DIGITALOCEAN-192-241-128-0628
5HINET-NET589
6VIETTEL-VN546
7VNPT-VN521
8ALISOFT474
9UNICOM-HA419
10CMNET415

The top 10 countries (as defined by the 2-character country code), ordered by number of suspected botnet IPs are:

RankCountry/Region# of suspected botnet IPs
1China8811
2United States4226
3Russian Federation1918
4Viet Nam1709
5India1571
6Brazil1379
7France888
8Indonesia872
9Taiwan771
10Mexico501

The top 10 TCP ports, ordered by number of connection attempts received are:

RankTCP port number# of connection attempts received
1445209230
2143360515
3120058759
490058758
5100053788
610051155
72250869
8170043353
92341540
10338919166