tag:blogger.com,1999:blog-67713846313751756792026-10-05T14:15:50.374+01:00Detect botnets from malicious mail, and notify the responsible ISP.Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.comBlogger9480125tag:blogger.com,1999:blog-6771384631375175679.post-85326591408200980142026-10-05T14:15:50.374+01:002026-10-05T14:15:50.374+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-10-04 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20010<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18603<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1530</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1372</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1058</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>940</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>462</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>8</td><td>DE-ALPHA</td><td align=right>327</td></tr> <tr><td>9</td><td>INFRAWATCH</td><td align=right>312</td></tr> <tr><td>10</td><td>ALISOFT</td><td align=right>255</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9093</td></tr> <tr><td>2</td><td>China</td><td align=right>3842</td></tr> <tr><td>3</td><td>Germany</td><td align=right>705</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>673</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>647</td></tr> <tr><td>6</td><td>France</td><td align=right>634</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>332</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>258</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>241</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>228</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>93307</td></tr> <tr><td>2</td><td align=right>1023</td><td align=right>85355</td></tr> <tr><td>3</td><td align=right>2095</td><td align=right>55226</td></tr> <tr><td>4</td><td align=right>8020</td><td align=right>37130</td></tr> <tr><td>5</td><td align=right>12022</td><td align=right>35927</td></tr> <tr><td>6</td><td align=right>2425</td><td align=right>33196</td></tr> <tr><td>7</td><td align=right>23</td><td align=right>32089</td></tr> <tr><td>8</td><td align=right>7094</td><td align=right>31214</td></tr> <tr><td>9</td><td align=right>8030</td><td align=right>30084</td></tr> <tr><td>10</td><td align=right>888</td><td align=right>28524</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-58021207816422898132026-10-04T14:15:26.300+01:002026-10-04T14:15:26.300+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-10-03 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18422<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17082<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1504</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1359</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1058</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>467</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>8</td><td>DE-ALPHA</td><td align=right>327</td></tr> <tr><td>9</td><td>INFRAWATCH</td><td align=right>311</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7960</td></tr> <tr><td>2</td><td>China</td><td align=right>3843</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>671</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>626</td></tr> <tr><td>5</td><td>France</td><td align=right>575</td></tr> <tr><td>6</td><td>Germany</td><td align=right>574</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>336</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>231</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>216</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>204</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>149339</td></tr> <tr><td>2</td><td align=right>2095</td><td align=right>52657</td></tr> <tr><td>3</td><td align=right>1023</td><td align=right>47935</td></tr> <tr><td>4</td><td align=right>8020</td><td align=right>34769</td></tr> <tr><td>5</td><td align=right>7094</td><td align=right>30565</td></tr> <tr><td>6</td><td align=right>8030</td><td align=right>29622</td></tr> <tr><td>7</td><td align=right>888</td><td align=right>29549</td></tr> <tr><td>8</td><td align=right>23</td><td align=right>28863</td></tr> <tr><td>9</td><td align=right>8025</td><td align=right>28577</td></tr> <tr><td>10</td><td align=right>22</td><td align=right>28421</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-12306524838708600932026-10-03T15:55:50.040+01:002026-10-03T15:55:50.040+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-10-02 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19350<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18045<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1486</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1339</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1064</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>461</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>334</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>311</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8518</td></tr> <tr><td>2</td><td>China</td><td align=right>3944</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>698</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>622</td></tr> <tr><td>5</td><td>Germany</td><td align=right>572</td></tr> <tr><td>6</td><td>France</td><td align=right>567</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>337</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>310</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>278</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>234</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>145830</td></tr> <tr><td>2</td><td align=right>55555</td><td align=right>104578</td></tr> <tr><td>3</td><td align=right>2095</td><td align=right>46038</td></tr> <tr><td>4</td><td align=right>2022</td><td align=right>35511</td></tr> <tr><td>5</td><td align=right>8020</td><td align=right>33233</td></tr> <tr><td>6</td><td align=right>888</td><td align=right>31741</td></tr> <tr><td>7</td><td align=right>23</td><td align=right>30707</td></tr> <tr><td>8</td><td align=right>7094</td><td align=right>30136</td></tr> <tr><td>9</td><td align=right>22</td><td align=right>28992</td></tr> <tr><td>10</td><td align=right>8088</td><td align=right>28481</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-53119684000863822882026-10-03T08:09:53.836+01:002026-10-03T08:09:53.836+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/10/daily-zombie-lists-for-october.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-10-01 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20262<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18984<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1512</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1333</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1067</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>459</td></tr> <tr><td>7</td><td>INFRAWATCH</td><td align=right>388</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>328</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9054</td></tr> <tr><td>2</td><td>China</td><td align=right>4072</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>779</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>633</td></tr> <tr><td>5</td><td>France</td><td align=right>574</td></tr> <tr><td>6</td><td>Germany</td><td align=right>566</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>334</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>290</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>287</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>256</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>202712</td></tr> <tr><td>2</td><td align=right>55555</td><td align=right>135917</td></tr> <tr><td>3</td><td align=right>2095</td><td align=right>49484</td></tr> <tr><td>4</td><td align=right>8020</td><td align=right>31453</td></tr> <tr><td>5</td><td align=right>8027</td><td align=right>31287</td></tr> <tr><td>6</td><td align=right>888</td><td align=right>31181</td></tr> <tr><td>7</td><td align=right>7100</td><td align=right>30217</td></tr> <tr><td>8</td><td align=right>7094</td><td align=right>29132</td></tr> <tr><td>9</td><td align=right>8025</td><td align=right>29097</td></tr> <tr><td>10</td><td align=right>22</td><td align=right>27852</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-52460791961331557972026-10-02T08:08:53.145+01:002026-10-05T14:10:19.675+01:00To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:<div>為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：</div><div><br /></div> <div>Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;</div><div>第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；</div> <div>Column 2: Zombie IP;</div><div>第2欄：該殭屍電腦的IP位址；</div> <div>Column 3: TCP destination port number scanned by the zombie.</div><div>第3欄：該殭屍電腦所掃描的TCP埠號。</div><div><br /></div> <div>Join the "<a href="https://t.me/szipl">Suspected Zombie IP List</a>" Telegram channel to get notified when the latest data are ready for download.</div><div>想在第一時間取得資料下載網址？請加入<a href="https://t.me/szipl">Suspected Zombie IP List</a>的Telegram頻道。</div><div><br /></div> <div>Here are the download links of the daily zombie IP lists for October 2026 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):</div><div>以下是2026年10月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：</div><div><br /></div> <div>10/01: <a href="https://www.mediafire.com/file/jh2xnplrkcck012/261001_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 5d358b944bd0b78319ad645fc1e8850e</div> <div>10/02: <a href="https://www.mediafire.com/file/un4ut3mjc0s6uzh/261002_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: a06b53bcb61aaadab5de1b9daf419e4e</div> <div>10/03: <a href="https://www.mediafire.com/file/2negg0qahcjc4wa/261003_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 11289315c81ea37a5e2c9be66244e844</div> <div>10/04: <a href="https://www.mediafire.com/file/gs6opbb2r4xkzdf/261004_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 165d5387e04a5930d5e441d28141d4c0</div> <div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-43268993277483453782026-10-01T15:13:53.864+01:002026-10-01T15:13:53.864+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-30 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19015<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17595<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1518</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1366</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1061</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>928</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>452</td></tr> <tr><td>7</td><td>INFRAWATCH</td><td align=right>382</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>374</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>277</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8420</td></tr> <tr><td>2</td><td>China</td><td align=right>3687</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>659</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>615</td></tr> <tr><td>5</td><td>Germany</td><td align=right>582</td></tr> <tr><td>6</td><td>France</td><td align=right>575</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>308</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>265</td></tr> <tr><td>9</td><td>India</td><td align=right>244</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>243</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>212837</td></tr> <tr><td>2</td><td align=right>55555</td><td align=right>121801</td></tr> <tr><td>3</td><td align=right>8085</td><td align=right>87966</td></tr> <tr><td>4</td><td align=right>2095</td><td align=right>76973</td></tr> <tr><td>5</td><td align=right>2078</td><td align=right>64104</td></tr> <tr><td>6</td><td align=right>8025</td><td align=right>43140</td></tr> <tr><td>7</td><td align=right>9999</td><td align=right>42795</td></tr> <tr><td>8</td><td align=right>2222</td><td align=right>40318</td></tr> <tr><td>9</td><td align=right>8027</td><td align=right>39122</td></tr> <tr><td>10</td><td align=right>7100</td><td align=right>34895</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-7950508670327140932026-09-30T16:00:59.998+01:002026-09-30T16:00:59.998+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-29 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19871<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18472<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1519</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1318</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1055</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>879</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>449</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>373</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>344</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>317</td></tr> <tr><td>10</td><td>DO-13</td><td align=right>247</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8963</td></tr> <tr><td>2</td><td>China</td><td align=right>3795</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>728</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>588</td></tr> <tr><td>5</td><td>Germany</td><td align=right>580</td></tr> <tr><td>6</td><td>France</td><td align=right>565</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>313</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>302</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>292</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>226</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>192649</td></tr> <tr><td>2</td><td align=right>2222</td><td align=right>63397</td></tr> <tr><td>3</td><td align=right>9999</td><td align=right>62246</td></tr> <tr><td>4</td><td align=right>8020</td><td align=right>41993</td></tr> <tr><td>5</td><td align=right>8000</td><td align=right>41712</td></tr> <tr><td>6</td><td align=right>9011</td><td align=right>38529</td></tr> <tr><td>7</td><td align=right>52885</td><td align=right>36821</td></tr> <tr><td>8</td><td align=right>2177</td><td align=right>36667</td></tr> <tr><td>9</td><td align=right>7283</td><td align=right>35349</td></tr> <tr><td>10</td><td align=right>8088</td><td align=right>34087</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-70898909696896405602026-09-29T14:00:11.700+01:002026-09-29T14:00:11.700+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-28 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18974<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17668<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1467</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1291</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1052</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>938</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>429</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>338</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>303</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>270</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8283</td></tr> <tr><td>2</td><td>China</td><td align=right>3660</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>753</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>576</td></tr> <tr><td>5</td><td>Germany</td><td align=right>576</td></tr> <tr><td>6</td><td>France</td><td align=right>564</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>306</td></tr> <tr><td>8</td><td>Netherlands</td><td align=right>296</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>267</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>264</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>166880</td></tr> <tr><td>2</td><td align=right>7777</td><td align=right>73121</td></tr> <tr><td>3</td><td align=right>5357</td><td align=right>45903</td></tr> <tr><td>4</td><td align=right>2222</td><td align=right>45094</td></tr> <tr><td>5</td><td align=right>8020</td><td align=right>41569</td></tr> <tr><td>6</td><td align=right>56641</td><td align=right>33605</td></tr> <tr><td>7</td><td align=right>5000</td><td align=right>32731</td></tr> <tr><td>8</td><td align=right>2000</td><td align=right>32425</td></tr> <tr><td>9</td><td align=right>8027</td><td align=right>31731</td></tr> <tr><td>10</td><td align=right>7100</td><td align=right>29657</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-89187908478678725652026-09-28T15:51:27.673+01:002026-09-28T15:51:27.673+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-27 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18850<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17671<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1434</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1238</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1018</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>938</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>428</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>301</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>301</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>257</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8519</td></tr> <tr><td>2</td><td>China</td><td align=right>3708</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>750</td></tr> <tr><td>4</td><td>France</td><td align=right>584</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>572</td></tr> <tr><td>6</td><td>Germany</td><td align=right>552</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>308</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>271</td></tr> <tr><td>9</td><td>Netherlands</td><td align=right>241</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>237</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>172510</td></tr> <tr><td>2</td><td align=right>8000</td><td align=right>166063</td></tr> <tr><td>3</td><td align=right>2078</td><td align=right>143591</td></tr> <tr><td>4</td><td align=right>7777</td><td align=right>100454</td></tr> <tr><td>5</td><td align=right>2095</td><td align=right>66213</td></tr> <tr><td>6</td><td align=right>2222</td><td align=right>62683</td></tr> <tr><td>7</td><td align=right>2000</td><td align=right>51942</td></tr> <tr><td>8</td><td align=right>2617</td><td align=right>43762</td></tr> <tr><td>9</td><td align=right>19233</td><td align=right>43655</td></tr> <tr><td>10</td><td align=right>8020</td><td align=right>43347</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-46055308938919401972026-09-27T15:42:21.667+01:002026-09-27T15:42:21.668+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-26 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19058<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17802<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>CLOUDFLARENET</td><td align=right>1509</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1450</td></tr> <tr><td>3</td><td>AL-3</td><td align=right>1241</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1021</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>419</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>373</td></tr> <tr><td>9</td><td>INFRAWATCH</td><td align=right>339</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>268</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9113</td></tr> <tr><td>2</td><td>China</td><td align=right>3628</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>584</td></tr> <tr><td>4</td><td>France</td><td align=right>562</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>521</td></tr> <tr><td>6</td><td>Germany</td><td align=right>373</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>288</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>282</td></tr> <tr><td>9</td><td>Netherlands</td><td align=right>247</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>209</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>7777</td><td align=right>219954</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>131920</td></tr> <tr><td>3</td><td align=right>8000</td><td align=right>73734</td></tr> <tr><td>4</td><td align=right>2078</td><td align=right>71259</td></tr> <tr><td>5</td><td align=right>9222</td><td align=right>56563</td></tr> <tr><td>6</td><td align=right>8020</td><td align=right>42289</td></tr> <tr><td>7</td><td align=right>2000</td><td align=right>38421</td></tr> <tr><td>8</td><td align=right>2222</td><td align=right>37649</td></tr> <tr><td>9</td><td align=right>2095</td><td align=right>37017</td></tr> <tr><td>10</td><td align=right>24022</td><td align=right>35819</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-36764607875456987932026-09-26T14:45:05.691+01:002026-09-26T14:45:05.691+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-25 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17583<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16419<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1418</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1291</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1019</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>460</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>367</td></tr> <tr><td>9</td><td>CMNET</td><td align=right>267</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7893</td></tr> <tr><td>2</td><td>China</td><td align=right>3341</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>619</td></tr> <tr><td>4</td><td>France</td><td align=right>555</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>526</td></tr> <tr><td>6</td><td>Germany</td><td align=right>385</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>313</td></tr> <tr><td>8</td><td>Netherlands</td><td align=right>295</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>264</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>245</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>7777</td><td align=right>230405</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>179751</td></tr> <tr><td>3</td><td align=right>9222</td><td align=right>67911</td></tr> <tr><td>4</td><td align=right>1122</td><td align=right>50663</td></tr> <tr><td>5</td><td align=right>8020</td><td align=right>37324</td></tr> <tr><td>6</td><td align=right>2078</td><td align=right>34857</td></tr> <tr><td>7</td><td align=right>2026</td><td align=right>31789</td></tr> <tr><td>8</td><td align=right>7100</td><td align=right>28817</td></tr> <tr><td>9</td><td align=right>8000</td><td align=right>28775</td></tr> <tr><td>10</td><td align=right>8027</td><td align=right>24774</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-46478572842452803012026-09-25T17:46:25.158+01:002026-09-25T17:46:25.159+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-24 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18896<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17911<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1409</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1301</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1060</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>955</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>521</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>439</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>9</td><td>CMNET</td><td align=right>263</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8739</td></tr> <tr><td>2</td><td>China</td><td align=right>3581</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>625</td></tr> <tr><td>4</td><td>Germany</td><td align=right>585</td></tr> <tr><td>5</td><td>France</td><td align=right>551</td></tr> <tr><td>6</td><td>United Kingdom</td><td align=right>511</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>334</td></tr> <tr><td>8</td><td>Netherlands</td><td align=right>327</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>287</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>279</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>169788</td></tr> <tr><td>2</td><td align=right>7777</td><td align=right>123723</td></tr> <tr><td>3</td><td align=right>1122</td><td align=right>72345</td></tr> <tr><td>4</td><td align=right>8030</td><td align=right>37504</td></tr> <tr><td>5</td><td align=right>7100</td><td align=right>36467</td></tr> <tr><td>6</td><td align=right>8020</td><td align=right>35917</td></tr> <tr><td>7</td><td align=right>2078</td><td align=right>29821</td></tr> <tr><td>8</td><td align=right>8018</td><td align=right>27459</td></tr> <tr><td>9</td><td align=right>8027</td><td align=right>26789</td></tr> <tr><td>10</td><td align=right>7094</td><td align=right>25956</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-85344344397615516242026-09-24T16:49:15.858+01:002026-09-24T16:49:15.858+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-23 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19703<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18592<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1570</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1317</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1054</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>958</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>877</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>434</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>380</td></tr> <tr><td>9</td><td>CMNET</td><td align=right>334</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>289</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8328</td></tr> <tr><td>2</td><td>China</td><td align=right>3922</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>847</td></tr> <tr><td>4</td><td>Germany</td><td align=right>777</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>597</td></tr> <tr><td>6</td><td>France</td><td align=right>556</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>411</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>317</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>272</td></tr> <tr><td>10</td><td>India</td><td align=right>259</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>196929</td></tr> <tr><td>2</td><td align=right>2078</td><td align=right>130729</td></tr> <tr><td>3</td><td align=right>1122</td><td align=right>80847</td></tr> <tr><td>4</td><td align=right>5357</td><td align=right>77938</td></tr> <tr><td>5</td><td align=right>888</td><td align=right>76689</td></tr> <tr><td>6</td><td align=right>51005</td><td align=right>69931</td></tr> <tr><td>7</td><td align=right>2000</td><td align=right>66634</td></tr> <tr><td>8</td><td align=right>8000</td><td align=right>51645</td></tr> <tr><td>9</td><td align=right>7777</td><td align=right>50065</td></tr> <tr><td>10</td><td align=right>8030</td><td align=right>46756</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-78068531942386708712026-09-23T17:28:13.722+01:002026-09-23T17:28:13.723+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-22 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19655<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18550<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1573</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1323</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1067</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>957</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>497</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>467</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>373</td></tr> <tr><td>9</td><td>cloud</td><td align=right>304</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>285</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8972</td></tr> <tr><td>2</td><td>China</td><td align=right>3894</td></tr> <tr><td>3</td><td>Germany</td><td align=right>680</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>635</td></tr> <tr><td>5</td><td>France</td><td align=right>552</td></tr> <tr><td>6</td><td>United Kingdom</td><td align=right>506</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>358</td></tr> <tr><td>8</td><td>Netherlands</td><td align=right>321</td></tr> <tr><td>9</td><td>India</td><td align=right>259</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>244</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>83195</td></tr> <tr><td>2</td><td align=right>8016</td><td align=right>30896</td></tr> <tr><td>3</td><td align=right>8022</td><td align=right>30328</td></tr> <tr><td>4</td><td align=right>8030</td><td align=right>29078</td></tr> <tr><td>5</td><td align=right>7100</td><td align=right>28752</td></tr> <tr><td>6</td><td align=right>8020</td><td align=right>28245</td></tr> <tr><td>7</td><td align=right>7091</td><td align=right>28105</td></tr> <tr><td>8</td><td align=right>7092</td><td align=right>27504</td></tr> <tr><td>9</td><td align=right>8026</td><td align=right>27062</td></tr> <tr><td>10</td><td align=right>7099</td><td align=right>26994</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-54973293056324366832026-09-21T15:09:08.560+01:002026-09-21T15:09:08.560+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-20 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17453<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16547<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1368</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1335</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1042</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>895</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>486</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>376</td></tr> <tr><td>8</td><td>DE-ALPHA</td><td align=right>342</td></tr> <tr><td>9</td><td>INFRAWATCH</td><td align=right>328</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8615</td></tr> <tr><td>2</td><td>China</td><td align=right>2085</td></tr> <tr><td>3</td><td>Germany</td><td align=right>747</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>712</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>646</td></tr> <tr><td>6</td><td>France</td><td align=right>576</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>335</td></tr> <tr><td>8</td><td>Netherlands</td><td align=right>278</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>257</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>210</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>1704</td><td align=right>138208</td></tr> <tr><td>2</td><td align=right>99</td><td align=right>120162</td></tr> <tr><td>3</td><td align=right>2500</td><td align=right>118156</td></tr> <tr><td>4</td><td align=right>9801</td><td align=right>110120</td></tr> <tr><td>5</td><td align=right>4711</td><td align=right>100694</td></tr> <tr><td>6</td><td align=right>5359</td><td align=right>90638</td></tr> <tr><td>7</td><td align=right>7648</td><td align=right>89715</td></tr> <tr><td>8</td><td align=right>18012</td><td align=right>87277</td></tr> <tr><td>9</td><td align=right>4460</td><td align=right>85493</td></tr> <tr><td>10</td><td align=right>3009</td><td align=right>84807</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-7534717216664721482026-09-20T13:48:14.920+01:002026-09-20T13:48:14.920+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-19 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17125<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16111<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1401</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1370</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1056</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>946</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>697</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>497</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>373</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>326</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7927</td></tr> <tr><td>2</td><td>China</td><td align=right>2192</td></tr> <tr><td>3</td><td>Germany</td><td align=right>803</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>693</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>634</td></tr> <tr><td>6</td><td>France</td><td align=right>597</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>335</td></tr> <tr><td>8</td><td>Netherlands</td><td align=right>305</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>252</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>238</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>99</td><td align=right>174693</td></tr> <tr><td>2</td><td align=right>2222</td><td align=right>128794</td></tr> <tr><td>3</td><td align=right>1797</td><td align=right>109025</td></tr> <tr><td>4</td><td align=right>14936</td><td align=right>102758</td></tr> <tr><td>5</td><td align=right>54984</td><td align=right>94125</td></tr> <tr><td>6</td><td align=right>2500</td><td align=right>91089</td></tr> <tr><td>7</td><td align=right>36505</td><td align=right>87589</td></tr> <tr><td>8</td><td align=right>1700</td><td align=right>83663</td></tr> <tr><td>9</td><td align=right>2525</td><td align=right>75101</td></tr> <tr><td>10</td><td align=right>3452</td><td align=right>70358</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-61533217617813826532026-09-19T12:10:46.062+01:002026-09-19T12:10:46.062+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-18 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17330<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16344<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1380</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1335</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1044</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>956</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>526</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>INFRAWATCH</td><td align=right>469</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>330</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8042</td></tr> <tr><td>2</td><td>China</td><td align=right>2265</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>757</td></tr> <tr><td>4</td><td>Germany</td><td align=right>686</td></tr> <tr><td>5</td><td>France</td><td align=right>595</td></tr> <tr><td>6</td><td>United Kingdom</td><td align=right>454</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>353</td></tr> <tr><td>8</td><td>Netherlands</td><td align=right>316</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>276</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>272</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>99</td><td align=right>184664</td></tr> <tr><td>2</td><td align=right>2500</td><td align=right>158485</td></tr> <tr><td>3</td><td align=right>8085</td><td align=right>131337</td></tr> <tr><td>4</td><td align=right>2343</td><td align=right>131113</td></tr> <tr><td>5</td><td align=right>1704</td><td align=right>128389</td></tr> <tr><td>6</td><td align=right>4711</td><td align=right>127759</td></tr> <tr><td>7</td><td align=right>3452</td><td align=right>127661</td></tr> <tr><td>8</td><td align=right>14936</td><td align=right>123771</td></tr> <tr><td>9</td><td align=right>1797</td><td align=right>118603</td></tr> <tr><td>10</td><td align=right>2222</td><td align=right>117937</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-36875579935266274372026-09-18T15:09:16.493+01:002026-09-18T15:09:16.493+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-17 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17142<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16156<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1332</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1329</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1044</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>959</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>475</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>366</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>330</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>293</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>255</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8749</td></tr> <tr><td>2</td><td>China</td><td align=right>2254</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>626</td></tr> <tr><td>4</td><td>France</td><td align=right>557</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>507</td></tr> <tr><td>6</td><td>Germany</td><td align=right>487</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>309</td></tr> <tr><td>8</td><td>Netherlands</td><td align=right>293</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>224</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>222</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>62151</td></tr> <tr><td>2</td><td align=right>6022</td><td align=right>45763</td></tr> <tr><td>3</td><td align=right>2722</td><td align=right>19680</td></tr> <tr><td>4</td><td align=right>2322</td><td align=right>19599</td></tr> <tr><td>5</td><td align=right>1222</td><td align=right>19529</td></tr> <tr><td>6</td><td align=right>7122</td><td align=right>18776</td></tr> <tr><td>7</td><td align=right>4444</td><td align=right>18537</td></tr> <tr><td>8</td><td align=right>3522</td><td align=right>18374</td></tr> <tr><td>9</td><td align=right>1000</td><td align=right>18081</td></tr> <tr><td>10</td><td align=right>2000</td><td align=right>18061</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-39611586029183924802026-09-17T16:11:33.268+01:002026-09-17T16:11:33.268+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-16 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 15991<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15102<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1480</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1302</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1043</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>489</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>INFRAWATCH</td><td align=right>467</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>369</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>291</td></tr> <tr><td>10</td><td>cloud</td><td align=right>245</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8132</td></tr> <tr><td>2</td><td>China</td><td align=right>2017</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>632</td></tr> <tr><td>4</td><td>Germany</td><td align=right>616</td></tr> <tr><td>5</td><td>France</td><td align=right>543</td></tr> <tr><td>6</td><td>United Kingdom</td><td align=right>434</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>293</td></tr> <tr><td>8</td><td>Russian Federation</td><td align=right>243</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>217</td></tr> <tr><td>10</td><td>India</td><td align=right>210</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>68878</td></tr> <tr><td>2</td><td align=right>20102</td><td align=right>30794</td></tr> <tr><td>3</td><td align=right>6022</td><td align=right>29729</td></tr> <tr><td>4</td><td align=right>2277</td><td align=right>26363</td></tr> <tr><td>5</td><td align=right>8083</td><td align=right>24394</td></tr> <tr><td>6</td><td align=right>5312</td><td align=right>23595</td></tr> <tr><td>7</td><td align=right>2796</td><td align=right>22654</td></tr> <tr><td>8</td><td align=right>1638</td><td align=right>21911</td></tr> <tr><td>9</td><td align=right>444</td><td align=right>21495</td></tr> <tr><td>10</td><td align=right>2337</td><td align=right>19811</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-6170087681871904922026-09-16T16:39:58.845+01:002026-09-16T16:39:58.845+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-15 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18495<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17655<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1511</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1414</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1043</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>486</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>INFRAWATCH</td><td align=right>478</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>370</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>333</td></tr> <tr><td>10</td><td>cloud</td><td align=right>257</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9072</td></tr> <tr><td>2</td><td>China</td><td align=right>3334</td></tr> <tr><td>3</td><td>Germany</td><td align=right>660</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>628</td></tr> <tr><td>5</td><td>France</td><td align=right>551</td></tr> <tr><td>6</td><td>United Kingdom</td><td align=right>476</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>291</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>254</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>230</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>209</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>137014</td></tr> <tr><td>2</td><td align=right>444</td><td align=right>43351</td></tr> <tr><td>3</td><td align=right>2122</td><td align=right>38464</td></tr> <tr><td>4</td><td align=right>3122</td><td align=right>37830</td></tr> <tr><td>5</td><td align=right>333</td><td align=right>29032</td></tr> <tr><td>6</td><td align=right>2254</td><td align=right>25158</td></tr> <tr><td>7</td><td align=right>20102</td><td align=right>24043</td></tr> <tr><td>8</td><td align=right>2796</td><td align=right>23910</td></tr> <tr><td>9</td><td align=right>1111</td><td align=right>23347</td></tr> <tr><td>10</td><td align=right>7870</td><td align=right>23320</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-25204394785983334012026-09-15T15:59:46.175+01:002026-09-15T15:59:46.175+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-14 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18065<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17148<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1489</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1329</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1134</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1047</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>954</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>473</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>365</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>319</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8220</td></tr> <tr><td>2</td><td>China</td><td align=right>2706</td></tr> <tr><td>3</td><td>Germany</td><td align=right>825</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>773</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>645</td></tr> <tr><td>6</td><td>France</td><td align=right>573</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>536</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>323</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>246</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>226</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>168439</td></tr> <tr><td>2</td><td align=right>10001</td><td align=right>157389</td></tr> <tr><td>3</td><td align=right>444</td><td align=right>49991</td></tr> <tr><td>4</td><td align=right>3122</td><td align=right>43074</td></tr> <tr><td>5</td><td align=right>2122</td><td align=right>42952</td></tr> <tr><td>6</td><td align=right>333</td><td align=right>32520</td></tr> <tr><td>7</td><td align=right>8008</td><td align=right>29499</td></tr> <tr><td>8</td><td align=right>1111</td><td align=right>26296</td></tr> <tr><td>9</td><td align=right>2254</td><td align=right>26025</td></tr> <tr><td>10</td><td align=right>122</td><td align=right>24867</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-78743512620685382852026-09-14T16:18:51.084+01:002026-09-14T16:18:51.084+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-13 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18776<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17909<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1375</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1364</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1151</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1049</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>957</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>491</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>373</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>346</td></tr> <tr><td>10</td><td>cloud</td><td align=right>254</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8914</td></tr> <tr><td>2</td><td>China</td><td align=right>3043</td></tr> <tr><td>3</td><td>Germany</td><td align=right>856</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>777</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>651</td></tr> <tr><td>6</td><td>France</td><td align=right>541</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>532</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>315</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>245</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>184</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>251929</td></tr> <tr><td>2</td><td align=right>3736</td><td align=right>59175</td></tr> <tr><td>3</td><td align=right>2636</td><td align=right>50745</td></tr> <tr><td>4</td><td align=right>5055</td><td align=right>47751</td></tr> <tr><td>5</td><td align=right>2883</td><td align=right>46572</td></tr> <tr><td>6</td><td align=right>8007</td><td align=right>42802</td></tr> <tr><td>7</td><td align=right>4010</td><td align=right>42219</td></tr> <tr><td>8</td><td align=right>1723</td><td align=right>40746</td></tr> <tr><td>9</td><td align=right>5637</td><td align=right>40742</td></tr> <tr><td>10</td><td align=right>144</td><td align=right>39876</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-27442368480296248982026-09-13T16:00:19.561+01:002026-09-13T16:00:19.562+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-12 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18128<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17188<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1381</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1317</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1046</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1027</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>505</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>372</td></tr> <tr><td>9</td><td>DE-ALPHA</td><td align=right>316</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7930</td></tr> <tr><td>2</td><td>China</td><td align=right>2933</td></tr> <tr><td>3</td><td>Germany</td><td align=right>830</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>670</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>651</td></tr> <tr><td>6</td><td>France</td><td align=right>565</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>524</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>352</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>315</td></tr> <tr><td>10</td><td>India</td><td align=right>237</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>263270</td></tr> <tr><td>2</td><td align=right>2299</td><td align=right>100984</td></tr> <tr><td>3</td><td align=right>20088</td><td align=right>68763</td></tr> <tr><td>4</td><td align=right>522</td><td align=right>60654</td></tr> <tr><td>5</td><td align=right>58888</td><td align=right>59506</td></tr> <tr><td>6</td><td align=right>9374</td><td align=right>58980</td></tr> <tr><td>7</td><td align=right>3137</td><td align=right>48402</td></tr> <tr><td>8</td><td align=right>2095</td><td align=right>47735</td></tr> <tr><td>9</td><td align=right>444</td><td align=right>44355</td></tr> <tr><td>10</td><td align=right>1136</td><td align=right>43407</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-86825293828165223852026-09-12T14:45:25.284+01:002026-09-12T14:45:25.284+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-11 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18165<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17156<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1376</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1284</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1137</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1040</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>580</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>374</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7912</td></tr> <tr><td>2</td><td>China</td><td align=right>3151</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>774</td></tr> <tr><td>4</td><td>Germany</td><td align=right>760</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>699</td></tr> <tr><td>6</td><td>France</td><td align=right>558</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>556</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>342</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>248</td></tr> <tr><td>10</td><td>India</td><td align=right>225</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>224995</td></tr> <tr><td>2</td><td align=right>7981</td><td align=right>83695</td></tr> <tr><td>3</td><td align=right>2299</td><td align=right>81115</td></tr> <tr><td>4</td><td align=right>2987</td><td align=right>63781</td></tr> <tr><td>5</td><td align=right>3137</td><td align=right>63563</td></tr> <tr><td>6</td><td align=right>58888</td><td align=right>59695</td></tr> <tr><td>7</td><td align=right>8443</td><td align=right>59632</td></tr> <tr><td>8</td><td align=right>20088</td><td align=right>55585</td></tr> <tr><td>9</td><td align=right>3455</td><td align=right>45739</td></tr> <tr><td>10</td><td align=right>2095</td><td align=right>43100</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-34385861224601283332026-09-11T17:03:27.716+01:002026-09-11T17:03:27.716+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/09/daily-zombie-lists-for-september.html">Daily Zombie IP Lists for September 2026</a>.<br /> detection period: 2026-09-10 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19769<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18833<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1371</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1125</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1042</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>1000</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>956</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>480</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>395</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>383</td></tr> <tr><td>9</td><td>FR-ONYPHE-20221220</td><td align=right>240</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8597</td></tr> <tr><td>2</td><td>China</td><td align=right>4001</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>785</td></tr> <tr><td>4</td><td>Germany</td><td align=right>772</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>568</td></tr> <tr><td>6</td><td>France</td><td align=right>563</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>552</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>373</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>259</td></tr> <tr><td>10</td><td>India</td><td align=right>236</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>3137</td><td align=right>164834</td></tr> <tr><td>2</td><td align=right>2299</td><td align=right>103632</td></tr> <tr><td>3</td><td align=right>5900</td><td align=right>101830</td></tr> <tr><td>4</td><td align=right>58888</td><td align=right>78749</td></tr> <tr><td>5</td><td align=right>20088</td><td align=right>71963</td></tr> <tr><td>6</td><td align=right>2095</td><td align=right>61837</td></tr> <tr><td>7</td><td align=right>4302</td><td align=right>56164</td></tr> <tr><td>8</td><td align=right>20054</td><td align=right>47846</td></tr> <tr><td>9</td><td align=right>7981</td><td align=right>31673</td></tr> <tr><td>10</td><td align=right>3222</td><td align=right>30907</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0