tag:blogger.com,1999:blog-67713846313751756792026-08-07T00:27:42.102+01:00Detect botnets from malicious mail, and notify the responsible ISP.Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.comBlogger9420125tag:blogger.com,1999:blog-6771384631375175679.post-2692436679499010892026-08-06T17:28:52.087+01:002026-08-06T17:28:52.087+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-05 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17947<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17039<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1325</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1101</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1047</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>999</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>963</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>343</td></tr> <tr><td>9</td><td>cloud</td><td align=right>282</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7775</td></tr> <tr><td>2</td><td>China</td><td align=right>2546</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1067</td></tr> <tr><td>4</td><td>Germany</td><td align=right>711</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>531</td></tr> <tr><td>6</td><td>Ukraine</td><td align=right>502</td></tr> <tr><td>7</td><td>France</td><td align=right>480</td></tr> <tr><td>8</td><td>Singapore</td><td align=right>455</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>323</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>276</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>7777</td><td align=right>105477</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>101561</td></tr> <tr><td>3</td><td align=right>666</td><td align=right>89840</td></tr> <tr><td>4</td><td align=right>22012</td><td align=right>31438</td></tr> <tr><td>5</td><td align=right>888</td><td align=right>30636</td></tr> <tr><td>6</td><td align=right>200</td><td align=right>25578</td></tr> <tr><td>7</td><td align=right>22</td><td align=right>24669</td></tr> <tr><td>8</td><td align=right>9022</td><td align=right>22706</td></tr> <tr><td>9</td><td align=right>3222</td><td align=right>22705</td></tr> <tr><td>10</td><td align=right>153</td><td align=right>22623</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-29980596133027810082026-08-05T13:19:11.308+01:002026-08-05T13:19:11.309+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-04 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18560<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17574<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1399</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1107</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1035</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>969</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>370</td></tr> <tr><td>9</td><td>cloud</td><td align=right>275</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8203</td></tr> <tr><td>2</td><td>China</td><td align=right>2539</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1092</td></tr> <tr><td>4</td><td>Germany</td><td align=right>736</td></tr> <tr><td>5</td><td>Ukraine</td><td align=right>669</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>540</td></tr> <tr><td>7</td><td>France</td><td align=right>488</td></tr> <tr><td>8</td><td>Singapore</td><td align=right>462</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>419</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>281</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>182839</td></tr> <tr><td>2</td><td align=right>7777</td><td align=right>107461</td></tr> <tr><td>3</td><td align=right>2271</td><td align=right>97074</td></tr> <tr><td>4</td><td align=right>666</td><td align=right>94437</td></tr> <tr><td>5</td><td align=right>888</td><td align=right>33910</td></tr> <tr><td>6</td><td align=right>8122</td><td align=right>30275</td></tr> <tr><td>7</td><td align=right>22</td><td align=right>28129</td></tr> <tr><td>8</td><td align=right>3222</td><td align=right>25901</td></tr> <tr><td>9</td><td align=right>200</td><td align=right>23275</td></tr> <tr><td>10</td><td align=right>173</td><td align=right>22740</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-72802282191076407592026-08-04T12:59:51.369+01:002026-08-04T12:59:51.370+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-03 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17597<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16682<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1333</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1085</td></tr> <tr><td>3</td><td>AL-3</td><td align=right>1084</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1034</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>373</td></tr> <tr><td>9</td><td>cloud</td><td align=right>299</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>246</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7908</td></tr> <tr><td>2</td><td>China</td><td align=right>2515</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1159</td></tr> <tr><td>4</td><td>Germany</td><td align=right>737</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>531</td></tr> <tr><td>6</td><td>France</td><td align=right>515</td></tr> <tr><td>7</td><td>Singapore</td><td align=right>468</td></tr> <tr><td>8</td><td>Ukraine</td><td align=right>326</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>313</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>278</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>173385</td></tr> <tr><td>2</td><td align=right>2271</td><td align=right>104960</td></tr> <tr><td>3</td><td align=right>666</td><td align=right>62973</td></tr> <tr><td>4</td><td align=right>7777</td><td align=right>45022</td></tr> <tr><td>5</td><td align=right>6022</td><td align=right>39384</td></tr> <tr><td>6</td><td align=right>3222</td><td align=right>26601</td></tr> <tr><td>7</td><td align=right>22</td><td align=right>24954</td></tr> <tr><td>8</td><td align=right>200</td><td align=right>23426</td></tr> <tr><td>9</td><td align=right>9022</td><td align=right>22117</td></tr> <tr><td>10</td><td align=right>173</td><td align=right>21904</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-87156024184000172882026-08-03T15:57:30.089+01:002026-08-03T15:57:30.089+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-02 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18027<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17048<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1374</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1129</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1099</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1031</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>959</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>395</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>363</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> <tr><td>10</td><td>HURRICANE-4</td><td align=right>228</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8516</td></tr> <tr><td>2</td><td>China</td><td align=right>2763</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1095</td></tr> <tr><td>4</td><td>Germany</td><td align=right>691</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>530</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>513</td></tr> <tr><td>7</td><td>France</td><td align=right>494</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>290</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>221</td></tr> <tr><td>10</td><td>European Union</td><td align=right>192</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>134738</td></tr> <tr><td>2</td><td align=right>2271</td><td align=right>75433</td></tr> <tr><td>3</td><td align=right>8015</td><td align=right>73845</td></tr> <tr><td>4</td><td align=right>4000</td><td align=right>41091</td></tr> <tr><td>5</td><td align=right>888</td><td align=right>39708</td></tr> <tr><td>6</td><td align=right>6022</td><td align=right>35721</td></tr> <tr><td>7</td><td align=right>10000</td><td align=right>30958</td></tr> <tr><td>8</td><td align=right>3306</td><td align=right>28003</td></tr> <tr><td>9</td><td align=right>22</td><td align=right>26833</td></tr> <tr><td>10</td><td align=right>3222</td><td align=right>24137</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-60071584829656267732026-08-02T13:19:18.700+01:002026-08-02T13:19:18.701+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-01 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17319<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16488<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1360</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1108</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1046</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>1041</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>958</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>373</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>373</td></tr> <tr><td>9</td><td>cloud</td><td align=right>301</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7801</td></tr> <tr><td>2</td><td>China</td><td align=right>2752</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1107</td></tr> <tr><td>4</td><td>Germany</td><td align=right>708</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>567</td></tr> <tr><td>6</td><td>France</td><td align=right>502</td></tr> <tr><td>7</td><td>Singapore</td><td align=right>495</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>303</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>225</td></tr> <tr><td>10</td><td>European Union</td><td align=right>195</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>6005</td><td align=right>71490</td></tr> <tr><td>2</td><td align=right>8015</td><td align=right>65342</td></tr> <tr><td>3</td><td align=right>8888</td><td align=right>64052</td></tr> <tr><td>4</td><td align=right>5900</td><td align=right>59536</td></tr> <tr><td>5</td><td align=right>888</td><td align=right>38360</td></tr> <tr><td>6</td><td align=right>22</td><td align=right>27117</td></tr> <tr><td>7</td><td align=right>3306</td><td align=right>25441</td></tr> <tr><td>8</td><td align=right>9000</td><td align=right>25420</td></tr> <tr><td>9</td><td align=right>9022</td><td align=right>24056</td></tr> <tr><td>10</td><td align=right>3222</td><td align=right>23796</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-51758553043394728462026-08-02T07:39:56.046+01:002026-08-06T17:25:25.957+01:00To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:<div>為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：</div><div><br /></div> <div>Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;</div><div>第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；</div> <div>Column 2: Zombie IP;</div><div>第2欄：該殭屍電腦的IP位址；</div> <div>Column 3: TCP destination port number scanned by the zombie.</div><div>第3欄：該殭屍電腦所掃描的TCP埠號。</div><div><br /></div> <div>Join the "<a href="https://t.me/szipl">Suspected Zombie IP List</a>" Telegram channel to get notified when the latest data are ready for download.</div><div>想在第一時間取得資料下載網址？請加入<a href="https://t.me/szipl">Suspected Zombie IP List</a>的Telegram頻道。</div><div><br /></div> <div>Here are the download links of the daily zombie IP lists for August 2026 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):</div><div>以下是2026年08月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：</div><div><br /></div> <div>08/01: <a href="https://www.mediafire.com/file/efk3uc1krwt4ic8/260801_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: ee622407dc8ddb6fe0ed29bfb9ad4de0</div> <div>08/02: <a href="https://www.mediafire.com/file/an8oxpecbt42r8a/260802_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 37abcbc4f1b31aed3bfc0ee714e44732</div> <div>08/03: <a href="https://www.mediafire.com/file/0gzu2pbk2dyth5e/260803_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: c24847e944753f0403a39b656120cea2</div> <div>08/04: <a href="https://www.mediafire.com/file/ez47rcruh5jduj3/260804_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: b45b8ff7faf47e8ffa9898cca74191da</div> <div>08/05: <a href="https://www.mediafire.com/file/x84gy77qpz0t7fp/260805_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 98021ed0075a5ec9ee9b8986e54c84d6</div> <div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-68554060723532977172026-08-01T16:08:10.444+01:002026-08-01T16:08:10.444+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-31 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17713<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16619<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1345</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1071</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1035</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>863</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>446</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>386</td></tr> <tr><td>9</td><td>cloud</td><td align=right>251</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7927</td></tr> <tr><td>2</td><td>China</td><td align=right>2943</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1120</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>543</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>542</td></tr> <tr><td>6</td><td>Germany</td><td align=right>478</td></tr> <tr><td>7</td><td>France</td><td align=right>477</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>267</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>265</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>206</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>8015</td><td align=right>87411</td></tr> <tr><td>2</td><td align=right>5555</td><td align=right>76451</td></tr> <tr><td>3</td><td align=right>8888</td><td align=right>66005</td></tr> <tr><td>4</td><td align=right>888</td><td align=right>40767</td></tr> <tr><td>5</td><td align=right>5000</td><td align=right>33905</td></tr> <tr><td>6</td><td align=right>3306</td><td align=right>29413</td></tr> <tr><td>7</td><td align=right>8122</td><td align=right>29021</td></tr> <tr><td>8</td><td align=right>23</td><td align=right>27418</td></tr> <tr><td>9</td><td align=right>22</td><td align=right>26733</td></tr> <tr><td>10</td><td align=right>8088</td><td align=right>24978</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-65939220740191947292026-07-31T14:01:36.209+01:002026-07-31T14:01:36.209+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-30 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18273<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17479<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1288</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1087</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1050</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>976</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>CLOUDFLARENET</td><td align=right>760</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>9</td><td>ASEPL-SG</td><td align=right>349</td></tr> <tr><td>10</td><td>cloud</td><td align=right>260</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9090</td></tr> <tr><td>2</td><td>China</td><td align=right>2397</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1142</td></tr> <tr><td>4</td><td>Germany</td><td align=right>635</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>532</td></tr> <tr><td>6</td><td>France</td><td align=right>515</td></tr> <tr><td>7</td><td>Singapore</td><td align=right>473</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>304</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>266</td></tr> <tr><td>10</td><td>India</td><td align=right>209</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>8015</td><td align=right>106469</td></tr> <tr><td>2</td><td align=right>5555</td><td align=right>95994</td></tr> <tr><td>3</td><td align=right>8888</td><td align=right>67966</td></tr> <tr><td>4</td><td align=right>2266</td><td align=right>41035</td></tr> <tr><td>5</td><td align=right>6000</td><td align=right>34585</td></tr> <tr><td>6</td><td align=right>2000</td><td align=right>33296</td></tr> <tr><td>7</td><td align=right>888</td><td align=right>30591</td></tr> <tr><td>8</td><td align=right>23</td><td align=right>29783</td></tr> <tr><td>9</td><td align=right>3306</td><td align=right>24945</td></tr> <tr><td>10</td><td align=right>7000</td><td align=right>24190</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-57006190376952060982026-07-30T13:44:39.251+01:002026-07-30T13:44:39.252+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-29 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17463<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16629<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1274</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1074</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1042</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>1017</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>958</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>354</td></tr> <tr><td>9</td><td>cloud</td><td align=right>266</td></tr> <tr><td>10</td><td>UCLOUD-US</td><td align=right>247</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7739</td></tr> <tr><td>2</td><td>China</td><td align=right>2846</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1103</td></tr> <tr><td>4</td><td>Germany</td><td align=right>678</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>559</td></tr> <tr><td>6</td><td>France</td><td align=right>473</td></tr> <tr><td>7</td><td>Singapore</td><td align=right>465</td></tr> <tr><td>8</td><td>Russian Federation</td><td align=right>324</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>310</td></tr> <tr><td>10</td><td>European Union</td><td align=right>211</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>6000</td><td align=right>86449</td></tr> <tr><td>2</td><td align=right>5555</td><td align=right>82927</td></tr> <tr><td>3</td><td align=right>2227</td><td align=right>76633</td></tr> <tr><td>4</td><td align=right>8888</td><td align=right>54401</td></tr> <tr><td>5</td><td align=right>2266</td><td align=right>42200</td></tr> <tr><td>6</td><td align=right>22010</td><td align=right>37842</td></tr> <tr><td>7</td><td align=right>3222</td><td align=right>25337</td></tr> <tr><td>8</td><td align=right>22</td><td align=right>24226</td></tr> <tr><td>9</td><td align=right>182</td><td align=right>20881</td></tr> <tr><td>10</td><td align=right>153</td><td align=right>20301</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-39011341826996487472026-07-29T17:02:58.988+01:002026-07-29T17:02:58.988+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-28 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17429<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16680<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1328</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1082</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1045</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>1015</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>959</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>380</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>376</td></tr> <tr><td>9</td><td>cloud</td><td align=right>299</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8080</td></tr> <tr><td>2</td><td>China</td><td align=right>2679</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1142</td></tr> <tr><td>4</td><td>Germany</td><td align=right>702</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>601</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>484</td></tr> <tr><td>7</td><td>France</td><td align=right>420</td></tr> <tr><td>8</td><td>Russian Federation</td><td align=right>297</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>243</td></tr> <tr><td>10</td><td>European Union</td><td align=right>210</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>2227</td><td align=right>76951</td></tr> <tr><td>2</td><td align=right>6001</td><td align=right>50160</td></tr> <tr><td>3</td><td align=right>6000</td><td align=right>45312</td></tr> <tr><td>4</td><td align=right>2266</td><td align=right>41159</td></tr> <tr><td>5</td><td align=right>9011</td><td align=right>40310</td></tr> <tr><td>6</td><td align=right>4722</td><td align=right>27037</td></tr> <tr><td>7</td><td align=right>22</td><td align=right>26861</td></tr> <tr><td>8</td><td align=right>3222</td><td align=right>24860</td></tr> <tr><td>9</td><td align=right>5522</td><td align=right>23255</td></tr> <tr><td>10</td><td align=right>182</td><td align=right>22447</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-32718355167065880022026-07-28T15:30:14.265+01:002026-07-28T15:30:14.266+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-27 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17515<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16626<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1421</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1099</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1045</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>1006</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>964</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>389</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>380</td></tr> <tr><td>9</td><td>cloud</td><td align=right>289</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7779</td></tr> <tr><td>2</td><td>China</td><td align=right>2876</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1148</td></tr> <tr><td>4</td><td>Germany</td><td align=right>734</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>568</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>503</td></tr> <tr><td>7</td><td>France</td><td align=right>407</td></tr> <tr><td>8</td><td>Russian Federation</td><td align=right>295</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>262</td></tr> <tr><td>10</td><td>Ukraine</td><td align=right>216</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>2227</td><td align=right>77780</td></tr> <tr><td>2</td><td align=right>2228</td><td align=right>61077</td></tr> <tr><td>3</td><td align=right>2266</td><td align=right>41409</td></tr> <tr><td>4</td><td align=right>4722</td><td align=right>29696</td></tr> <tr><td>5</td><td align=right>2226</td><td align=right>27491</td></tr> <tr><td>6</td><td align=right>22</td><td align=right>27096</td></tr> <tr><td>7</td><td align=right>9422</td><td align=right>23996</td></tr> <tr><td>8</td><td align=right>3222</td><td align=right>23019</td></tr> <tr><td>9</td><td align=right>5900</td><td align=right>22472</td></tr> <tr><td>10</td><td align=right>182</td><td align=right>22382</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-49699329094683392002026-07-27T13:35:54.160+01:002026-07-27T13:35:54.160+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-26 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17778<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16976<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1453</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1129</td></tr> <tr><td>3</td><td>AL-3</td><td align=right>1101</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1044</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>357</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>356</td></tr> <tr><td>9</td><td>cloud</td><td align=right>308</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>246</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8364</td></tr> <tr><td>2</td><td>China</td><td align=right>2637</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1185</td></tr> <tr><td>4</td><td>Germany</td><td align=right>765</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>568</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>443</td></tr> <tr><td>7</td><td>France</td><td align=right>422</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>268</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>261</td></tr> <tr><td>10</td><td>Ukraine</td><td align=right>198</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>2266</td><td align=right>42182</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>31460</td></tr> <tr><td>3</td><td align=right>4722</td><td align=right>29752</td></tr> <tr><td>4</td><td align=right>22</td><td align=right>25526</td></tr> <tr><td>5</td><td align=right>2222</td><td align=right>22978</td></tr> <tr><td>6</td><td align=right>182</td><td align=right>22542</td></tr> <tr><td>7</td><td align=right>322</td><td align=right>22012</td></tr> <tr><td>8</td><td align=right>5322</td><td align=right>21615</td></tr> <tr><td>9</td><td align=right>3222</td><td align=right>21006</td></tr> <tr><td>10</td><td align=right>4422</td><td align=right>19771</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-57124177353116554782026-07-26T10:42:40.685+01:002026-07-26T10:42:40.686+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-25 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17622<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16666<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1351</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1107</td></tr> <tr><td>3</td><td>AL-3</td><td align=right>1047</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1039</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>CLOUDFLARENET</td><td align=right>755</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>380</td></tr> <tr><td>9</td><td>ASEPL-SG</td><td align=right>365</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7988</td></tr> <tr><td>2</td><td>China</td><td align=right>2783</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1203</td></tr> <tr><td>4</td><td>Germany</td><td align=right>787</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>587</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>452</td></tr> <tr><td>7</td><td>France</td><td align=right>412</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>249</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>228</td></tr> <tr><td>10</td><td>European Union</td><td align=right>208</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>8005</td><td align=right>41631</td></tr> <tr><td>2</td><td align=right>2266</td><td align=right>40897</td></tr> <tr><td>3</td><td align=right>4722</td><td align=right>30998</td></tr> <tr><td>4</td><td align=right>5900</td><td align=right>30091</td></tr> <tr><td>5</td><td align=right>9322</td><td align=right>27603</td></tr> <tr><td>6</td><td align=right>22</td><td align=right>26395</td></tr> <tr><td>7</td><td align=right>5322</td><td align=right>22688</td></tr> <tr><td>8</td><td align=right>4222</td><td align=right>22252</td></tr> <tr><td>9</td><td align=right>182</td><td align=right>22197</td></tr> <tr><td>10</td><td align=right>4322</td><td align=right>21358</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-3843408278626905052026-07-25T16:30:59.291+01:002026-07-25T16:30:59.291+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-24 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 16917<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16182<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1328</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1143</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1035</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>988</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>963</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>371</td></tr> <tr><td>9</td><td>cloud</td><td align=right>319</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>246</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7514</td></tr> <tr><td>2</td><td>China</td><td align=right>2962</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1164</td></tr> <tr><td>4</td><td>Germany</td><td align=right>719</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>557</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>491</td></tr> <tr><td>7</td><td>France</td><td align=right>440</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>247</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>213</td></tr> <tr><td>10</td><td>European Union</td><td align=right>208</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>2266</td><td align=right>41870</td></tr> <tr><td>2</td><td align=right>4722</td><td align=right>29712</td></tr> <tr><td>3</td><td align=right>22</td><td align=right>27077</td></tr> <tr><td>4</td><td align=right>622</td><td align=right>26980</td></tr> <tr><td>5</td><td align=right>5900</td><td align=right>26965</td></tr> <tr><td>6</td><td align=right>6122</td><td align=right>23481</td></tr> <tr><td>7</td><td align=right>3222</td><td align=right>23164</td></tr> <tr><td>8</td><td align=right>4322</td><td align=right>22689</td></tr> <tr><td>9</td><td align=right>2122</td><td align=right>22567</td></tr> <tr><td>10</td><td align=right>4222</td><td align=right>22195</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-7096990022749413572026-07-24T13:20:11.498+01:002026-07-24T13:20:11.499+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-23 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18389<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17317<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1456</td></tr> <tr><td>2</td><td>GOOGLE-CLOUD</td><td align=right>1045</td></tr> <tr><td>3</td><td>AL-3</td><td align=right>1028</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>963</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>904</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>380</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>378</td></tr> <tr><td>9</td><td>cloud</td><td align=right>289</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>243</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8251</td></tr> <tr><td>2</td><td>China</td><td align=right>3210</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1272</td></tr> <tr><td>4</td><td>Netherlands</td><td align=right>586</td></tr> <tr><td>5</td><td>Germany</td><td align=right>493</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>492</td></tr> <tr><td>7</td><td>France</td><td align=right>415</td></tr> <tr><td>8</td><td>European Union</td><td align=right>255</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>240</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>232</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>2266</td><td align=right>42694</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>39967</td></tr> <tr><td>3</td><td align=right>8022</td><td align=right>39168</td></tr> <tr><td>4</td><td align=right>1022</td><td align=right>31134</td></tr> <tr><td>5</td><td align=right>622</td><td align=right>29698</td></tr> <tr><td>6</td><td align=right>4722</td><td align=right>29256</td></tr> <tr><td>7</td><td align=right>22</td><td align=right>28530</td></tr> <tr><td>8</td><td align=right>5922</td><td align=right>28523</td></tr> <tr><td>9</td><td align=right>322</td><td align=right>27850</td></tr> <tr><td>10</td><td align=right>2022</td><td align=right>27817</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-74797265148796158912026-07-23T13:25:15.529+01:002026-07-23T13:25:15.530+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-22 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18625<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17815<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1535</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1097</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1046</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>1006</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>380</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>344</td></tr> <tr><td>9</td><td>cloud</td><td align=right>335</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7792</td></tr> <tr><td>2</td><td>China</td><td align=right>3995</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1226</td></tr> <tr><td>4</td><td>Germany</td><td align=right>645</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>526</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>461</td></tr> <tr><td>7</td><td>France</td><td align=right>440</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>262</td></tr> <tr><td>9</td><td>India</td><td align=right>243</td></tr> <tr><td>10</td><td>European Union</td><td align=right>212</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>71969</td></tr> <tr><td>2</td><td align=right>2266</td><td align=right>43899</td></tr> <tr><td>3</td><td align=right>2022</td><td align=right>28959</td></tr> <tr><td>4</td><td align=right>622</td><td align=right>28855</td></tr> <tr><td>5</td><td align=right>4722</td><td align=right>28726</td></tr> <tr><td>6</td><td align=right>322</td><td align=right>27458</td></tr> <tr><td>7</td><td align=right>9122</td><td align=right>26342</td></tr> <tr><td>8</td><td align=right>1622</td><td align=right>26210</td></tr> <tr><td>9</td><td align=right>22</td><td align=right>26129</td></tr> <tr><td>10</td><td align=right>9822</td><td align=right>26120</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-69370337702043780542026-07-22T12:03:12.707+01:002026-07-23T05:26:12.148+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-21 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19130<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18358<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1346</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1113</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1078</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1040</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>380</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>349</td></tr> <tr><td>9</td><td>cloud</td><td align=right>275</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>244</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8173</td></tr> <tr><td>2</td><td>China</td><td align=right>4009</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1189</td></tr> <tr><td>4</td><td>Germany</td><td align=right>651</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>537</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>458</td></tr> <tr><td>7</td><td>France</td><td align=right>402</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>241</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>205</td></tr> <tr><td>10</td><td>European Union</td><td align=right>193</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>69034</td></tr> <tr><td>2</td><td align=right>5422</td><td align=right>49256</td></tr> <tr><td>3</td><td align=right>2266</td><td align=right>46406</td></tr> <tr><td>4</td><td align=right>1122</td><td align=right>32181</td></tr> <tr><td>5</td><td align=right>9222</td><td align=right>30604</td></tr> <tr><td>6</td><td align=right>6522</td><td align=right>30276</td></tr> <tr><td>7</td><td align=right>4722</td><td align=right>28202</td></tr> <tr><td>8</td><td align=right>622</td><td align=right>27693</td></tr> <tr><td>9</td><td align=right>2022</td><td align=right>27689</td></tr> <tr><td>10</td><td align=right>1622</td><td align=right>27120</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-464681281425662182026-07-21T14:28:09.677+01:002026-07-21T14:28:09.677+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-20 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18080<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17267<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1326</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1092</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1068</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>973</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>366</td></tr> <tr><td>9</td><td>cloud</td><td align=right>281</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7536</td></tr> <tr><td>2</td><td>China</td><td align=right>3986</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1136</td></tr> <tr><td>4</td><td>Germany</td><td align=right>591</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>570</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>467</td></tr> <tr><td>7</td><td>France</td><td align=right>413</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>276</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>261</td></tr> <tr><td>10</td><td>India</td><td align=right>219</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5422</td><td align=right>109216</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>82230</td></tr> <tr><td>3</td><td align=right>2422</td><td align=right>71442</td></tr> <tr><td>4</td><td align=right>2758</td><td align=right>54317</td></tr> <tr><td>5</td><td align=right>9617</td><td align=right>49354</td></tr> <tr><td>6</td><td align=right>2266</td><td align=right>47921</td></tr> <tr><td>7</td><td align=right>9022</td><td align=right>36181</td></tr> <tr><td>8</td><td align=right>11483</td><td align=right>34138</td></tr> <tr><td>9</td><td align=right>8001</td><td align=right>30037</td></tr> <tr><td>10</td><td align=right>23</td><td align=right>29934</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-37914908542804698802026-07-20T15:47:09.796+01:002026-07-20T15:47:09.796+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-19 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17930<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17189<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1312</td></tr> <tr><td>2</td><td>GOOGLE-CLOUD</td><td align=right>1040</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1005</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>969</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>959</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>374</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>323</td></tr> <tr><td>9</td><td>cloud</td><td align=right>243</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8134</td></tr> <tr><td>2</td><td>China</td><td align=right>3946</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>961</td></tr> <tr><td>4</td><td>Netherlands</td><td align=right>541</td></tr> <tr><td>5</td><td>Germany</td><td align=right>497</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>459</td></tr> <tr><td>7</td><td>France</td><td align=right>410</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>271</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>203</td></tr> <tr><td>10</td><td>India</td><td align=right>172</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>101487</td></tr> <tr><td>2</td><td align=right>5422</td><td align=right>98821</td></tr> <tr><td>3</td><td align=right>3822</td><td align=right>92258</td></tr> <tr><td>4</td><td align=right>2422</td><td align=right>71712</td></tr> <tr><td>5</td><td align=right>6415</td><td align=right>54885</td></tr> <tr><td>6</td><td align=right>5534</td><td align=right>49527</td></tr> <tr><td>7</td><td align=right>2266</td><td align=right>49270</td></tr> <tr><td>8</td><td align=right>9022</td><td align=right>44657</td></tr> <tr><td>9</td><td align=right>7022</td><td align=right>41108</td></tr> <tr><td>10</td><td align=right>15844</td><td align=right>41105</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-70118513639098282432026-07-19T13:54:38.749+01:002026-07-19T13:54:38.749+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-18 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18052<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17278<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1337</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1088</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1045</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>1009</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>392</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>384</td></tr> <tr><td>9</td><td>cloud</td><td align=right>288</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7521</td></tr> <tr><td>2</td><td>China</td><td align=right>4138</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1111</td></tr> <tr><td>4</td><td>Netherlands</td><td align=right>548</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>512</td></tr> <tr><td>6</td><td>Germany</td><td align=right>431</td></tr> <tr><td>7</td><td>France</td><td align=right>425</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>248</td></tr> <tr><td>9</td><td>India</td><td align=right>241</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>209</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>3822</td><td align=right>117119</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>79192</td></tr> <tr><td>3</td><td align=right>2422</td><td align=right>61150</td></tr> <tr><td>4</td><td align=right>7022</td><td align=right>59026</td></tr> <tr><td>5</td><td align=right>3708</td><td align=right>54441</td></tr> <tr><td>6</td><td align=right>2266</td><td align=right>51132</td></tr> <tr><td>7</td><td align=right>9022</td><td align=right>45689</td></tr> <tr><td>8</td><td align=right>3950</td><td align=right>41128</td></tr> <tr><td>9</td><td align=right>9131</td><td align=right>36735</td></tr> <tr><td>10</td><td align=right>2022</td><td align=right>35479</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-3644645100837672982026-07-18T16:21:57.187+01:002026-07-18T16:21:57.187+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-17 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18279<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17355<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1350</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1131</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1098</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1046</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>383</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>358</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>230</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7846</td></tr> <tr><td>2</td><td>China</td><td align=right>4086</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1093</td></tr> <tr><td>4</td><td>Netherlands</td><td align=right>543</td></tr> <tr><td>5</td><td>Germany</td><td align=right>484</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>464</td></tr> <tr><td>7</td><td>France</td><td align=right>403</td></tr> <tr><td>8</td><td>India</td><td align=right>250</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>240</td></tr> <tr><td>10</td><td>European Union</td><td align=right>196</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>7022</td><td align=right>58820</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>45905</td></tr> <tr><td>3</td><td align=right>3822</td><td align=right>43316</td></tr> <tr><td>4</td><td align=right>2022</td><td align=right>38833</td></tr> <tr><td>5</td><td align=right>9222</td><td align=right>33098</td></tr> <tr><td>6</td><td align=right>1022</td><td align=right>32257</td></tr> <tr><td>7</td><td align=right>4122</td><td align=right>32132</td></tr> <tr><td>8</td><td align=right>222</td><td align=right>30131</td></tr> <tr><td>9</td><td align=right>22</td><td align=right>29071</td></tr> <tr><td>10</td><td align=right>6522</td><td align=right>28967</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-52102977034998495472026-07-17T11:28:47.143+01:002026-07-17T11:28:47.144+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-16 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17502<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16726<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1294</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1073</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1054</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>985</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>356</td></tr> <tr><td>9</td><td>cloud</td><td align=right>272</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7663</td></tr> <tr><td>2</td><td>China</td><td align=right>4041</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>856</td></tr> <tr><td>4</td><td>Netherlands</td><td align=right>535</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>442</td></tr> <tr><td>6</td><td>Germany</td><td align=right>433</td></tr> <tr><td>7</td><td>France</td><td align=right>422</td></tr> <tr><td>8</td><td>India</td><td align=right>296</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>239</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>209</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>7022</td><td align=right>51620</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>33910</td></tr> <tr><td>3</td><td align=right>1022</td><td align=right>32974</td></tr> <tr><td>4</td><td align=right>2022</td><td align=right>32814</td></tr> <tr><td>5</td><td align=right>4122</td><td align=right>30687</td></tr> <tr><td>6</td><td align=right>9222</td><td align=right>29285</td></tr> <tr><td>7</td><td align=right>5822</td><td align=right>28712</td></tr> <tr><td>8</td><td align=right>222</td><td align=right>28627</td></tr> <tr><td>9</td><td align=right>6522</td><td align=right>28152</td></tr> <tr><td>10</td><td align=right>4722</td><td align=right>27861</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-11064334164528926732026-07-16T14:10:03.022+01:002026-07-16T14:10:03.022+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-15 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17993<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16942<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1327</td></tr> <tr><td>2</td><td>GOOGLE-CLOUD</td><td align=right>1044</td></tr> <tr><td>3</td><td>AL-3</td><td align=right>968</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>892</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>341</td></tr> <tr><td>9</td><td>cloud</td><td align=right>247</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7990</td></tr> <tr><td>2</td><td>China</td><td align=right>3649</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1057</td></tr> <tr><td>4</td><td>Netherlands</td><td align=right>536</td></tr> <tr><td>5</td><td>France</td><td align=right>429</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>425</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>279</td></tr> <tr><td>8</td><td>India</td><td align=right>250</td></tr> <tr><td>9</td><td>Germany</td><td align=right>235</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>197</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5822</td><td align=right>91180</td></tr> <tr><td>2</td><td align=right>7022</td><td align=right>54676</td></tr> <tr><td>3</td><td align=right>8559</td><td align=right>43550</td></tr> <tr><td>4</td><td align=right>2122</td><td align=right>34780</td></tr> <tr><td>5</td><td align=right>4122</td><td align=right>33964</td></tr> <tr><td>6</td><td align=right>1022</td><td align=right>33144</td></tr> <tr><td>7</td><td align=right>5900</td><td align=right>31268</td></tr> <tr><td>8</td><td align=right>822</td><td align=right>30525</td></tr> <tr><td>9</td><td align=right>4322</td><td align=right>30464</td></tr> <tr><td>10</td><td align=right>622</td><td align=right>29964</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-70596673916157920612026-07-15T14:18:35.483+01:002026-07-15T14:18:35.483+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-14 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21085<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20188<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1401</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1387</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1118</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1040</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>522</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>469</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>10</td><td>cloud</td><td align=right>314</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8775</td></tr> <tr><td>2</td><td>China</td><td align=right>5005</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1042</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>709</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>578</td></tr> <tr><td>6</td><td>Germany</td><td align=right>488</td></tr> <tr><td>7</td><td>France</td><td align=right>419</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>323</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>306</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>275</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>14406</td><td align=right>46907</td></tr> <tr><td>2</td><td align=right>7606</td><td align=right>43777</td></tr> <tr><td>3</td><td align=right>4910</td><td align=right>42055</td></tr> <tr><td>4</td><td align=right>9872</td><td align=right>38823</td></tr> <tr><td>5</td><td align=right>1522</td><td align=right>35668</td></tr> <tr><td>6</td><td align=right>2122</td><td align=right>35211</td></tr> <tr><td>7</td><td align=right>4122</td><td align=right>34054</td></tr> <tr><td>8</td><td align=right>5900</td><td align=right>33456</td></tr> <tr><td>9</td><td align=right>5822</td><td align=right>33020</td></tr> <tr><td>10</td><td align=right>9999</td><td align=right>32036</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-56860860875830911482026-07-14T12:50:14.944+01:002026-07-14T12:50:14.944+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-13 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20643<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19737<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1397</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1397</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1061</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1056</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>963</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>523</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>462</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>10</td><td>cloud</td><td align=right>322</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8529</td></tr> <tr><td>2</td><td>China</td><td align=right>4963</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>803</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>721</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>604</td></tr> <tr><td>6</td><td>Germany</td><td align=right>470</td></tr> <tr><td>7</td><td>France</td><td align=right>423</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>317</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>317</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>275</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>9999</td><td align=right>57595</td></tr> <tr><td>2</td><td align=right>9011</td><td align=right>39039</td></tr> <tr><td>3</td><td align=right>22</td><td align=right>38869</td></tr> <tr><td>4</td><td align=right>3333</td><td align=right>35960</td></tr> <tr><td>5</td><td align=right>622</td><td align=right>34221</td></tr> <tr><td>6</td><td align=right>14387</td><td align=right>34094</td></tr> <tr><td>7</td><td align=right>4122</td><td align=right>33130</td></tr> <tr><td>8</td><td align=right>4322</td><td align=right>31568</td></tr> <tr><td>9</td><td align=right>2122</td><td align=right>31202</td></tr> <tr><td>10</td><td align=right>5781</td><td align=right>31002</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0