tag:blogger.com,1999:blog-67713846313751756792026-04-17T13:10:26.811+01:00Detect botnets from malicious mail, and notify the responsible ISP.Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.comBlogger9307125tag:blogger.com,1999:blog-6771384631375175679.post-58790188996071067222026-04-17T13:10:00.002+01:002026-04-17T13:10:26.595+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-16 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19067<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18077<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1368</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1367</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1009</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>951</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>428</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>367</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>343</td></tr> <tr><td>9</td><td>cloud</td><td align=right>328</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>252</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8485</td></tr> <tr><td>2</td><td>China</td><td align=right>4678</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>763</td></tr> <tr><td>4</td><td>France</td><td align=right>603</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>360</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>351</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>279</td></tr> <tr><td>8</td><td>India</td><td align=right>276</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>251</td></tr> <tr><td>10</td><td>Germany</td><td align=right>251</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>355592</td></tr> <tr><td>2</td><td align=right>2222</td><td align=right>115091</td></tr> <tr><td>3</td><td align=right>7777</td><td align=right>106000</td></tr> <tr><td>4</td><td align=right>8085</td><td align=right>94842</td></tr> <tr><td>5</td><td align=right>9110</td><td align=right>86223</td></tr> <tr><td>6</td><td align=right>2232</td><td align=right>81571</td></tr> <tr><td>7</td><td align=right>23401</td><td align=right>68250</td></tr> <tr><td>8</td><td align=right>2288</td><td align=right>63004</td></tr> <tr><td>9</td><td align=right>992</td><td align=right>57187</td></tr> <tr><td>10</td><td align=right>5431</td><td align=right>54939</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-6659330556061693082026-04-16T11:23:00.001+01:002026-04-16T11:23:35.843+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-15 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 16139<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15135<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1386</td></tr> <tr><td>2</td><td>GOOGLE-CLOUD</td><td align=right>1003</td></tr> <tr><td>3</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>891</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>6</td><td>CENSY</td><td align=right>372</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>355</td></tr> <tr><td>8</td><td>cloud</td><td align=right>332</td></tr> <tr><td>9</td><td>ASEPL-SG</td><td align=right>267</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>250</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7677</td></tr> <tr><td>2</td><td>China</td><td align=right>3003</td></tr> <tr><td>3</td><td>France</td><td align=right>587</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>491</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>357</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>343</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>280</td></tr> <tr><td>8</td><td>India</td><td align=right>260</td></tr> <tr><td>9</td><td>Viet Nam</td><td align=right>238</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>235</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>7777</td><td align=right>411683</td></tr> <tr><td>2</td><td align=right>8015</td><td align=right>330945</td></tr> <tr><td>3</td><td align=right>5900</td><td align=right>298423</td></tr> <tr><td>4</td><td align=right>9443</td><td align=right>297709</td></tr> <tr><td>5</td><td align=right>2095</td><td align=right>246598</td></tr> <tr><td>6</td><td align=right>2222</td><td align=right>171490</td></tr> <tr><td>7</td><td align=right>5357</td><td align=right>115521</td></tr> <tr><td>8</td><td align=right>8000</td><td align=right>86595</td></tr> <tr><td>9</td><td align=right>8085</td><td align=right>83589</td></tr> <tr><td>10</td><td align=right>2232</td><td align=right>78208</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-40970871089769986472026-04-15T11:31:00.000+01:002026-04-15T11:31:07.617+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-14 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17455<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16757<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1379</td></tr> <tr><td>2</td><td>GOOGLE-CLOUD</td><td align=right>1002</td></tr> <tr><td>3</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>925</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>6</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>351</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>292</td></tr> <tr><td>9</td><td>cloud</td><td align=right>290</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>256</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8225</td></tr> <tr><td>2</td><td>China</td><td align=right>3397</td></tr> <tr><td>3</td><td>France</td><td align=right>552</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>506</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>372</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>360</td></tr> <tr><td>7</td><td>Germany</td><td align=right>307</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>293</td></tr> <tr><td>9</td><td>United Kingdom</td><td align=right>268</td></tr> <tr><td>10</td><td>Viet Nam</td><td align=right>254</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>7777</td><td align=right>489497</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>305280</td></tr> <tr><td>3</td><td align=right>9443</td><td align=right>238549</td></tr> <tr><td>4</td><td align=right>8015</td><td align=right>238146</td></tr> <tr><td>5</td><td align=right>2095</td><td align=right>191655</td></tr> <tr><td>6</td><td align=right>2222</td><td align=right>116843</td></tr> <tr><td>7</td><td align=right>8082</td><td align=right>105349</td></tr> <tr><td>8</td><td align=right>25</td><td align=right>102724</td></tr> <tr><td>9</td><td align=right>8000</td><td align=right>79587</td></tr> <tr><td>10</td><td align=right>2232</td><td align=right>76403</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-78205174460770896832026-04-14T16:31:00.001+01:002026-04-14T16:31:25.999+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-13 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17557<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16838<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1391</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1148</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1004</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>6</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>360</td></tr> <tr><td>8</td><td>cloud</td><td align=right>340</td></tr> <tr><td>9</td><td>ASEPL-SG</td><td align=right>313</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>258</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7884</td></tr> <tr><td>2</td><td>China</td><td align=right>3904</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>640</td></tr> <tr><td>4</td><td>France</td><td align=right>550</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>361</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>338</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>301</td></tr> <tr><td>8</td><td>India</td><td align=right>288</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>258</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>246</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>346775</td></tr> <tr><td>2</td><td align=right>7777</td><td align=right>157905</td></tr> <tr><td>3</td><td align=right>2095</td><td align=right>142649</td></tr> <tr><td>4</td><td align=right>9443</td><td align=right>106940</td></tr> <tr><td>5</td><td align=right>5901</td><td align=right>68145</td></tr> <tr><td>6</td><td align=right>2288</td><td align=right>62980</td></tr> <tr><td>7</td><td align=right>2206</td><td align=right>62242</td></tr> <tr><td>8</td><td align=right>2222</td><td align=right>58353</td></tr> <tr><td>9</td><td align=right>4322</td><td align=right>56679</td></tr> <tr><td>10</td><td align=right>2232</td><td align=right>55898</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-74746417209814917722026-04-13T16:52:00.001+01:002026-04-13T16:52:21.096+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-12 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17959<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16880<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1392</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1315</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1007</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>949</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>450</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>365</td></tr> <tr><td>9</td><td>UCLOUD-HK</td><td align=right>253</td></tr> <tr><td>10</td><td>AT-88-Z</td><td align=right>247</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8754</td></tr> <tr><td>2</td><td>China</td><td align=right>3627</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>678</td></tr> <tr><td>4</td><td>France</td><td align=right>553</td></tr> <tr><td>5</td><td>Germany</td><td align=right>380</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>378</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>352</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>226</td></tr> <tr><td>9</td><td>United Kingdom</td><td align=right>214</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>211</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>403081</td></tr> <tr><td>2</td><td align=right>51005</td><td align=right>189328</td></tr> <tr><td>3</td><td align=right>2078</td><td align=right>153670</td></tr> <tr><td>4</td><td align=right>2095</td><td align=right>82307</td></tr> <tr><td>5</td><td align=right>7777</td><td align=right>76612</td></tr> <tr><td>6</td><td align=right>2222</td><td align=right>74474</td></tr> <tr><td>7</td><td align=right>2288</td><td align=right>64073</td></tr> <tr><td>8</td><td align=right>8015</td><td align=right>62307</td></tr> <tr><td>9</td><td align=right>2206</td><td align=right>62013</td></tr> <tr><td>10</td><td align=right>6022</td><td align=right>61801</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-91261503640502923312026-04-12T16:45:00.001+01:002026-04-12T16:45:13.898+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-11 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 16854<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15984<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1366</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1282</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1004</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>479</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>375</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>9</td><td>cloud</td><td align=right>327</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>259</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7855</td></tr> <tr><td>2</td><td>China</td><td align=right>3567</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>831</td></tr> <tr><td>4</td><td>France</td><td align=right>542</td></tr> <tr><td>5</td><td>Germany</td><td align=right>375</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>354</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>348</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>249</td></tr> <tr><td>9</td><td>United Kingdom</td><td align=right>226</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>217</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>424324</td></tr> <tr><td>2</td><td align=right>888</td><td align=right>306750</td></tr> <tr><td>3</td><td align=right>51005</td><td align=right>208858</td></tr> <tr><td>4</td><td align=right>8088</td><td align=right>137190</td></tr> <tr><td>5</td><td align=right>2078</td><td align=right>118368</td></tr> <tr><td>6</td><td align=right>5357</td><td align=right>93142</td></tr> <tr><td>7</td><td align=right>2288</td><td align=right>63120</td></tr> <tr><td>8</td><td align=right>7777</td><td align=right>61224</td></tr> <tr><td>9</td><td align=right>2206</td><td align=right>61191</td></tr> <tr><td>10</td><td align=right>2222</td><td align=right>52601</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-7463398575369938552026-04-11T14:44:00.002+01:002026-04-11T14:44:46.236+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-10 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17575<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16680<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1393</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1388</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1000</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>480</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>380</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>370</td></tr> <tr><td>9</td><td>cloud</td><td align=right>338</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>268</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8231</td></tr> <tr><td>2</td><td>China</td><td align=right>3793</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>804</td></tr> <tr><td>4</td><td>France</td><td align=right>544</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>372</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>361</td></tr> <tr><td>7</td><td>Germany</td><td align=right>275</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>255</td></tr> <tr><td>9</td><td>United Kingdom</td><td align=right>249</td></tr> <tr><td>10</td><td>India</td><td align=right>216</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>517780</td></tr> <tr><td>2</td><td align=right>888</td><td align=right>192702</td></tr> <tr><td>3</td><td align=right>4222</td><td align=right>106156</td></tr> <tr><td>4</td><td align=right>51005</td><td align=right>105279</td></tr> <tr><td>5</td><td align=right>8088</td><td align=right>89904</td></tr> <tr><td>6</td><td align=right>2078</td><td align=right>66807</td></tr> <tr><td>7</td><td align=right>8085</td><td align=right>66538</td></tr> <tr><td>8</td><td align=right>2288</td><td align=right>63358</td></tr> <tr><td>9</td><td align=right>2231</td><td align=right>61086</td></tr> <tr><td>10</td><td align=right>5357</td><td align=right>60994</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-73900753677644765412026-04-10T15:27:00.001+01:002026-04-10T15:27:04.877+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-09 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 16893<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15969<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1355</td></tr> <tr><td>2</td><td>GOOGLE-CLOUD</td><td align=right>1008</td></tr> <tr><td>3</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>927</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>6</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>371</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>368</td></tr> <tr><td>9</td><td>cloud</td><td align=right>308</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>262</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8125</td></tr> <tr><td>2</td><td>China</td><td align=right>3126</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>649</td></tr> <tr><td>4</td><td>France</td><td align=right>562</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>413</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>362</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>269</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>240</td></tr> <tr><td>9</td><td>India</td><td align=right>231</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>230</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>535292</td></tr> <tr><td>2</td><td align=right>5357</td><td align=right>151774</td></tr> <tr><td>3</td><td align=right>888</td><td align=right>112720</td></tr> <tr><td>4</td><td align=right>4222</td><td align=right>106771</td></tr> <tr><td>5</td><td align=right>8088</td><td align=right>100730</td></tr> <tr><td>6</td><td align=right>8085</td><td align=right>72132</td></tr> <tr><td>7</td><td align=right>9443</td><td align=right>69783</td></tr> <tr><td>8</td><td align=right>2078</td><td align=right>61845</td></tr> <tr><td>9</td><td align=right>8000</td><td align=right>59818</td></tr> <tr><td>10</td><td align=right>2231</td><td align=right>59327</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-2730858187051848152026-04-09T12:54:00.001+01:002026-04-09T12:54:56.909+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-08 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 16994<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16140<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1387</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1251</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1005</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>514</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>378</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>377</td></tr> <tr><td>9</td><td>cloud</td><td align=right>322</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>263</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7707</td></tr> <tr><td>2</td><td>China</td><td align=right>3716</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>762</td></tr> <tr><td>4</td><td>France</td><td align=right>555</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>371</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>360</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>281</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>227</td></tr> <tr><td>9</td><td>United Kingdom</td><td align=right>224</td></tr> <tr><td>10</td><td>India</td><td align=right>211</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>496622</td></tr> <tr><td>2</td><td align=right>8088</td><td align=right>148239</td></tr> <tr><td>3</td><td align=right>4222</td><td align=right>110715</td></tr> <tr><td>4</td><td align=right>5357</td><td align=right>76138</td></tr> <tr><td>5</td><td align=right>2095</td><td align=right>68995</td></tr> <tr><td>6</td><td align=right>2078</td><td align=right>67603</td></tr> <tr><td>7</td><td align=right>51005</td><td align=right>57728</td></tr> <tr><td>8</td><td align=right>8085</td><td align=right>56508</td></tr> <tr><td>9</td><td align=right>2231</td><td align=right>55837</td></tr> <tr><td>10</td><td align=right>9022</td><td align=right>44702</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-76841599377085350912026-04-08T11:36:00.000+01:002026-04-08T11:36:00.645+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-07 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18149<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17239<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1361</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1304</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1034</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>547</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>447</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>370</td></tr> <tr><td>9</td><td>cloud</td><td align=right>331</td></tr> <tr><td>10</td><td>LINODE-US</td><td align=right>274</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8807</td></tr> <tr><td>2</td><td>China</td><td align=right>3311</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>939</td></tr> <tr><td>4</td><td>France</td><td align=right>572</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>390</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>364</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>288</td></tr> <tr><td>8</td><td>India</td><td align=right>243</td></tr> <tr><td>9</td><td>United Kingdom</td><td align=right>226</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>224</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>473362</td></tr> <tr><td>2</td><td align=right>4222</td><td align=right>124464</td></tr> <tr><td>3</td><td align=right>25</td><td align=right>104550</td></tr> <tr><td>4</td><td align=right>2271</td><td align=right>96650</td></tr> <tr><td>5</td><td align=right>2205</td><td align=right>61562</td></tr> <tr><td>6</td><td align=right>2231</td><td align=right>54311</td></tr> <tr><td>7</td><td align=right>0</td><td align=right>46447</td></tr> <tr><td>8</td><td align=right>58603</td><td align=right>45142</td></tr> <tr><td>9</td><td align=right>2222</td><td align=right>39907</td></tr> <tr><td>10</td><td align=right>8088</td><td align=right>34455</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-4886522708590217092026-04-07T16:25:00.002+01:002026-04-07T16:25:40.111+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-06 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17243<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16206<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1346</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1255</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1011</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>429</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>374</td></tr> <tr><td>9</td><td>cloud</td><td align=right>270</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>260</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7884</td></tr> <tr><td>2</td><td>China</td><td align=right>3404</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>771</td></tr> <tr><td>4</td><td>France</td><td align=right>560</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>369</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>332</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>274</td></tr> <tr><td>8</td><td>India</td><td align=right>251</td></tr> <tr><td>9</td><td>Germany</td><td align=right>238</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>227</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>376942</td></tr> <tr><td>2</td><td align=right>25</td><td align=right>195262</td></tr> <tr><td>3</td><td align=right>4222</td><td align=right>106780</td></tr> <tr><td>4</td><td align=right>0</td><td align=right>104984</td></tr> <tr><td>5</td><td align=right>2271</td><td align=right>99310</td></tr> <tr><td>6</td><td align=right>58603</td><td align=right>98417</td></tr> <tr><td>7</td><td align=right>2095</td><td align=right>92856</td></tr> <tr><td>8</td><td align=right>2205</td><td align=right>91534</td></tr> <tr><td>9</td><td align=right>2222</td><td align=right>72345</td></tr> <tr><td>10</td><td align=right>7777</td><td align=right>62709</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-74619335278569785392026-04-06T10:21:00.000+01:002026-04-06T10:21:41.068+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-05 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17759<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16846<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1351</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1351</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1005</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>951</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>547</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>370</td></tr> <tr><td>9</td><td>cloud</td><td align=right>321</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8631</td></tr> <tr><td>2</td><td>China</td><td align=right>3370</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>927</td></tr> <tr><td>4</td><td>France</td><td align=right>555</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>368</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>344</td></tr> <tr><td>7</td><td>United Kingdom</td><td align=right>257</td></tr> <tr><td>8</td><td>Germany</td><td align=right>244</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>231</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>220</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>425806</td></tr> <tr><td>2</td><td align=right>25</td><td align=right>157491</td></tr> <tr><td>3</td><td align=right>58603</td><td align=right>114872</td></tr> <tr><td>4</td><td align=right>2095</td><td align=right>106440</td></tr> <tr><td>5</td><td align=right>2205</td><td align=right>102238</td></tr> <tr><td>6</td><td align=right>7777</td><td align=right>92993</td></tr> <tr><td>7</td><td align=right>9443</td><td align=right>79257</td></tr> <tr><td>8</td><td align=right>8000</td><td align=right>69799</td></tr> <tr><td>9</td><td align=right>8088</td><td align=right>65344</td></tr> <tr><td>10</td><td align=right>1012</td><td align=right>60520</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-79740604400434332992026-04-05T16:11:00.000+01:002026-04-05T16:11:13.993+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-04 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17286<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16167<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1375</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1274</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1002</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>534</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>385</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>9</td><td>UCLOUD-HK</td><td align=right>259</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>239</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7992</td></tr> <tr><td>2</td><td>China</td><td align=right>3348</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>856</td></tr> <tr><td>4</td><td>France</td><td align=right>563</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>367</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>356</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>270</td></tr> <tr><td>8</td><td>United Kingdom</td><td align=right>257</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>213</td></tr> <tr><td>10</td><td>Germany</td><td align=right>207</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>452983</td></tr> <tr><td>2</td><td align=right>2205</td><td align=right>104790</td></tr> <tr><td>3</td><td align=right>888</td><td align=right>73035</td></tr> <tr><td>4</td><td align=right>8000</td><td align=right>64207</td></tr> <tr><td>5</td><td align=right>7777</td><td align=right>62753</td></tr> <tr><td>6</td><td align=right>25</td><td align=right>62302</td></tr> <tr><td>7</td><td align=right>8085</td><td align=right>51000</td></tr> <tr><td>8</td><td align=right>8088</td><td align=right>50717</td></tr> <tr><td>9</td><td align=right>9443</td><td align=right>50012</td></tr> <tr><td>10</td><td align=right>5357</td><td align=right>49846</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-82073209863677855022026-04-04T14:24:00.001+01:002026-04-04T14:24:13.807+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-03 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17544<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16616<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1356</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1304</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1012</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>506</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>370</td></tr> <tr><td>9</td><td>cloud</td><td align=right>327</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>265</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8385</td></tr> <tr><td>2</td><td>China</td><td align=right>3174</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>820</td></tr> <tr><td>4</td><td>France</td><td align=right>553</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>366</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>331</td></tr> <tr><td>7</td><td>Germany</td><td align=right>252</td></tr> <tr><td>8</td><td>United Kingdom</td><td align=right>251</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>249</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>232</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>448419</td></tr> <tr><td>2</td><td align=right>888</td><td align=right>299465</td></tr> <tr><td>3</td><td align=right>2222</td><td align=right>165406</td></tr> <tr><td>4</td><td align=right>8000</td><td align=right>143359</td></tr> <tr><td>5</td><td align=right>7777</td><td align=right>109951</td></tr> <tr><td>6</td><td align=right>2256</td><td align=right>97351</td></tr> <tr><td>7</td><td align=right>2238</td><td align=right>94542</td></tr> <tr><td>8</td><td align=right>2205</td><td align=right>93336</td></tr> <tr><td>9</td><td align=right>2000</td><td align=right>89980</td></tr> <tr><td>10</td><td align=right>25</td><td align=right>81697</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-28340808462982061672026-04-03T12:48:00.001+01:002026-04-03T12:48:21.341+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-02 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18339<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17393<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1382</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1316</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1013</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>542</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>402</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>383</td></tr> <tr><td>9</td><td>cloud</td><td align=right>324</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>261</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9068</td></tr> <tr><td>2</td><td>China</td><td align=right>3369</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>923</td></tr> <tr><td>4</td><td>France</td><td align=right>549</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>375</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>371</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>311</td></tr> <tr><td>8</td><td>United Kingdom</td><td align=right>255</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>227</td></tr> <tr><td>10</td><td>India</td><td align=right>226</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>390007</td></tr> <tr><td>2</td><td align=right>7777</td><td align=right>191896</td></tr> <tr><td>3</td><td align=right>8000</td><td align=right>178771</td></tr> <tr><td>4</td><td align=right>8015</td><td align=right>111911</td></tr> <tr><td>5</td><td align=right>25</td><td align=right>104287</td></tr> <tr><td>6</td><td align=right>888</td><td align=right>99236</td></tr> <tr><td>7</td><td align=right>2238</td><td align=right>94483</td></tr> <tr><td>8</td><td align=right>2205</td><td align=right>89895</td></tr> <tr><td>9</td><td align=right>2256</td><td align=right>81641</td></tr> <tr><td>10</td><td align=right>2222</td><td align=right>75326</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-9747840196440966442026-04-02T11:00:00.001+01:002026-04-02T11:00:07.617+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-01 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18154<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17161<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1360</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1341</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1005</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>658</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>412</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>9</td><td>cloud</td><td align=right>289</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>262</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8352</td></tr> <tr><td>2</td><td>China</td><td align=right>3612</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1007</td></tr> <tr><td>4</td><td>France</td><td align=right>538</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>376</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>318</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>293</td></tr> <tr><td>8</td><td>Germany</td><td align=right>277</td></tr> <tr><td>9</td><td>India</td><td align=right>237</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>235</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>407272</td></tr> <tr><td>2</td><td align=right>888</td><td align=right>311121</td></tr> <tr><td>3</td><td align=right>7777</td><td align=right>265530</td></tr> <tr><td>4</td><td align=right>51005</td><td align=right>184929</td></tr> <tr><td>5</td><td align=right>8000</td><td align=right>168306</td></tr> <tr><td>6</td><td align=right>25</td><td align=right>168240</td></tr> <tr><td>7</td><td align=right>2000</td><td align=right>156083</td></tr> <tr><td>8</td><td align=right>8015</td><td align=right>139461</td></tr> <tr><td>9</td><td align=right>5357</td><td align=right>131503</td></tr> <tr><td>10</td><td align=right>2205</td><td align=right>92308</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-53792434593560028612026-04-02T10:47:00.016+01:002026-04-17T13:05:47.585+01:00To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:<div>為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：</div><div><br /></div> <div>Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;</div><div>第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；</div> <div>Column 2: Zombie IP;</div><div>第2欄：該殭屍電腦的IP位址；</div> <div>Column 3: TCP destination port number scanned by the zombie.</div><div>第3欄：該殭屍電腦所掃描的TCP埠號。</div><div><br /></div> <div>Join the "<a href="https://t.me/szipl">Suspected Zombie IP List</a>" Telegram channel to get notified when the latest data are ready for download.</div><div>想在第一時間取得資料下載網址？請加入<a href="https://t.me/szipl">Suspected Zombie IP List</a>的Telegram頻道。</div><div><br /></div> <div>Here are the download links of the daily zombie IP lists for April 2026 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):</div><div>以下是2026年04月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：</div><div><br /></div> <div>04/01: <a href="https://www.mediafire.com/file/s0586vo2qdnp7l0/260401_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 9c741e33e224c4aa90559ca99b0bfa5c</div> <div>04/02: <a href="https://www.mediafire.com/file/d3z3nrx0x71qp97/260402_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: b10181c543be6c6f70816f73cfa083f1</div> <div>04/03: <a href="https://www.mediafire.com/file/6gn2rywwe96ut41/260403_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: b1ec6f8358168bd5dec14005ef53a504</div> <div>04/04: <a href="https://www.mediafire.com/file/iuqohbu1pakogh8/260404_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 952e4fb63533040a19e393bccc7783ca</div> <div>04/05: <a href="https://www.mediafire.com/file/6fc1ja6tjzh7bg6/260405_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 71d54fec2bbc9d8678dba2c7732a83c9</div> <div>04/06: <a href="https://www.mediafire.com/file/wf4vvh51lpzmai7/260406_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 32e461467c78ce13e97efc15e520fd70</div> <div>04/07: <a href="https://www.mediafire.com/file/pv3f4ebsyb4pbmj/260407_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 77fb6cad7129fe6d4aeefa064ffc3b09</div> <div>04/08: <a href="https://www.mediafire.com/file/dp2hzxphvt8yz1u/260408_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 1d2e3974b7a4b0546903d82716c9d1fb</div> <div>04/09: <a href="https://www.mediafire.com/file/6rfcsa8tnexic1v/260409_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 54b9728d195e1e209178cd4b3fb0baae</div> <div>04/10: <a href="https://www.mediafire.com/file/je17pmizz74zlxr/260410_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 0a8442cc7ba8ad721b1aec6fcd7a8262</div> <div>04/11: <a href="https://www.mediafire.com/file/yilqk53t2f4v3zk/260411_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 1ee5233235790bbf93d09681f9685a27</div> <div>04/12: <a href="https://www.mediafire.com/file/1lsq63tb3dlktgu/260412_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 4c61c8ccdaca36f83fa0bd416b089bf4</div> <div>04/13: <a href="https://www.mediafire.com/file/3z21r04j61grw3k/260413_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 63b58f45fd92e66c5ea82a02d125fabb</div> <div>04/14: <a href="https://www.mediafire.com/file/um4322czxxmay1x/260414_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 930b481c8d7976797d00569341e9b3d6</div> <div>04/15: <a href="https://www.mediafire.com/file/kz0dbo5g0tzsvwt/260415_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 2660dad2921ec4cb0d1a4da431c3799c</div> <div>04/16: <a href="https://www.mediafire.com/file/p7702589ezyvd6q/260416_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 4ae2cc1be3024d84090ccbe985666472</div> <div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-216991136357967872026-04-01T11:29:00.003+01:002026-04-01T11:29:59.732+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/03/daily-zombie-lists-for-march.html">Daily Zombie IP Lists for March 2026</a>.<br /> detection period: 2026-03-31 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18882<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17943<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1433</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1372</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1008</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>951</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>936</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>399</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>384</td></tr> <tr><td>9</td><td>cloud</td><td align=right>307</td></tr> <tr><td>10</td><td>ALISOFT</td><td align=right>305</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8782</td></tr> <tr><td>2</td><td>China</td><td align=right>3662</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1410</td></tr> <tr><td>4</td><td>France</td><td align=right>479</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>366</td></tr> <tr><td>6</td><td>Indonesia</td><td align=right>341</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>306</td></tr> <tr><td>8</td><td>United Kingdom</td><td align=right>252</td></tr> <tr><td>9</td><td>India</td><td align=right>251</td></tr> <tr><td>10</td><td>Germany</td><td align=right>230</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>296031</td></tr> <tr><td>2</td><td align=right>888</td><td align=right>150718</td></tr> <tr><td>3</td><td align=right>7777</td><td align=right>123334</td></tr> <tr><td>4</td><td align=right>9011</td><td align=right>95558</td></tr> <tr><td>5</td><td align=right>2205</td><td align=right>91224</td></tr> <tr><td>6</td><td align=right>2000</td><td align=right>89413</td></tr> <tr><td>7</td><td align=right>51005</td><td align=right>85457</td></tr> <tr><td>8</td><td align=right>8000</td><td align=right>79299</td></tr> <tr><td>9</td><td align=right>2298</td><td align=right>70834</td></tr> <tr><td>10</td><td align=right>5357</td><td align=right>66204</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-11332850191411889322026-03-31T16:44:00.000+01:002026-03-31T16:44:02.719+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/03/daily-zombie-lists-for-march.html">Daily Zombie IP Lists for March 2026</a>.<br /> detection period: 2026-03-30 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18014<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17075<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1568</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1333</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1000</td></tr> <tr><td>4</td><td>ASEPL-SG</td><td align=right>962</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>6</td><td>VOLCANO-ENGINE</td><td align=right>404</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>9</td><td>cloud</td><td align=right>328</td></tr> <tr><td>10</td><td>ALISOFT</td><td align=right>303</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8259</td></tr> <tr><td>2</td><td>China</td><td align=right>3612</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1315</td></tr> <tr><td>4</td><td>France</td><td align=right>466</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>363</td></tr> <tr><td>6</td><td>Indonesia</td><td align=right>336</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>278</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>243</td></tr> <tr><td>9</td><td>United Kingdom</td><td align=right>232</td></tr> <tr><td>10</td><td>India</td><td align=right>229</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>320107</td></tr> <tr><td>2</td><td align=right>2254</td><td align=right>101987</td></tr> <tr><td>3</td><td align=right>2205</td><td align=right>98719</td></tr> <tr><td>4</td><td align=right>5025</td><td align=right>91756</td></tr> <tr><td>5</td><td align=right>7722</td><td align=right>74956</td></tr> <tr><td>6</td><td align=right>6666</td><td align=right>46098</td></tr> <tr><td>7</td><td align=right>9901</td><td align=right>45918</td></tr> <tr><td>8</td><td align=right>5522</td><td align=right>41546</td></tr> <tr><td>9</td><td align=right>7777</td><td align=right>37622</td></tr> <tr><td>10</td><td align=right>5902</td><td align=right>36633</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-8689461462162936312026-03-30T12:20:00.001+01:002026-03-30T12:20:26.412+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/03/daily-zombie-lists-for-march.html">Daily Zombie IP Lists for March 2026</a>.<br /> detection period: 2026-03-29 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19154<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18111<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1917</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1334</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1005</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>951</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>818</td></tr> <tr><td>6</td><td>VOLCANO-ENGINE</td><td align=right>401</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>357</td></tr> <tr><td>9</td><td>ALISOFT</td><td align=right>310</td></tr> <tr><td>10</td><td>cloud</td><td align=right>292</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9480</td></tr> <tr><td>2</td><td>China</td><td align=right>3482</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1290</td></tr> <tr><td>4</td><td>France</td><td align=right>466</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>357</td></tr> <tr><td>6</td><td>Indonesia</td><td align=right>320</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>308</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>258</td></tr> <tr><td>9</td><td>United Kingdom</td><td align=right>235</td></tr> <tr><td>10</td><td>India</td><td align=right>216</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>363825</td></tr> <tr><td>2</td><td align=right>6622</td><td align=right>99014</td></tr> <tr><td>3</td><td align=right>2254</td><td align=right>83769</td></tr> <tr><td>4</td><td align=right>6666</td><td align=right>74683</td></tr> <tr><td>5</td><td align=right>6005</td><td align=right>51827</td></tr> <tr><td>6</td><td align=right>57622</td><td align=right>48945</td></tr> <tr><td>7</td><td align=right>5522</td><td align=right>44017</td></tr> <tr><td>8</td><td align=right>5902</td><td align=right>38020</td></tr> <tr><td>9</td><td align=right>5357</td><td align=right>36421</td></tr> <tr><td>10</td><td align=right>7722</td><td align=right>36328</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-19135699594853454042026-03-29T14:25:00.001+01:002026-03-29T14:25:11.342+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/03/daily-zombie-lists-for-march.html">Daily Zombie IP Lists for March 2026</a>.<br /> detection period: 2026-03-28 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18437<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17515<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1720</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1337</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1001</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>946</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>900</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>367</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>361</td></tr> <tr><td>9</td><td>cloud</td><td align=right>320</td></tr> <tr><td>10</td><td>ALISOFT</td><td align=right>302</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8522</td></tr> <tr><td>2</td><td>China</td><td align=right>3562</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1361</td></tr> <tr><td>4</td><td>France</td><td align=right>471</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>368</td></tr> <tr><td>6</td><td>Indonesia</td><td align=right>335</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>323</td></tr> <tr><td>8</td><td>India</td><td align=right>279</td></tr> <tr><td>9</td><td>Germany</td><td align=right>234</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>227</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>364311</td></tr> <tr><td>2</td><td align=right>5357</td><td align=right>90539</td></tr> <tr><td>3</td><td align=right>6622</td><td align=right>79226</td></tr> <tr><td>4</td><td align=right>6666</td><td align=right>75269</td></tr> <tr><td>5</td><td align=right>2078</td><td align=right>65142</td></tr> <tr><td>6</td><td align=right>2299</td><td align=right>60987</td></tr> <tr><td>7</td><td align=right>9443</td><td align=right>55634</td></tr> <tr><td>8</td><td align=right>2222</td><td align=right>52667</td></tr> <tr><td>9</td><td align=right>8082</td><td align=right>52300</td></tr> <tr><td>10</td><td align=right>51005</td><td align=right>51784</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-83572950235845622152026-03-28T12:42:00.000+00:002026-03-28T12:42:04.113+00:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/03/daily-zombie-lists-for-march.html">Daily Zombie IP Lists for March 2026</a>.<br /> detection period: 2026-03-27 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19056<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17909<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1865</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1341</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1002</td></tr> <tr><td>4</td><td>ASEPL-SG</td><td align=right>975</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>410</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>369</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>364</td></tr> <tr><td>9</td><td>ALISOFT</td><td align=right>297</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>263</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8447</td></tr> <tr><td>2</td><td>China</td><td align=right>3817</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1298</td></tr> <tr><td>4</td><td>France</td><td align=right>483</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>374</td></tr> <tr><td>6</td><td>Indonesia</td><td align=right>361</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>333</td></tr> <tr><td>8</td><td>India</td><td align=right>292</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>271</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>221</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>405824</td></tr> <tr><td>2</td><td align=right>2078</td><td align=right>101370</td></tr> <tr><td>3</td><td align=right>2204</td><td align=right>89787</td></tr> <tr><td>4</td><td align=right>8015</td><td align=right>88288</td></tr> <tr><td>5</td><td align=right>8082</td><td align=right>74027</td></tr> <tr><td>6</td><td align=right>2222</td><td align=right>73805</td></tr> <tr><td>7</td><td align=right>8000</td><td align=right>71101</td></tr> <tr><td>8</td><td align=right>9443</td><td align=right>65225</td></tr> <tr><td>9</td><td align=right>2299</td><td align=right>60553</td></tr> <tr><td>10</td><td align=right>2255</td><td align=right>60228</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-88649733584523324792026-03-27T10:47:00.001+00:002026-03-27T10:47:03.395+00:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/03/daily-zombie-lists-for-march.html">Daily Zombie IP Lists for March 2026</a>.<br /> detection period: 2026-03-26 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19503<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18529<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1863</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1350</td></tr> <tr><td>3</td><td>ASEPL-SG</td><td align=right>980</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>926</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>910</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>366</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>365</td></tr> <tr><td>9</td><td>cloud</td><td align=right>328</td></tr> <tr><td>10</td><td>ALISOFT</td><td align=right>295</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8985</td></tr> <tr><td>2</td><td>China</td><td align=right>3457</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1445</td></tr> <tr><td>4</td><td>France</td><td align=right>566</td></tr> <tr><td>5</td><td>Indonesia</td><td align=right>387</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>361</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>356</td></tr> <tr><td>8</td><td>India</td><td align=right>298</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>273</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>259</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>445878</td></tr> <tr><td>2</td><td align=right>2078</td><td align=right>177923</td></tr> <tr><td>3</td><td align=right>2204</td><td align=right>105101</td></tr> <tr><td>4</td><td align=right>8000</td><td align=right>85372</td></tr> <tr><td>5</td><td align=right>888</td><td align=right>85247</td></tr> <tr><td>6</td><td align=right>5357</td><td align=right>80880</td></tr> <tr><td>7</td><td align=right>554</td><td align=right>79532</td></tr> <tr><td>8</td><td align=right>2000</td><td align=right>76415</td></tr> <tr><td>9</td><td align=right>6000</td><td align=right>74702</td></tr> <tr><td>10</td><td align=right>7722</td><td align=right>70084</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-67055951053392244112026-03-26T11:58:00.002+00:002026-03-26T11:58:25.162+00:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/03/daily-zombie-lists-for-march.html">Daily Zombie IP Lists for March 2026</a>.<br /> detection period: 2026-03-25 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19122<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18113<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1622</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1335</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>996</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>947</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>392</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>364</td></tr> <tr><td>9</td><td>cloud</td><td align=right>328</td></tr> <tr><td>10</td><td>ALISOFT</td><td align=right>317</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8429</td></tr> <tr><td>2</td><td>China</td><td align=right>3568</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1412</td></tr> <tr><td>4</td><td>France</td><td align=right>581</td></tr> <tr><td>5</td><td>Indonesia</td><td align=right>423</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>342</td></tr> <tr><td>7</td><td>India</td><td align=right>335</td></tr> <tr><td>8</td><td>Netherlands</td><td align=right>334</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>279</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>262</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>402659</td></tr> <tr><td>2</td><td align=right>2078</td><td align=right>276937</td></tr> <tr><td>3</td><td align=right>7777</td><td align=right>230821</td></tr> <tr><td>4</td><td align=right>55555</td><td align=right>185628</td></tr> <tr><td>5</td><td align=right>2000</td><td align=right>128770</td></tr> <tr><td>6</td><td align=right>888</td><td align=right>116717</td></tr> <tr><td>7</td><td align=right>8082</td><td align=right>113813</td></tr> <tr><td>8</td><td align=right>2204</td><td align=right>108775</td></tr> <tr><td>9</td><td align=right>8000</td><td align=right>100149</td></tr> <tr><td>10</td><td align=right>2095</td><td align=right>100036</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-56625440301649274682026-03-25T11:07:00.002+00:002026-03-25T11:07:33.892+00:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/03/daily-zombie-lists-for-march.html">Daily Zombie IP Lists for March 2026</a>.<br /> detection period: 2026-03-24 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 16994<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16145<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1341</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1094</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>999</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>948</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>684</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>447</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>373</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>363</td></tr> <tr><td>9</td><td>cloud</td><td align=right>299</td></tr> <tr><td>10</td><td>ALISOFT</td><td align=right>286</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8182</td></tr> <tr><td>2</td><td>China</td><td align=right>3333</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>896</td></tr> <tr><td>4</td><td>France</td><td align=right>530</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>350</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>313</td></tr> <tr><td>7</td><td>India</td><td align=right>258</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>244</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>236</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>204</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>325892</td></tr> <tr><td>2</td><td align=right>7777</td><td align=right>225890</td></tr> <tr><td>3</td><td align=right>2078</td><td align=right>162527</td></tr> <tr><td>4</td><td align=right>8082</td><td align=right>125279</td></tr> <tr><td>5</td><td align=right>2222</td><td align=right>110311</td></tr> <tr><td>6</td><td align=right>2204</td><td align=right>107384</td></tr> <tr><td>7</td><td align=right>55555</td><td align=right>87882</td></tr> <tr><td>8</td><td align=right>6817</td><td align=right>80000</td></tr> <tr><td>9</td><td align=right>2000</td><td align=right>79605</td></tr> <tr><td>10</td><td align=right>8000</td><td align=right>68854</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0