tag:blogger.com,1999:blog-67713846313751756792026-10-26T15:48:43.181+00:00Detect botnets from malicious mail, and notify the responsible ISP.Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.comBlogger9500125tag:blogger.com,1999:blog-6771384631375175679.post-62293695127033093752026-10-26T15:48:43.181+00:002026-10-26T15:48:43.181+00:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-25 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21351<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19658<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1462</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1311</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1070</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>922</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>443</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>362</td></tr> <tr><td>8</td><td>DE-ALPHA</td><td align=right>310</td></tr> <tr><td>9</td><td>UCLOUD-HK</td><td align=right>304</td></tr> <tr><td>10</td><td>ALISOFT</td><td align=right>265</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9518</td></tr> <tr><td>2</td><td>China</td><td align=right>3395</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>700</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>693</td></tr> <tr><td>5</td><td>France</td><td align=right>592</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>510</td></tr> <tr><td>7</td><td>Germany</td><td align=right>497</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>373</td></tr> <tr><td>9</td><td>Netherlands</td><td align=right>351</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>322</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>402744</td></tr> <tr><td>2</td><td align=right>2232</td><td align=right>95991</td></tr> <tr><td>3</td><td align=right>3322</td><td align=right>58901</td></tr> <tr><td>4</td><td align=right>2022</td><td align=right>49965</td></tr> <tr><td>5</td><td align=right>9204</td><td align=right>40792</td></tr> <tr><td>6</td><td align=right>2211</td><td align=right>36662</td></tr> <tr><td>7</td><td align=right>2095</td><td align=right>36292</td></tr> <tr><td>8</td><td align=right>2222</td><td align=right>33643</td></tr> <tr><td>9</td><td align=right>6433</td><td align=right>31562</td></tr> <tr><td>10</td><td align=right>9201</td><td align=right>31029</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-13539382745827052252026-10-25T15:39:35.650+00:002026-10-25T15:39:35.650+00:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-24 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19436<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17803<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1463</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1294</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1069</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>905</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>439</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>362</td></tr> <tr><td>8</td><td>DE-ALPHA</td><td align=right>322</td></tr> <tr><td>9</td><td>KORNET-KR</td><td align=right>262</td></tr> <tr><td>10</td><td>ALISOFT</td><td align=right>245</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8277</td></tr> <tr><td>2</td><td>China</td><td align=right>2989</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>659</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>649</td></tr> <tr><td>5</td><td>France</td><td align=right>588</td></tr> <tr><td>6</td><td>Germany</td><td align=right>504</td></tr> <tr><td>7</td><td>South Korea</td><td align=right>410</td></tr> <tr><td>8</td><td>India</td><td align=right>386</td></tr> <tr><td>9</td><td>Netherlands</td><td align=right>355</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>344</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>428258</td></tr> <tr><td>2</td><td align=right>2022</td><td align=right>50662</td></tr> <tr><td>3</td><td align=right>2232</td><td align=right>50231</td></tr> <tr><td>4</td><td align=right>9204</td><td align=right>43562</td></tr> <tr><td>5</td><td align=right>2095</td><td align=right>32898</td></tr> <tr><td>6</td><td align=right>9201</td><td align=right>30808</td></tr> <tr><td>7</td><td align=right>9206</td><td align=right>30411</td></tr> <tr><td>8</td><td align=right>9220</td><td align=right>29936</td></tr> <tr><td>9</td><td align=right>22</td><td align=right>28697</td></tr> <tr><td>10</td><td align=right>6022</td><td align=right>26689</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-38774167067269233092026-10-24T15:28:22.793+01:002026-10-24T15:28:22.793+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-23 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20054<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18397<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1453</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1313</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1076</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>908</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>470</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>361</td></tr> <tr><td>8</td><td>DE-ALPHA</td><td align=right>257</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8943</td></tr> <tr><td>2</td><td>China</td><td align=right>2868</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>806</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>704</td></tr> <tr><td>5</td><td>France</td><td align=right>601</td></tr> <tr><td>6</td><td>Germany</td><td align=right>429</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>414</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>391</td></tr> <tr><td>9</td><td>India</td><td align=right>365</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>354</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>565134</td></tr> <tr><td>2</td><td align=right>2022</td><td align=right>49383</td></tr> <tr><td>3</td><td align=right>9204</td><td align=right>42216</td></tr> <tr><td>4</td><td align=right>9201</td><td align=right>35083</td></tr> <tr><td>5</td><td align=right>9206</td><td align=right>33215</td></tr> <tr><td>6</td><td align=right>9443</td><td align=right>31728</td></tr> <tr><td>7</td><td align=right>2095</td><td align=right>31065</td></tr> <tr><td>8</td><td align=right>9210</td><td align=right>29853</td></tr> <tr><td>9</td><td align=right>9220</td><td align=right>29257</td></tr> <tr><td>10</td><td align=right>9207</td><td align=right>27241</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-30980222704257385032026-10-23T17:09:23.838+01:002026-10-23T17:09:23.839+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-22 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19678<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18086<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1476</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1303</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1070</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>911</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>454</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>8</td><td>ALISOFT</td><td align=right>253</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9368</td></tr> <tr><td>2</td><td>China</td><td align=right>2715</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>727</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>698</td></tr> <tr><td>5</td><td>France</td><td align=right>597</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>385</td></tr> <tr><td>7</td><td>South Korea</td><td align=right>343</td></tr> <tr><td>8</td><td>Netherlands</td><td align=right>332</td></tr> <tr><td>9</td><td>India</td><td align=right>313</td></tr> <tr><td>10</td><td>Germany</td><td align=right>306</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>493321</td></tr> <tr><td>2</td><td align=right>33</td><td align=right>80383</td></tr> <tr><td>3</td><td align=right>212</td><td align=right>50149</td></tr> <tr><td>4</td><td align=right>9204</td><td align=right>46082</td></tr> <tr><td>5</td><td align=right>9922</td><td align=right>39116</td></tr> <tr><td>6</td><td align=right>9201</td><td align=right>32396</td></tr> <tr><td>7</td><td align=right>9210</td><td align=right>31458</td></tr> <tr><td>8</td><td align=right>2095</td><td align=right>30754</td></tr> <tr><td>9</td><td align=right>9206</td><td align=right>30185</td></tr> <tr><td>10</td><td align=right>9443</td><td align=right>29804</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-30516639601670644622026-10-22T16:07:07.894+01:002026-10-22T16:07:07.894+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-21 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19956<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18147<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1509</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1438</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1055</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>905</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>474</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>8</td><td>ALISOFT</td><td align=right>260</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9005</td></tr> <tr><td>2</td><td>China</td><td align=right>3259</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>681</td></tr> <tr><td>4</td><td>France</td><td align=right>600</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>580</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>396</td></tr> <tr><td>7</td><td>South Korea</td><td align=right>376</td></tr> <tr><td>8</td><td>India</td><td align=right>344</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>310</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>295</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>492354</td></tr> <tr><td>2</td><td align=right>212</td><td align=right>62076</td></tr> <tr><td>3</td><td align=right>9204</td><td align=right>50312</td></tr> <tr><td>4</td><td align=right>33</td><td align=right>44150</td></tr> <tr><td>5</td><td align=right>9922</td><td align=right>41121</td></tr> <tr><td>6</td><td align=right>9201</td><td align=right>34118</td></tr> <tr><td>7</td><td align=right>2095</td><td align=right>32349</td></tr> <tr><td>8</td><td align=right>29</td><td align=right>31015</td></tr> <tr><td>9</td><td align=right>7000</td><td align=right>30383</td></tr> <tr><td>10</td><td align=right>9210</td><td align=right>28364</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-75779801371771132922026-10-21T13:17:08.901+01:002026-10-22T16:07:45.070+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-20 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19928<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18270<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1500</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1446</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1067</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>909</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>480</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>374</td></tr> <tr><td>8</td><td>ALISOFT</td><td align=right>279</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9693</td></tr> <tr><td>2</td><td>China</td><td align=right>2836</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>744</td></tr> <tr><td>4</td><td>France</td><td align=right>633</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>586</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>397</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>370</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>302</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>281</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>264</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>456985</td></tr> <tr><td>2</td><td align=right>212</td><td align=right>67435</td></tr> <tr><td>3</td><td align=right>9204</td><td align=right>48163</td></tr> <tr><td>4</td><td align=right>8000</td><td align=right>42350</td></tr> <tr><td>5</td><td align=right>2095</td><td align=right>41164</td></tr> <tr><td>6</td><td align=right>9922</td><td align=right>39189</td></tr> <tr><td>7</td><td align=right>9443</td><td align=right>37373</td></tr> <tr><td>8</td><td align=right>5357</td><td align=right>34109</td></tr> <tr><td>9</td><td align=right>9201</td><td align=right>33449</td></tr> <tr><td>10</td><td align=right>29</td><td align=right>30904</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-22863228799707684982026-10-20T12:56:46.150+01:002026-10-22T16:07:57.517+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-19 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19804<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18055<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1546</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1503</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1060</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>910</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>515</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>359</td></tr> <tr><td>8</td><td>ALISOFT</td><td align=right>270</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9176</td></tr> <tr><td>2</td><td>China</td><td align=right>2902</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>790</td></tr> <tr><td>4</td><td>France</td><td align=right>627</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>550</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>399</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>380</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>297</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>274</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>274</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>394207</td></tr> <tr><td>2</td><td align=right>9204</td><td align=right>44480</td></tr> <tr><td>3</td><td align=right>9443</td><td align=right>43258</td></tr> <tr><td>4</td><td align=right>9922</td><td align=right>38726</td></tr> <tr><td>5</td><td align=right>2095</td><td align=right>38478</td></tr> <tr><td>6</td><td align=right>555</td><td align=right>38059</td></tr> <tr><td>7</td><td align=right>10</td><td align=right>33843</td></tr> <tr><td>8</td><td align=right>5357</td><td align=right>33804</td></tr> <tr><td>9</td><td align=right>29</td><td align=right>33766</td></tr> <tr><td>10</td><td align=right>9201</td><td align=right>31871</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-6407952693191443692026-10-19T16:09:37.750+01:002026-10-22T16:08:10.698+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-18 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18430<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16920<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1471</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1298</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1055</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>909</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>462</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>362</td></tr> <tr><td>8</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> <tr><td>10</td><td>HURRICANE-4</td><td align=right>224</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9385</td></tr> <tr><td>2</td><td>China</td><td align=right>2760</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>650</td></tr> <tr><td>4</td><td>France</td><td align=right>571</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>504</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>370</td></tr> <tr><td>7</td><td>South Korea</td><td align=right>276</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>265</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>210</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>192</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>360442</td></tr> <tr><td>2</td><td align=right>6000</td><td align=right>76765</td></tr> <tr><td>3</td><td align=right>4</td><td align=right>70413</td></tr> <tr><td>4</td><td align=right>9</td><td align=right>67998</td></tr> <tr><td>5</td><td align=right>3</td><td align=right>65526</td></tr> <tr><td>6</td><td align=right>5</td><td align=right>64553</td></tr> <tr><td>7</td><td align=right>8</td><td align=right>62819</td></tr> <tr><td>8</td><td align=right>1</td><td align=right>62432</td></tr> <tr><td>9</td><td align=right>10</td><td align=right>57622</td></tr> <tr><td>10</td><td align=right>2</td><td align=right>56744</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-36833352512898284352026-10-18T14:19:37.379+01:002026-10-22T16:08:25.221+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-17 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 16569<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15159<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1376</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1211</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1059</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>911</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>436</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>359</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>341</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7857</td></tr> <tr><td>2</td><td>China</td><td align=right>2521</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>733</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>611</td></tr> <tr><td>5</td><td>France</td><td align=right>554</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>349</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>306</td></tr> <tr><td>8</td><td>Germany</td><td align=right>199</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>197</td></tr> <tr><td>10</td><td>India</td><td align=right>195</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>243886</td></tr> <tr><td>2</td><td align=right>9204</td><td align=right>46773</td></tr> <tr><td>3</td><td align=right>6000</td><td align=right>44808</td></tr> <tr><td>4</td><td align=right>9202</td><td align=right>39478</td></tr> <tr><td>5</td><td align=right>9201</td><td align=right>39025</td></tr> <tr><td>6</td><td align=right>522</td><td align=right>37991</td></tr> <tr><td>7</td><td align=right>2020</td><td align=right>36775</td></tr> <tr><td>8</td><td align=right>12222</td><td align=right>33684</td></tr> <tr><td>9</td><td align=right>888</td><td align=right>31816</td></tr> <tr><td>10</td><td align=right>9206</td><td align=right>31334</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-5651676665442595562026-10-17T16:14:25.041+01:002026-10-22T16:08:36.624+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-16 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 16646<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15281<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1416</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1250</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1061</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>909</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>401</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>354</td></tr> <tr><td>8</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> <tr><td>10</td><td>CAVISAR-NET1</td><td align=right>234</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8158</td></tr> <tr><td>2</td><td>China</td><td align=right>2350</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>607</td></tr> <tr><td>4</td><td>France</td><td align=right>556</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>537</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>311</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>290</td></tr> <tr><td>8</td><td>Honduras</td><td align=right>242</td></tr> <tr><td>9</td><td>India</td><td align=right>196</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>195</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>305589</td></tr> <tr><td>2</td><td align=right>5471</td><td align=right>59823</td></tr> <tr><td>3</td><td align=right>9204</td><td align=right>54607</td></tr> <tr><td>4</td><td align=right>4117</td><td align=right>49692</td></tr> <tr><td>5</td><td align=right>9201</td><td align=right>48410</td></tr> <tr><td>6</td><td align=right>9220</td><td align=right>46102</td></tr> <tr><td>7</td><td align=right>1159</td><td align=right>43612</td></tr> <tr><td>8</td><td align=right>3382</td><td align=right>43206</td></tr> <tr><td>9</td><td align=right>9202</td><td align=right>41814</td></tr> <tr><td>10</td><td align=right>9210</td><td align=right>38867</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-28902168789173177992026-10-16T15:58:14.432+01:002026-10-22T16:08:48.755+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-15 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17971<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16604<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1419</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1302</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1065</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>909</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>450</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>359</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>283</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8985</td></tr> <tr><td>2</td><td>China</td><td align=right>2713</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>743</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>659</td></tr> <tr><td>5</td><td>France</td><td align=right>543</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>357</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>351</td></tr> <tr><td>8</td><td>Russian Federation</td><td align=right>206</td></tr> <tr><td>9</td><td>India</td><td align=right>206</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>189</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>380487</td></tr> <tr><td>2</td><td align=right>27</td><td align=right>41954</td></tr> <tr><td>3</td><td align=right>2020</td><td align=right>37004</td></tr> <tr><td>4</td><td align=right>9922</td><td align=right>33922</td></tr> <tr><td>5</td><td align=right>12222</td><td align=right>32461</td></tr> <tr><td>6</td><td align=right>9204</td><td align=right>31341</td></tr> <tr><td>7</td><td align=right>2095</td><td align=right>30063</td></tr> <tr><td>8</td><td align=right>444</td><td align=right>28950</td></tr> <tr><td>9</td><td align=right>1463</td><td align=right>28715</td></tr> <tr><td>10</td><td align=right>55555</td><td align=right>28642</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-15105653978879508862026-10-15T14:51:08.818+01:002026-10-22T16:08:59.843+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-14 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18178<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16844<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1411</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1263</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1051</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>911</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>463</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>366</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>263</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8365</td></tr> <tr><td>2</td><td>China</td><td align=right>3388</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>687</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>679</td></tr> <tr><td>5</td><td>France</td><td align=right>542</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>368</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>343</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>253</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>212</td></tr> <tr><td>10</td><td>India</td><td align=right>211</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>456806</td></tr> <tr><td>2</td><td align=right>27</td><td align=right>58550</td></tr> <tr><td>3</td><td align=right>2095</td><td align=right>52961</td></tr> <tr><td>4</td><td align=right>444</td><td align=right>39862</td></tr> <tr><td>5</td><td align=right>2020</td><td align=right>37179</td></tr> <tr><td>6</td><td align=right>1463</td><td align=right>33493</td></tr> <tr><td>7</td><td align=right>12222</td><td align=right>31096</td></tr> <tr><td>8</td><td align=right>7777</td><td align=right>28660</td></tr> <tr><td>9</td><td align=right>8088</td><td align=right>26310</td></tr> <tr><td>10</td><td align=right>4117</td><td align=right>25105</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-50996351165816759552026-10-14T14:59:55.902+01:002026-10-22T16:09:12.092+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-13 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18669<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17339<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1384</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1214</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1055</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>915</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>443</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>372</td></tr> <tr><td>8</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>227</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8922</td></tr> <tr><td>2</td><td>China</td><td align=right>3464</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>667</td></tr> <tr><td>4</td><td>France</td><td align=right>563</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>508</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>361</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>323</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>273</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>233</td></tr> <tr><td>10</td><td>India</td><td align=right>223</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>471329</td></tr> <tr><td>2</td><td align=right>2095</td><td align=right>56966</td></tr> <tr><td>3</td><td align=right>26</td><td align=right>44508</td></tr> <tr><td>4</td><td align=right>444</td><td align=right>39665</td></tr> <tr><td>5</td><td align=right>2020</td><td align=right>36112</td></tr> <tr><td>6</td><td align=right>1463</td><td align=right>32657</td></tr> <tr><td>7</td><td align=right>12222</td><td align=right>30629</td></tr> <tr><td>8</td><td align=right>7777</td><td align=right>27204</td></tr> <tr><td>9</td><td align=right>9011</td><td align=right>25262</td></tr> <tr><td>10</td><td align=right>27</td><td align=right>23665</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-81819080328433464412026-10-13T16:15:06.357+01:002026-10-22T16:09:25.912+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-12 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17911<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16567<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1489</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1301</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1049</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>924</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>422</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>372</td></tr> <tr><td>8</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>230</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8648</td></tr> <tr><td>2</td><td>China</td><td align=right>2811</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>637</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>611</td></tr> <tr><td>5</td><td>France</td><td align=right>568</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>367</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>345</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>279</td></tr> <tr><td>9</td><td>India</td><td align=right>263</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>258</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>402614</td></tr> <tr><td>2</td><td align=right>26</td><td align=right>72812</td></tr> <tr><td>3</td><td align=right>2095</td><td align=right>57855</td></tr> <tr><td>4</td><td align=right>444</td><td align=right>40775</td></tr> <tr><td>5</td><td align=right>2020</td><td align=right>35939</td></tr> <tr><td>6</td><td align=right>1463</td><td align=right>31395</td></tr> <tr><td>7</td><td align=right>7777</td><td align=right>23030</td></tr> <tr><td>8</td><td align=right>8088</td><td align=right>21914</td></tr> <tr><td>9</td><td align=right>22</td><td align=right>18720</td></tr> <tr><td>10</td><td align=right>4117</td><td align=right>18165</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-41450091886353359582026-10-12T16:27:18.922+01:002026-10-22T16:09:36.968+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-11 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17651<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16372<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1393</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1236</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1067</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>923</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>454</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>366</td></tr> <tr><td>8</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>229</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8700</td></tr> <tr><td>2</td><td>China</td><td align=right>2732</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>672</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>652</td></tr> <tr><td>5</td><td>France</td><td align=right>563</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>328</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>303</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>289</td></tr> <tr><td>9</td><td>India</td><td align=right>205</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>198</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>388560</td></tr> <tr><td>2</td><td align=right>1463</td><td align=right>74120</td></tr> <tr><td>3</td><td align=right>2095</td><td align=right>63009</td></tr> <tr><td>4</td><td align=right>4034</td><td align=right>44938</td></tr> <tr><td>5</td><td align=right>4117</td><td align=right>43611</td></tr> <tr><td>6</td><td align=right>2020</td><td align=right>42012</td></tr> <tr><td>7</td><td align=right>1824</td><td align=right>37873</td></tr> <tr><td>8</td><td align=right>12022</td><td align=right>34184</td></tr> <tr><td>9</td><td align=right>2482</td><td align=right>33072</td></tr> <tr><td>10</td><td align=right>8088</td><td align=right>30638</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-62791726985836121522026-10-11T15:15:24.020+01:002026-10-22T16:09:48.805+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-10 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 16871<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15563<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1390</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1243</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1068</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>929</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>437</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>372</td></tr> <tr><td>8</td><td>CMNET</td><td align=right>261</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7841</td></tr> <tr><td>2</td><td>China</td><td align=right>2800</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>663</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>612</td></tr> <tr><td>5</td><td>France</td><td align=right>562</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>361</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>316</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>258</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>213</td></tr> <tr><td>10</td><td>India</td><td align=right>196</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>273818</td></tr> <tr><td>2</td><td align=right>1463</td><td align=right>71695</td></tr> <tr><td>3</td><td align=right>2095</td><td align=right>63567</td></tr> <tr><td>4</td><td align=right>2104</td><td align=right>50030</td></tr> <tr><td>5</td><td align=right>4034</td><td align=right>44142</td></tr> <tr><td>6</td><td align=right>2020</td><td align=right>42273</td></tr> <tr><td>7</td><td align=right>4117</td><td align=right>41734</td></tr> <tr><td>8</td><td align=right>12022</td><td align=right>39384</td></tr> <tr><td>9</td><td align=right>1824</td><td align=right>36866</td></tr> <tr><td>10</td><td align=right>2482</td><td align=right>32817</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-85798834628802851622026-10-10T15:57:17.319+01:002026-10-22T16:10:00.391+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-09 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17079<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15724<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1400</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1243</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1061</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>921</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>402</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>362</td></tr> <tr><td>8</td><td>CMNET</td><td align=right>245</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8017</td></tr> <tr><td>2</td><td>China</td><td align=right>2821</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>701</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>632</td></tr> <tr><td>5</td><td>France</td><td align=right>560</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>349</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>296</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>225</td></tr> <tr><td>9</td><td>India</td><td align=right>221</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>220</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>234929</td></tr> <tr><td>2</td><td align=right>55555</td><td align=right>124538</td></tr> <tr><td>3</td><td align=right>2095</td><td align=right>104570</td></tr> <tr><td>4</td><td align=right>1463</td><td align=right>68593</td></tr> <tr><td>5</td><td align=right>2104</td><td align=right>48123</td></tr> <tr><td>6</td><td align=right>2020</td><td align=right>41782</td></tr> <tr><td>7</td><td align=right>4034</td><td align=right>41563</td></tr> <tr><td>8</td><td align=right>4117</td><td align=right>39967</td></tr> <tr><td>9</td><td align=right>12022</td><td align=right>39482</td></tr> <tr><td>10</td><td align=right>8088</td><td align=right>38782</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-64507908400987998972026-10-08T15:27:07.973+01:002026-10-22T16:10:13.715+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-07 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18294<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16884<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1477</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1262</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1047</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>932</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>454</td></tr> <tr><td>7</td><td>INFRAWATCH</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>414</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8321</td></tr> <tr><td>2</td><td>China</td><td align=right>3336</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>744</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>633</td></tr> <tr><td>5</td><td>France</td><td align=right>574</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>374</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>305</td></tr> <tr><td>8</td><td>Germany</td><td align=right>268</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>249</td></tr> <tr><td>10</td><td>India</td><td align=right>213</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>188432</td></tr> <tr><td>2</td><td align=right>1463</td><td align=right>67460</td></tr> <tr><td>3</td><td align=right>4117</td><td align=right>63017</td></tr> <tr><td>4</td><td align=right>2095</td><td align=right>59139</td></tr> <tr><td>5</td><td align=right>1024</td><td align=right>50690</td></tr> <tr><td>6</td><td align=right>2104</td><td align=right>48131</td></tr> <tr><td>7</td><td align=right>4025</td><td align=right>44826</td></tr> <tr><td>8</td><td align=right>4034</td><td align=right>41555</td></tr> <tr><td>9</td><td align=right>6701</td><td align=right>41114</td></tr> <tr><td>10</td><td align=right>12022</td><td align=right>39440</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-78968734571302184322026-10-07T15:32:22.549+01:002026-10-22T16:10:29.344+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-06 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20769<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19415<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1506</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1304</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1059</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>934</td></tr> <tr><td>5</td><td>CLOUDFLARENET</td><td align=right>785</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>458</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>374</td></tr> <tr><td>9</td><td>INFRAWATCH</td><td align=right>316</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>251</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9598</td></tr> <tr><td>2</td><td>China</td><td align=right>4571</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>692</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>667</td></tr> <tr><td>5</td><td>France</td><td align=right>550</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>319</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>303</td></tr> <tr><td>8</td><td>Germany</td><td align=right>288</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>215</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>209</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>163082</td></tr> <tr><td>2</td><td align=right>2095</td><td align=right>84347</td></tr> <tr><td>3</td><td align=right>322</td><td align=right>43478</td></tr> <tr><td>4</td><td align=right>12022</td><td align=right>39591</td></tr> <tr><td>5</td><td align=right>6924</td><td align=right>38338</td></tr> <tr><td>6</td><td align=right>6600</td><td align=right>33664</td></tr> <tr><td>7</td><td align=right>23</td><td align=right>32945</td></tr> <tr><td>8</td><td align=right>55555</td><td align=right>27624</td></tr> <tr><td>9</td><td align=right>9339</td><td align=right>26747</td></tr> <tr><td>10</td><td align=right>4117</td><td align=right>25448</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-18092845294775454772026-10-06T15:20:56.021+01:002026-10-22T16:10:39.949+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-05 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19714<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18338<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1552</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1274</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1070</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>933</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>456</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>374</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>321</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8572</td></tr> <tr><td>2</td><td>China</td><td align=right>4060</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>692</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>687</td></tr> <tr><td>5</td><td>France</td><td align=right>636</td></tr> <tr><td>6</td><td>Germany</td><td align=right>449</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>325</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>314</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>261</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>223</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>63937</td></tr> <tr><td>2</td><td align=right>1023</td><td align=right>52757</td></tr> <tr><td>3</td><td align=right>12022</td><td align=right>39362</td></tr> <tr><td>4</td><td align=right>2095</td><td align=right>32176</td></tr> <tr><td>5</td><td align=right>23</td><td align=right>32082</td></tr> <tr><td>6</td><td align=right>7093</td><td align=right>24697</td></tr> <tr><td>7</td><td align=right>8025</td><td align=right>22927</td></tr> <tr><td>8</td><td align=right>8030</td><td align=right>22832</td></tr> <tr><td>9</td><td align=right>7094</td><td align=right>22468</td></tr> <tr><td>10</td><td align=right>8027</td><td align=right>22466</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-85326591408200980142026-10-05T14:15:50.374+01:002026-10-22T16:10:51.297+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-04 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20010<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18603<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1530</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1372</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1058</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>940</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>462</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>8</td><td>DE-ALPHA</td><td align=right>327</td></tr> <tr><td>9</td><td>INFRAWATCH</td><td align=right>312</td></tr> <tr><td>10</td><td>ALISOFT</td><td align=right>255</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9093</td></tr> <tr><td>2</td><td>China</td><td align=right>3842</td></tr> <tr><td>3</td><td>Germany</td><td align=right>705</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>673</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>647</td></tr> <tr><td>6</td><td>France</td><td align=right>634</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>332</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>258</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>241</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>228</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>93307</td></tr> <tr><td>2</td><td align=right>1023</td><td align=right>85355</td></tr> <tr><td>3</td><td align=right>2095</td><td align=right>55226</td></tr> <tr><td>4</td><td align=right>8020</td><td align=right>37130</td></tr> <tr><td>5</td><td align=right>12022</td><td align=right>35927</td></tr> <tr><td>6</td><td align=right>2425</td><td align=right>33196</td></tr> <tr><td>7</td><td align=right>23</td><td align=right>32089</td></tr> <tr><td>8</td><td align=right>7094</td><td align=right>31214</td></tr> <tr><td>9</td><td align=right>8030</td><td align=right>30084</td></tr> <tr><td>10</td><td align=right>888</td><td align=right>28524</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-58021207816422898132026-10-04T14:15:26.300+01:002026-10-22T16:11:03.538+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-03 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18422<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17082<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1504</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1359</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1058</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>467</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>8</td><td>DE-ALPHA</td><td align=right>327</td></tr> <tr><td>9</td><td>INFRAWATCH</td><td align=right>311</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7960</td></tr> <tr><td>2</td><td>China</td><td align=right>3843</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>671</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>626</td></tr> <tr><td>5</td><td>France</td><td align=right>575</td></tr> <tr><td>6</td><td>Germany</td><td align=right>574</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>336</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>231</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>216</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>204</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>149339</td></tr> <tr><td>2</td><td align=right>2095</td><td align=right>52657</td></tr> <tr><td>3</td><td align=right>1023</td><td align=right>47935</td></tr> <tr><td>4</td><td align=right>8020</td><td align=right>34769</td></tr> <tr><td>5</td><td align=right>7094</td><td align=right>30565</td></tr> <tr><td>6</td><td align=right>8030</td><td align=right>29622</td></tr> <tr><td>7</td><td align=right>888</td><td align=right>29549</td></tr> <tr><td>8</td><td align=right>23</td><td align=right>28863</td></tr> <tr><td>9</td><td align=right>8025</td><td align=right>28577</td></tr> <tr><td>10</td><td align=right>22</td><td align=right>28421</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-12306524838708600932026-10-03T15:55:50.040+01:002026-10-22T16:11:15.265+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-02 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19350<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18045<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1486</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1339</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1064</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>461</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>334</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>311</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8518</td></tr> <tr><td>2</td><td>China</td><td align=right>3944</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>698</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>622</td></tr> <tr><td>5</td><td>Germany</td><td align=right>572</td></tr> <tr><td>6</td><td>France</td><td align=right>567</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>337</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>310</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>278</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>234</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>145830</td></tr> <tr><td>2</td><td align=right>55555</td><td align=right>104578</td></tr> <tr><td>3</td><td align=right>2095</td><td align=right>46038</td></tr> <tr><td>4</td><td align=right>2022</td><td align=right>35511</td></tr> <tr><td>5</td><td align=right>8020</td><td align=right>33233</td></tr> <tr><td>6</td><td align=right>888</td><td align=right>31741</td></tr> <tr><td>7</td><td align=right>23</td><td align=right>30707</td></tr> <tr><td>8</td><td align=right>7094</td><td align=right>30136</td></tr> <tr><td>9</td><td align=right>22</td><td align=right>28992</td></tr> <tr><td>10</td><td align=right>8088</td><td align=right>28481</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-53119684000863822882026-10-03T08:09:53.836+01:002026-10-22T16:11:28.453+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for October 2026</a>.<br /> detection period: 2026-10-01 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20262<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18984<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1512</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1333</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1067</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>459</td></tr> <tr><td>7</td><td>INFRAWATCH</td><td align=right>388</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>328</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9054</td></tr> <tr><td>2</td><td>China</td><td align=right>4072</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>779</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>633</td></tr> <tr><td>5</td><td>France</td><td align=right>574</td></tr> <tr><td>6</td><td>Germany</td><td align=right>566</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>334</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>290</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>287</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>256</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>202712</td></tr> <tr><td>2</td><td align=right>55555</td><td align=right>135917</td></tr> <tr><td>3</td><td align=right>2095</td><td align=right>49484</td></tr> <tr><td>4</td><td align=right>8020</td><td align=right>31453</td></tr> <tr><td>5</td><td align=right>8027</td><td align=right>31287</td></tr> <tr><td>6</td><td align=right>888</td><td align=right>31181</td></tr> <tr><td>7</td><td align=right>7100</td><td align=right>30217</td></tr> <tr><td>8</td><td align=right>7094</td><td align=right>29132</td></tr> <tr><td>9</td><td align=right>8025</td><td align=right>29097</td></tr> <tr><td>10</td><td align=right>22</td><td align=right>27852</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-52460791961331557972026-10-02T08:08:53.145+01:002026-10-26T07:32:24.291+00:00To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:<div>為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：</div><div><br /></div> <div>Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;</div><div>第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；</div> <div>Column 2: Zombie IP;</div><div>第2欄：該殭屍電腦的IP位址；</div> <div>Column 3: TCP destination port number scanned by the zombie.</div><div>第3欄：該殭屍電腦所掃描的TCP埠號。</div><div><br /></div> <div>Join the "<a href="https://t.me/szipl">Suspected Zombie IP List</a>" Telegram channel to get notified when the latest data are ready for download.</div><div>想在第一時間取得資料下載網址？請加入<a href="https://t.me/szipl">Suspected Zombie IP List</a>的Telegram頻道。</div><div><br /></div> <div>Here are the download links of the daily zombie IP lists for October 2026 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):</div><div>以下是2026年10月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：</div><div><br /></div> <div>10/01: <a href="https://www.mediafire.com/file/jh2xnplrkcck012/261001_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 5d358b944bd0b78319ad645fc1e8850e</div> <div>10/02: <a href="https://www.mediafire.com/file/un4ut3mjc0s6uzh/261002_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: a06b53bcb61aaadab5de1b9daf419e4e</div> <div>10/03: <a href="https://www.mediafire.com/file/2negg0qahcjc4wa/261003_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 11289315c81ea37a5e2c9be66244e844</div> <div>10/04: <a href="https://www.mediafire.com/file/gs6opbb2r4xkzdf/261004_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 165d5387e04a5930d5e441d28141d4c0</div> <div>10/05: <a href="https://www.mediafire.com/file/30ovufoybskwwae/261005_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: d26b2b6c5ab4e7a6910737822f23e074</div> <div>10/06: <a href="https://www.mediafire.com/file/afkudsyj6aagw9z/261006_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 0bc58bafe8285e073a95da78175d7615</div> <div>10/07: <a href="https://www.mediafire.com/file/pb4j681mekf9v1g/261007_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: c30201c280004e224d7a4f830b7633a0</div> <div>10/08: <a href="https://www.mediafire.com/file/fvij2dnumou4m2u/261008_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 1b565aa8a3c71b485cfb022c4de1ad4b</div> <div>10/09: <a href="https://www.mediafire.com/file/2btl37lptipfdb7/261009_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: d9011af32b451ad960c9fac156c3f841</div> <div>10/10: <a href="https://www.mediafire.com/file/ze2w29s1a47powj/261010_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 75b8cde5f2de114da1e1fb44799d2af4</div> <div>10/11: <a href="https://www.mediafire.com/file/d97zci1y5zv7fns/261011_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: e20ddad83cd844dd4bcae12615e19338</div> <div>10/12: <a href="https://www.mediafire.com/file/7nw0rjyqeo740zd/261012_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 67033fcd5e8e9cc329dae0fa3011ba49</div> <div>10/13: <a href="https://www.mediafire.com/file/ax3ifa5cfealq87/261013_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 05805ff14fd4f56c8c7aefb0fb3598af</div> <div>10/14: <a href="https://www.mediafire.com/file/9clix2z6dke0v4r/261014_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: b737a9dcc735b54f30a40a2d1c0c6d35</div> <div>10/15: <a href="https://www.mediafire.com/file/tpf6yccw4kpbfn7/261015_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 7a70a47f0e6f41247d21f4d9954b1a48</div> <div>10/16: <a href="https://www.mediafire.com/file/ypx259cnc7s8pmt/261016_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 57e638fe291211cf8844f64b74474be6</div> <div>10/17: <a href="https://www.mediafire.com/file/ua93onattn85rnv/261017_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 07f2e70a35548540e858ed15c8e54b6d</div> <div>10/18: <a href="https://www.mediafire.com/file/6s90lwzrsjlnzoo/261018_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 72dfa23df8db200a011527721028c265</div> <div>10/19: <a href="https://www.mediafire.com/file/6g3ftiyu85wnd4u/261019_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: c69a299317005e90475e6f2ddcdf11d9</div> <div>10/20: <a href="https://www.mediafire.com/file/kkd01bui2akzcxr/261020_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 90a68e9910202ed1046f747d2ce16c93</div> <div>10/21: <a href="https://www.mediafire.com/file/z5ff0mnjlzl2sc7/261021_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 0fffd03edc6db147ab2bf87b2f685db2</div> <div>10/22: <a href="https://www.mediafire.com/file/f33y7okt5qxkvhu/261022_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: eca18ff406ee272abca6f3c1c5ef09f1</div> <div>10/23: <a href="https://www.mediafire.com/file/jyybu4gt0i2lox0/261023_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 9a5dea63c03758dd4921af06c35c9a00</div> <div>10/24: <a href="https://www.mediafire.com/file/c11472ex2ejp82a/261024_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 27e9e248a3c74c56247cc867f0bed046</div> <div>10/25: <a href="https://www.mediafire.com/file/jqk81d8fsm670rv/261025_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 4ede597126fe44da19bfc1552dacba0e</div> <div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0