tag:blogger.com,1999:blog-67713846313751756792026-09-16T00:53:18.403+01:00Detect botnets from malicious mail, and notify the responsible ISP.Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.comBlogger9460125tag:blogger.com,1999:blog-6771384631375175679.post-25204394785983334012026-09-15T15:59:46.175+01:002026-09-15T15:59:46.175+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-14 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18065<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17148<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1489</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1329</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1134</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1047</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>954</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>473</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>365</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>319</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8220</td></tr> <tr><td>2</td><td>China</td><td align=right>2706</td></tr> <tr><td>3</td><td>Germany</td><td align=right>825</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>773</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>645</td></tr> <tr><td>6</td><td>France</td><td align=right>573</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>536</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>323</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>246</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>226</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>168439</td></tr> <tr><td>2</td><td align=right>10001</td><td align=right>157389</td></tr> <tr><td>3</td><td align=right>444</td><td align=right>49991</td></tr> <tr><td>4</td><td align=right>3122</td><td align=right>43074</td></tr> <tr><td>5</td><td align=right>2122</td><td align=right>42952</td></tr> <tr><td>6</td><td align=right>333</td><td align=right>32520</td></tr> <tr><td>7</td><td align=right>8008</td><td align=right>29499</td></tr> <tr><td>8</td><td align=right>1111</td><td align=right>26296</td></tr> <tr><td>9</td><td align=right>2254</td><td align=right>26025</td></tr> <tr><td>10</td><td align=right>122</td><td align=right>24867</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-78743512620685382852026-09-14T16:18:51.084+01:002026-09-14T16:18:51.084+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-13 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18776<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17909<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1375</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1364</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1151</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1049</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>957</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>491</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>373</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>346</td></tr> <tr><td>10</td><td>cloud</td><td align=right>254</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8914</td></tr> <tr><td>2</td><td>China</td><td align=right>3043</td></tr> <tr><td>3</td><td>Germany</td><td align=right>856</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>777</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>651</td></tr> <tr><td>6</td><td>France</td><td align=right>541</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>532</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>315</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>245</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>184</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>251929</td></tr> <tr><td>2</td><td align=right>3736</td><td align=right>59175</td></tr> <tr><td>3</td><td align=right>2636</td><td align=right>50745</td></tr> <tr><td>4</td><td align=right>5055</td><td align=right>47751</td></tr> <tr><td>5</td><td align=right>2883</td><td align=right>46572</td></tr> <tr><td>6</td><td align=right>8007</td><td align=right>42802</td></tr> <tr><td>7</td><td align=right>4010</td><td align=right>42219</td></tr> <tr><td>8</td><td align=right>1723</td><td align=right>40746</td></tr> <tr><td>9</td><td align=right>5637</td><td align=right>40742</td></tr> <tr><td>10</td><td align=right>144</td><td align=right>39876</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-27442368480296248982026-09-13T16:00:19.561+01:002026-09-13T16:00:19.562+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-12 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18128<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17188<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1381</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1317</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1046</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1027</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>505</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>372</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>316</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7930</td></tr> <tr><td>2</td><td>China</td><td align=right>2933</td></tr> <tr><td>3</td><td>Germany</td><td align=right>830</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>670</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>651</td></tr> <tr><td>6</td><td>France</td><td align=right>565</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>524</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>352</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>315</td></tr> <tr><td>10</td><td>India</td><td align=right>237</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>263270</td></tr> <tr><td>2</td><td align=right>2299</td><td align=right>100984</td></tr> <tr><td>3</td><td align=right>20088</td><td align=right>68763</td></tr> <tr><td>4</td><td align=right>522</td><td align=right>60654</td></tr> <tr><td>5</td><td align=right>58888</td><td align=right>59506</td></tr> <tr><td>6</td><td align=right>9374</td><td align=right>58980</td></tr> <tr><td>7</td><td align=right>3137</td><td align=right>48402</td></tr> <tr><td>8</td><td align=right>2095</td><td align=right>47735</td></tr> <tr><td>9</td><td align=right>444</td><td align=right>44355</td></tr> <tr><td>10</td><td align=right>1136</td><td align=right>43407</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-86825293828165223852026-09-12T14:45:25.284+01:002026-09-12T14:45:25.284+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-11 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18165<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17156<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1376</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1284</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1137</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1040</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>580</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>374</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7912</td></tr> <tr><td>2</td><td>China</td><td align=right>3151</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>774</td></tr> <tr><td>4</td><td>Germany</td><td align=right>760</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>699</td></tr> <tr><td>6</td><td>France</td><td align=right>558</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>556</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>342</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>248</td></tr> <tr><td>10</td><td>India</td><td align=right>225</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>224995</td></tr> <tr><td>2</td><td align=right>7981</td><td align=right>83695</td></tr> <tr><td>3</td><td align=right>2299</td><td align=right>81115</td></tr> <tr><td>4</td><td align=right>2987</td><td align=right>63781</td></tr> <tr><td>5</td><td align=right>3137</td><td align=right>63563</td></tr> <tr><td>6</td><td align=right>58888</td><td align=right>59695</td></tr> <tr><td>7</td><td align=right>8443</td><td align=right>59632</td></tr> <tr><td>8</td><td align=right>20088</td><td align=right>55585</td></tr> <tr><td>9</td><td align=right>3455</td><td align=right>45739</td></tr> <tr><td>10</td><td align=right>2095</td><td align=right>43100</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-34385861224601283332026-09-11T17:03:27.716+01:002026-09-11T17:03:27.716+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-10 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19769<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18833<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1371</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1125</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1042</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>1000</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>956</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>395</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>383</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8597</td></tr> <tr><td>2</td><td>China</td><td align=right>4001</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>785</td></tr> <tr><td>4</td><td>Germany</td><td align=right>772</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>568</td></tr> <tr><td>6</td><td>France</td><td align=right>563</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>552</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>373</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>259</td></tr> <tr><td>10</td><td>India</td><td align=right>236</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>3137</td><td align=right>164834</td></tr> <tr><td>2</td><td align=right>2299</td><td align=right>103632</td></tr> <tr><td>3</td><td align=right>5900</td><td align=right>101830</td></tr> <tr><td>4</td><td align=right>58888</td><td align=right>78749</td></tr> <tr><td>5</td><td align=right>20088</td><td align=right>71963</td></tr> <tr><td>6</td><td align=right>2095</td><td align=right>61837</td></tr> <tr><td>7</td><td align=right>4302</td><td align=right>56164</td></tr> <tr><td>8</td><td align=right>20054</td><td align=right>47846</td></tr> <tr><td>9</td><td align=right>7981</td><td align=right>31673</td></tr> <tr><td>10</td><td align=right>3222</td><td align=right>30907</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-50313172293781030722026-09-10T15:08:26.485+01:002026-09-10T15:08:26.485+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-09 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19958<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18714<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1376</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1176</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1044</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>957</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>593</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>494</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8266</td></tr> <tr><td>2</td><td>China</td><td align=right>3857</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>676</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>671</td></tr> <tr><td>5</td><td>France</td><td align=right>581</td></tr> <tr><td>6</td><td>Germany</td><td align=right>557</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>496</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>338</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>314</td></tr> <tr><td>10</td><td>India</td><td align=right>290</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>120598</td></tr> <tr><td>2</td><td align=right>8000</td><td align=right>53170</td></tr> <tr><td>3</td><td align=right>2229</td><td align=right>52982</td></tr> <tr><td>4</td><td align=right>5409</td><td align=right>46874</td></tr> <tr><td>5</td><td align=right>8001</td><td align=right>43807</td></tr> <tr><td>6</td><td align=right>3011</td><td align=right>42660</td></tr> <tr><td>7</td><td align=right>9612</td><td align=right>36613</td></tr> <tr><td>8</td><td align=right>9922</td><td align=right>35921</td></tr> <tr><td>9</td><td align=right>3033</td><td align=right>33251</td></tr> <tr><td>10</td><td align=right>2718</td><td align=right>32702</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-56863561823135130052026-09-09T16:31:30.709+01:002026-09-09T16:31:30.709+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-08 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18672<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17719<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1344</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1322</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1048</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>956</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>903</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>511</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>366</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>276</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8707</td></tr> <tr><td>2</td><td>China</td><td align=right>2935</td></tr> <tr><td>3</td><td>Germany</td><td align=right>788</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>680</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>629</td></tr> <tr><td>6</td><td>France</td><td align=right>551</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>537</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>316</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>238</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>208</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>168301</td></tr> <tr><td>2</td><td align=right>2229</td><td align=right>118617</td></tr> <tr><td>3</td><td align=right>2222</td><td align=right>64973</td></tr> <tr><td>4</td><td align=right>515</td><td align=right>61176</td></tr> <tr><td>5</td><td align=right>2337</td><td align=right>57438</td></tr> <tr><td>6</td><td align=right>22323</td><td align=right>55888</td></tr> <tr><td>7</td><td align=right>2252</td><td align=right>52641</td></tr> <tr><td>8</td><td align=right>3011</td><td align=right>43121</td></tr> <tr><td>9</td><td align=right>8000</td><td align=right>38587</td></tr> <tr><td>10</td><td align=right>9922</td><td align=right>38254</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-69949519580168020972026-09-08T16:41:46.658+01:002026-09-08T16:41:46.658+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-07 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17942<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16981<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1403</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1315</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1047</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>986</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>955</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>497</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>359</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>305</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8173</td></tr> <tr><td>2</td><td>China</td><td align=right>2688</td></tr> <tr><td>3</td><td>Germany</td><td align=right>816</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>655</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>647</td></tr> <tr><td>6</td><td>France</td><td align=right>551</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>533</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>313</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>273</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>226</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>136972</td></tr> <tr><td>2</td><td align=right>2222</td><td align=right>36594</td></tr> <tr><td>3</td><td align=right>2254</td><td align=right>22637</td></tr> <tr><td>4</td><td align=right>9922</td><td align=right>22626</td></tr> <tr><td>5</td><td align=right>2229</td><td align=right>21952</td></tr> <tr><td>6</td><td align=right>7822</td><td align=right>20292</td></tr> <tr><td>7</td><td align=right>318</td><td align=right>19462</td></tr> <tr><td>8</td><td align=right>1322</td><td align=right>18313</td></tr> <tr><td>9</td><td align=right>22</td><td align=right>18255</td></tr> <tr><td>10</td><td align=right>278</td><td align=right>17736</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-75011828569326703532026-09-06T15:08:22.858+01:002026-09-06T15:08:22.858+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-05 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19676<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18604<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1429</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1367</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1052</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1010</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>956</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>512</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>359</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>306</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8396</td></tr> <tr><td>2</td><td>China</td><td align=right>2554</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1049</td></tr> <tr><td>4</td><td>Germany</td><td align=right>833</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>692</td></tr> <tr><td>6</td><td>France</td><td align=right>570</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>537</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>376</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>345</td></tr> <tr><td>10</td><td>India</td><td align=right>284</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>200388</td></tr> <tr><td>2</td><td align=right>1963</td><td align=right>68661</td></tr> <tr><td>3</td><td align=right>2222</td><td align=right>63626</td></tr> <tr><td>4</td><td align=right>2463</td><td align=right>56269</td></tr> <tr><td>5</td><td align=right>1311</td><td align=right>50328</td></tr> <tr><td>6</td><td align=right>2562</td><td align=right>46803</td></tr> <tr><td>7</td><td align=right>2225</td><td align=right>44978</td></tr> <tr><td>8</td><td align=right>7999</td><td align=right>44280</td></tr> <tr><td>9</td><td align=right>6379</td><td align=right>42226</td></tr> <tr><td>10</td><td align=right>3338</td><td align=right>41937</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-64722541233857331562026-09-05T14:51:56.377+01:002026-09-05T14:51:56.377+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-04 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19782<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18732<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1295</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1238</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1096</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1055</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>539</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>365</td></tr> <tr><td>9</td><td>UCLOUD-US</td><td align=right>258</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8154</td></tr> <tr><td>2</td><td>China</td><td align=right>2769</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1007</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>805</td></tr> <tr><td>5</td><td>Germany</td><td align=right>761</td></tr> <tr><td>6</td><td>France</td><td align=right>582</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>564</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>412</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>377</td></tr> <tr><td>10</td><td>India</td><td align=right>292</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>213463</td></tr> <tr><td>2</td><td align=right>6379</td><td align=right>83340</td></tr> <tr><td>3</td><td align=right>1963</td><td align=right>80379</td></tr> <tr><td>4</td><td align=right>7018</td><td align=right>58021</td></tr> <tr><td>5</td><td align=right>1991</td><td align=right>57564</td></tr> <tr><td>6</td><td align=right>1311</td><td align=right>57251</td></tr> <tr><td>7</td><td align=right>2222</td><td align=right>44852</td></tr> <tr><td>8</td><td align=right>8082</td><td align=right>43995</td></tr> <tr><td>9</td><td align=right>1226</td><td align=right>39587</td></tr> <tr><td>10</td><td align=right>6123</td><td align=right>37365</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-30619092012625310372026-09-04T15:47:14.105+01:002026-09-04T15:47:14.105+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-03 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20669<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19578<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1379</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1321</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1117</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1057</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>955</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>505</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>371</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>251</td></tr> <tr><td>10</td><td>UCLOUD-US</td><td align=right>247</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9026</td></tr> <tr><td>2</td><td>China</td><td align=right>2946</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1094</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>817</td></tr> <tr><td>5</td><td>Germany</td><td align=right>783</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>597</td></tr> <tr><td>7</td><td>France</td><td align=right>577</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>382</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>308</td></tr> <tr><td>10</td><td>India</td><td align=right>294</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>147882</td></tr> <tr><td>2</td><td align=right>1963</td><td align=right>73833</td></tr> <tr><td>3</td><td align=right>1208</td><td align=right>69939</td></tr> <tr><td>4</td><td align=right>1311</td><td align=right>56418</td></tr> <tr><td>5</td><td align=right>6379</td><td align=right>50873</td></tr> <tr><td>6</td><td align=right>3338</td><td align=right>47654</td></tr> <tr><td>7</td><td align=right>2178</td><td align=right>45846</td></tr> <tr><td>8</td><td align=right>9011</td><td align=right>42006</td></tr> <tr><td>9</td><td align=right>8082</td><td align=right>41259</td></tr> <tr><td>10</td><td align=right>1443</td><td align=right>40181</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-17959143081283771552026-09-03T14:20:43.070+01:002026-09-03T14:20:43.070+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-02 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20833<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19790<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1426</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1365</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1145</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1049</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>956</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>526</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>300</td></tr> <tr><td>10</td><td>UCLOUD-US</td><td align=right>255</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8502</td></tr> <tr><td>2</td><td>China</td><td align=right>3190</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1302</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>840</td></tr> <tr><td>5</td><td>Germany</td><td align=right>810</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>608</td></tr> <tr><td>7</td><td>France</td><td align=right>590</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>384</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>303</td></tr> <tr><td>10</td><td>India</td><td align=right>303</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>117646</td></tr> <tr><td>2</td><td align=right>8843</td><td align=right>36116</td></tr> <tr><td>3</td><td align=right>1212</td><td align=right>34701</td></tr> <tr><td>4</td><td align=right>6379</td><td align=right>29383</td></tr> <tr><td>5</td><td align=right>3520</td><td align=right>27469</td></tr> <tr><td>6</td><td align=right>5721</td><td align=right>26717</td></tr> <tr><td>7</td><td align=right>4444</td><td align=right>24334</td></tr> <tr><td>8</td><td align=right>6018</td><td align=right>23129</td></tr> <tr><td>9</td><td align=right>3338</td><td align=right>21385</td></tr> <tr><td>10</td><td align=right>808</td><td align=right>21183</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-52086340622196026342026-09-02T14:42:52.255+01:002026-09-02T14:42:52.255+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-01 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 23107<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21687<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1536</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1395</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1022</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>955</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>920</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>580</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>366</td></tr> <tr><td>9</td><td>CMNET</td><td align=right>318</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>299</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9348</td></tr> <tr><td>2</td><td>China</td><td align=right>4091</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1309</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>895</td></tr> <tr><td>5</td><td>Germany</td><td align=right>820</td></tr> <tr><td>6</td><td>France</td><td align=right>585</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>580</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>416</td></tr> <tr><td>9</td><td>India</td><td align=right>348</td></tr> <tr><td>10</td><td>European Union</td><td align=right>342</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>165084</td></tr> <tr><td>2</td><td align=right>5721</td><td align=right>29855</td></tr> <tr><td>3</td><td align=right>3001</td><td align=right>28426</td></tr> <tr><td>4</td><td align=right>4172</td><td align=right>28206</td></tr> <tr><td>5</td><td align=right>8786</td><td align=right>26218</td></tr> <tr><td>6</td><td align=right>1234</td><td align=right>25691</td></tr> <tr><td>7</td><td align=right>3913</td><td align=right>24683</td></tr> <tr><td>8</td><td align=right>7236</td><td align=right>23997</td></tr> <tr><td>9</td><td align=right>3242</td><td align=right>22297</td></tr> <tr><td>10</td><td align=right>6018</td><td align=right>21807</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-68559449707648257852026-09-02T14:37:04.706+01:002026-09-15T15:53:49.534+01:00To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:<div>為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：</div><div><br /></div> <div>Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;</div><div>第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；</div> <div>Column 2: Zombie IP;</div><div>第2欄：該殭屍電腦的IP位址；</div> <div>Column 3: TCP destination port number scanned by the zombie.</div><div>第3欄：該殭屍電腦所掃描的TCP埠號。</div><div><br /></div> <div>Join the "<a href="https://t.me/szipl">Suspected Zombie IP List</a>" Telegram channel to get notified when the latest data are ready for download.</div><div>想在第一時間取得資料下載網址？請加入<a href="https://t.me/szipl">Suspected Zombie IP List</a>的Telegram頻道。</div><div><br /></div> <div>Here are the download links of the daily zombie IP lists for September 2026 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):</div><div>以下是2026年09月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：</div><div><br /></div> <div>09/01: <a href="https://www.mediafire.com/file/1h25ad6wbu1f84l/260901_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 0d3372ce48c42f4a36cce4173969dd91</div> <div>09/02: <a href="https://www.mediafire.com/file/ydwmg2t3s7gl1hq/260902_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: d27bc38145680f35ee0d15b1e5a92d6f</div> <div>09/03: <a href="https://www.mediafire.com/file/nz6gcjqynbharra/260903_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 8aefb0d4ae98df003e5480cfd8b64eda</div> <div>09/04: <a href="https://www.mediafire.com/file/ucfsxxgg4opvzas/260904_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 61a37de9f9c9d00bb4dbf609667dd6c0</div> <div>09/05: <a href="https://www.mediafire.com/file/nqu7v5rf4t2saml/260905_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: f1558f655f73e861acd16eac05869f2c</div> <div>09/07: <a href="https://www.mediafire.com/file/22zg93spbe1iwbv/260907_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 5672d364c00ef0d30f4d9538f9395adc</div> <div>09/08: <a href="https://www.mediafire.com/file/p1tz1e1j29q83wc/260908_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: e5c1b54a3167ee2430021edea31fa239</div> <div>09/09: <a href="https://www.mediafire.com/file/z4sum8kk9k7w0y8/260909_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: e4d4a3bfccd7f1ffcff2874fbd546f25</div> <div>09/10: <a href="https://www.mediafire.com/file/aokx3lldmpg3606/260910_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: ee02a604c5b25c0985c19f2c72f2ab84</div> <div>09/11: <a href="https://www.mediafire.com/file/e1dyes5chs9y3qe/260911_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: a078b697988111a17e1f1d2a2ec91033</div> <div>09/12: <a href="https://www.mediafire.com/file/ulufxcs3tkm5udk/260912_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 0831737aff898a76a00289daadc96ef9</div> <div>09/13: <a href="https://www.mediafire.com/file/xeees1if26rmkb7/260913_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: af07853e195ca848455286d7df905dfa</div> <div>09/14: <a href="https://www.mediafire.com/file/0gvhpzzqb7cptk9/260914_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: a350c457c20c681a5c2b7f4f68281588</div> <div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-72171252079325053142026-09-01T15:00:44.538+01:002026-09-01T15:00:44.538+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-31 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21741<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20675<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1373</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1366</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1177</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1058</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>952</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>535</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>9</td><td>UCLOUD-US</td><td align=right>247</td></tr> <tr><td>10</td><td>Stella-IT-KRF</td><td align=right>242</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8704</td></tr> <tr><td>2</td><td>China</td><td align=right>3837</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1285</td></tr> <tr><td>4</td><td>Germany</td><td align=right>933</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>828</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>580</td></tr> <tr><td>7</td><td>France</td><td align=right>566</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>403</td></tr> <tr><td>9</td><td>India</td><td align=right>309</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>302</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>171801</td></tr> <tr><td>2</td><td align=right>3030</td><td align=right>52924</td></tr> <tr><td>3</td><td align=right>1111</td><td align=right>46587</td></tr> <tr><td>4</td><td align=right>3740</td><td align=right>40595</td></tr> <tr><td>5</td><td align=right>4704</td><td align=right>38627</td></tr> <tr><td>6</td><td align=right>2758</td><td align=right>34956</td></tr> <tr><td>7</td><td align=right>3990</td><td align=right>31476</td></tr> <tr><td>8</td><td align=right>3493</td><td align=right>30289</td></tr> <tr><td>9</td><td align=right>3302</td><td align=right>30157</td></tr> <tr><td>10</td><td align=right>1022</td><td align=right>29610</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-69463262546554226082026-08-31T16:01:15.048+01:002026-08-31T16:01:15.048+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-30 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 22192<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21125<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1398</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1311</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1172</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1045</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>954</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>541</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>9</td><td>UCLOUD-US</td><td align=right>258</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8957</td></tr> <tr><td>2</td><td>China</td><td align=right>4110</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1288</td></tr> <tr><td>4</td><td>Germany</td><td align=right>986</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>853</td></tr> <tr><td>6</td><td>France</td><td align=right>570</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>551</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>382</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>302</td></tr> <tr><td>10</td><td>European Union</td><td align=right>287</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>175796</td></tr> <tr><td>2</td><td align=right>1111</td><td align=right>93916</td></tr> <tr><td>3</td><td align=right>7722</td><td align=right>67183</td></tr> <tr><td>4</td><td align=right>2396</td><td align=right>53871</td></tr> <tr><td>5</td><td align=right>3030</td><td align=right>53810</td></tr> <tr><td>6</td><td align=right>3332</td><td align=right>38989</td></tr> <tr><td>7</td><td align=right>5085</td><td align=right>38771</td></tr> <tr><td>8</td><td align=right>2095</td><td align=right>38363</td></tr> <tr><td>9</td><td align=right>1994</td><td align=right>37870</td></tr> <tr><td>10</td><td align=right>2165</td><td align=right>35402</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-76673429171389449402026-08-30T13:05:04.637+01:002026-08-30T13:05:04.637+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-29 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20867<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19727<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1337</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1307</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1074</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1021</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>956</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>514</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>275</td></tr> <tr><td>10</td><td>UCLOUD-US</td><td align=right>271</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7966</td></tr> <tr><td>2</td><td>China</td><td align=right>4180</td></tr> <tr><td>3</td><td>Germany</td><td align=right>1028</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>986</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>732</td></tr> <tr><td>6</td><td>France</td><td align=right>584</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>505</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>396</td></tr> <tr><td>9</td><td>India</td><td align=right>299</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>289</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>179682</td></tr> <tr><td>2</td><td align=right>1111</td><td align=right>98425</td></tr> <tr><td>3</td><td align=right>3030</td><td align=right>45218</td></tr> <tr><td>4</td><td align=right>7722</td><td align=right>44076</td></tr> <tr><td>5</td><td align=right>3332</td><td align=right>42183</td></tr> <tr><td>6</td><td align=right>2095</td><td align=right>39794</td></tr> <tr><td>7</td><td align=right>2396</td><td align=right>37096</td></tr> <tr><td>8</td><td align=right>1122</td><td align=right>35577</td></tr> <tr><td>9</td><td align=right>5133</td><td align=right>34614</td></tr> <tr><td>10</td><td align=right>2387</td><td align=right>29552</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-52232493860005237862026-08-29T15:44:36.327+01:002026-08-29T15:44:36.327+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-28 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21635<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20413<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1409</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1320</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1134</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1020</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>955</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>474</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>373</td></tr> <tr><td>9</td><td>UCLOUD-US</td><td align=right>255</td></tr> <tr><td>10</td><td>cloud</td><td align=right>247</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8267</td></tr> <tr><td>2</td><td>China</td><td align=right>4117</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1139</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>809</td></tr> <tr><td>5</td><td>Germany</td><td align=right>780</td></tr> <tr><td>6</td><td>France</td><td align=right>613</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>551</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>400</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>321</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>315</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>232508</td></tr> <tr><td>2</td><td align=right>1122</td><td align=right>84468</td></tr> <tr><td>3</td><td align=right>2225</td><td align=right>54931</td></tr> <tr><td>4</td><td align=right>2095</td><td align=right>47122</td></tr> <tr><td>5</td><td align=right>1667</td><td align=right>33924</td></tr> <tr><td>6</td><td align=right>2343</td><td align=right>29019</td></tr> <tr><td>7</td><td align=right>3358</td><td align=right>28427</td></tr> <tr><td>8</td><td align=right>2396</td><td align=right>28050</td></tr> <tr><td>9</td><td align=right>3332</td><td align=right>26525</td></tr> <tr><td>10</td><td align=right>2168</td><td align=right>26147</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-42340148099967044972026-08-28T17:23:44.480+01:002026-08-28T17:23:44.480+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-27 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 22679<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21479<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1531</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1272</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1120</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1022</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>6</td><td>CLOUDFLARENET</td><td align=right>675</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>442</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>10</td><td>UCLOUD-US</td><td align=right>273</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9697</td></tr> <tr><td>2</td><td>China</td><td align=right>3817</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>987</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>779</td></tr> <tr><td>5</td><td>Germany</td><td align=right>760</td></tr> <tr><td>6</td><td>France</td><td align=right>615</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>556</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>409</td></tr> <tr><td>9</td><td>India</td><td align=right>343</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>336</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>172650</td></tr> <tr><td>2</td><td align=right>1122</td><td align=right>82642</td></tr> <tr><td>3</td><td align=right>2225</td><td align=right>57357</td></tr> <tr><td>4</td><td align=right>7001</td><td align=right>49230</td></tr> <tr><td>5</td><td align=right>5431</td><td align=right>38211</td></tr> <tr><td>6</td><td align=right>2095</td><td align=right>37209</td></tr> <tr><td>7</td><td align=right>50100</td><td align=right>35731</td></tr> <tr><td>8</td><td align=right>1523</td><td align=right>35108</td></tr> <tr><td>9</td><td align=right>1880</td><td align=right>32408</td></tr> <tr><td>10</td><td align=right>5361</td><td align=right>32178</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-44074765567949088892026-08-27T16:14:16.092+01:002026-08-27T16:14:16.092+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-26 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18542<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17638<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1181</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1143</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1042</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>1011</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>958</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>340</td></tr> <tr><td>9</td><td>UCLOUD-US</td><td align=right>278</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7705</td></tr> <tr><td>2</td><td>China</td><td align=right>3277</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1123</td></tr> <tr><td>4</td><td>Germany</td><td align=right>680</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>562</td></tr> <tr><td>6</td><td>France</td><td align=right>551</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>544</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>348</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>256</td></tr> <tr><td>10</td><td>India</td><td align=right>255</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>146401</td></tr> <tr><td>2</td><td align=right>50100</td><td align=right>96219</td></tr> <tr><td>3</td><td align=right>7227</td><td align=right>92888</td></tr> <tr><td>4</td><td align=right>1122</td><td align=right>74559</td></tr> <tr><td>5</td><td align=right>4600</td><td align=right>63669</td></tr> <tr><td>6</td><td align=right>1076</td><td align=right>61976</td></tr> <tr><td>7</td><td align=right>8103</td><td align=right>60564</td></tr> <tr><td>8</td><td align=right>6558</td><td align=right>48233</td></tr> <tr><td>9</td><td align=right>7163</td><td align=right>48192</td></tr> <tr><td>10</td><td align=right>9214</td><td align=right>47821</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-32998642287179662222026-08-26T14:05:48.121+01:002026-08-26T14:05:48.121+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-25 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18709<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17833<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>INFRAWATCH</td><td align=right>1159</td></tr> <tr><td>2</td><td>GOOGLE-CLOUD</td><td align=right>1036</td></tr> <tr><td>3</td><td>MSFT</td><td align=right>1018</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>1005</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>370</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>357</td></tr> <tr><td>9</td><td>UCLOUD-US</td><td align=right>280</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8148</td></tr> <tr><td>2</td><td>China</td><td align=right>3271</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1028</td></tr> <tr><td>4</td><td>Germany</td><td align=right>695</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>574</td></tr> <tr><td>6</td><td>France</td><td align=right>540</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>532</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>332</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>287</td></tr> <tr><td>10</td><td>India</td><td align=right>243</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>3764</td><td align=right>122478</td></tr> <tr><td>2</td><td align=right>69</td><td align=right>100518</td></tr> <tr><td>3</td><td align=right>9280</td><td align=right>83766</td></tr> <tr><td>4</td><td align=right>5361</td><td align=right>78810</td></tr> <tr><td>5</td><td align=right>9592</td><td align=right>77746</td></tr> <tr><td>6</td><td align=right>7588</td><td align=right>71325</td></tr> <tr><td>7</td><td align=right>7967</td><td align=right>68873</td></tr> <tr><td>8</td><td align=right>9123</td><td align=right>66482</td></tr> <tr><td>9</td><td align=right>8081</td><td align=right>64586</td></tr> <tr><td>10</td><td align=right>6506</td><td align=right>63401</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-8614278184905382832026-08-25T14:03:05.110+01:002026-08-25T14:03:05.110+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-24 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18571<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17462<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1045</td></tr> <tr><td>2</td><td>GOOGLE-CLOUD</td><td align=right>1039</td></tr> <tr><td>3</td><td>MSFT</td><td align=right>1033</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>958</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>918</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>382</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>374</td></tr> <tr><td>9</td><td>UCLOUD-US</td><td align=right>275</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8028</td></tr> <tr><td>2</td><td>China</td><td align=right>3115</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1145</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>610</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>579</td></tr> <tr><td>6</td><td>France</td><td align=right>564</td></tr> <tr><td>7</td><td>Germany</td><td align=right>417</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>306</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>264</td></tr> <tr><td>10</td><td>Ukraine</td><td align=right>220</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>1483</td><td align=right>134405</td></tr> <tr><td>2</td><td align=right>1057</td><td align=right>97325</td></tr> <tr><td>3</td><td align=right>8912</td><td align=right>77749</td></tr> <tr><td>4</td><td align=right>69</td><td align=right>67092</td></tr> <tr><td>5</td><td align=right>5900</td><td align=right>66998</td></tr> <tr><td>6</td><td align=right>9022</td><td align=right>66773</td></tr> <tr><td>7</td><td align=right>3700</td><td align=right>55879</td></tr> <tr><td>8</td><td align=right>9090</td><td align=right>53661</td></tr> <tr><td>9</td><td align=right>3764</td><td align=right>53607</td></tr> <tr><td>10</td><td align=right>8118</td><td align=right>53294</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-79274803072364780212026-08-24T12:50:06.625+01:002026-08-24T12:50:06.625+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-23 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19325<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18348<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>INFRAWATCH</td><td align=right>1159</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1080</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1048</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>991</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>395</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>367</td></tr> <tr><td>9</td><td>UCLOUD-US</td><td align=right>265</td></tr> <tr><td>10</td><td>cloud</td><td align=right>245</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8257</td></tr> <tr><td>2</td><td>China</td><td align=right>3463</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1067</td></tr> <tr><td>4</td><td>Germany</td><td align=right>691</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>624</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>556</td></tr> <tr><td>7</td><td>France</td><td align=right>549</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>340</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>313</td></tr> <tr><td>10</td><td>Ukraine</td><td align=right>230</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>4076</td><td align=right>54791</td></tr> <tr><td>2</td><td align=right>9022</td><td align=right>52641</td></tr> <tr><td>3</td><td align=right>5900</td><td align=right>51710</td></tr> <tr><td>4</td><td align=right>9090</td><td align=right>48890</td></tr> <tr><td>5</td><td align=right>8162</td><td align=right>48128</td></tr> <tr><td>6</td><td align=right>8472</td><td align=right>46338</td></tr> <tr><td>7</td><td align=right>1217</td><td align=right>45358</td></tr> <tr><td>8</td><td align=right>3700</td><td align=right>45019</td></tr> <tr><td>9</td><td align=right>1483</td><td align=right>44940</td></tr> <tr><td>10</td><td align=right>333</td><td align=right>42870</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-28581235263595475642026-08-23T14:58:50.687+01:002026-08-23T14:58:50.688+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-22 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17756<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16790<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>INFRAWATCH</td><td align=right>1088</td></tr> <tr><td>2</td><td>GOOGLE-CLOUD</td><td align=right>1050</td></tr> <tr><td>3</td><td>MSFT</td><td align=right>1030</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>1007</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>365</td></tr> <tr><td>9</td><td>UCLOUD-US</td><td align=right>264</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7388</td></tr> <tr><td>2</td><td>China</td><td align=right>3136</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>962</td></tr> <tr><td>4</td><td>Germany</td><td align=right>600</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>587</td></tr> <tr><td>6</td><td>France</td><td align=right>551</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>545</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>349</td></tr> <tr><td>9</td><td>India</td><td align=right>249</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>243</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>100356</td></tr> <tr><td>2</td><td align=right>1217</td><td align=right>63785</td></tr> <tr><td>3</td><td align=right>9389</td><td align=right>53072</td></tr> <tr><td>4</td><td align=right>6018</td><td align=right>40466</td></tr> <tr><td>5</td><td align=right>2224</td><td align=right>38114</td></tr> <tr><td>6</td><td align=right>9762</td><td align=right>36882</td></tr> <tr><td>7</td><td align=right>9022</td><td align=right>35685</td></tr> <tr><td>8</td><td align=right>2165</td><td align=right>35596</td></tr> <tr><td>9</td><td align=right>9800</td><td align=right>35402</td></tr> <tr><td>10</td><td align=right>8061</td><td align=right>32105</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-90963586738670226572026-08-22T15:52:10.607+01:002026-08-22T15:52:10.607+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/08/daily-zombie-lists-for-august.html">Daily Zombie IP Lists for August 2026</a>.<br /> detection period: 2026-08-21 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17519<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16558<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>INFRAWATCH</td><td align=right>1057</td></tr> <tr><td>2</td><td>GOOGLE-CLOUD</td><td align=right>1039</td></tr> <tr><td>3</td><td>AL-3</td><td align=right>1008</td></tr> <tr><td>4</td><td>MSFT</td><td align=right>981</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>347</td></tr> <tr><td>9</td><td>UCLOUD-US</td><td align=right>264</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7391</td></tr> <tr><td>2</td><td>China</td><td align=right>3165</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>920</td></tr> <tr><td>4</td><td>Germany</td><td align=right>604</td></tr> <tr><td>5</td><td>France</td><td align=right>550</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>539</td></tr> <tr><td>7</td><td>Singapore</td><td align=right>525</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>340</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>276</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>242</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>119830</td></tr> <tr><td>2</td><td align=right>2025</td><td align=right>48878</td></tr> <tr><td>3</td><td align=right>2224</td><td align=right>36540</td></tr> <tr><td>4</td><td align=right>1217</td><td align=right>31601</td></tr> <tr><td>5</td><td align=right>52200</td><td align=right>27836</td></tr> <tr><td>6</td><td align=right>2165</td><td align=right>27091</td></tr> <tr><td>7</td><td align=right>9022</td><td align=right>26274</td></tr> <tr><td>8</td><td align=right>9389</td><td align=right>25454</td></tr> <tr><td>9</td><td align=right>2923</td><td align=right>24539</td></tr> <tr><td>10</td><td align=right>9762</td><td align=right>23301</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0