We started scanning for IoT devices compromised by the Eleven11bot DDoS botnet, with ~86.4K discovered on 2025-03-03. IP data is shared daily in our Compromised IoT report https://www.shadowserver.org/what-we-do/network-reporting/compromised-iot-report/
Top affected: US (24.7K), UK (10.8K).
Dashboard map view: https://dashboard.shadowserver.org/statistics/combined/map/?map_type=std&day=2025-03-03&source=compromised_iot&tag=eleven11bot%2B&geo=all&data_set=count&scale=log
For background, please see Nokia Deepfield Emergency Response Team (ERT) @deepfield@infosec.exchange announcement: @deepfield@infosec.exchange
Dashboard breakdown by US state: