my system might be infected by a bot, how to find it?

edit

Hi, please don't treat this phrase as 'if you have 5+ RRS => this is a bot'. It's better to think about it as: '5+ RRS COULD POTENTIALLY (but absolutely not necessarily) be a sign of some bot activity so it's good to check what it is'.

In your case please check what names are being resolved when you get 5+ RRS: they're googleapis, large CDNs, fileshares, amazon, instagram and so on. All these are very large systems/networks and for them this is absolutely normal to have such number of owned IP addresses.

Of course I don't state the host is clean, I just say in your case this isn't an indicator of malicious activity. At first glance I'd rather check why are many requests to Iran domain names (if you're not from there).