tag:blogger.com,1999:blog-67713846313751756792026-07-17T22:26:10.824+01:00Detect botnets from malicious mail, and notify the responsible ISP.Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.comBlogger9399125tag:blogger.com,1999:blog-6771384631375175679.post-52102977034998495472026-07-17T11:28:47.143+01:002026-07-17T11:28:47.144+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-16 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17502<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16726<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1294</td></tr> <tr><td>2</td><td>INFRAWATCH</td><td align=right>1073</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1054</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>985</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>356</td></tr> <tr><td>9</td><td>cloud</td><td align=right>272</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7663</td></tr> <tr><td>2</td><td>China</td><td align=right>4041</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>856</td></tr> <tr><td>4</td><td>Netherlands</td><td align=right>535</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>442</td></tr> <tr><td>6</td><td>Germany</td><td align=right>433</td></tr> <tr><td>7</td><td>France</td><td align=right>422</td></tr> <tr><td>8</td><td>India</td><td align=right>296</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>239</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>209</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>7022</td><td align=right>51620</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>33910</td></tr> <tr><td>3</td><td align=right>1022</td><td align=right>32974</td></tr> <tr><td>4</td><td align=right>2022</td><td align=right>32814</td></tr> <tr><td>5</td><td align=right>4122</td><td align=right>30687</td></tr> <tr><td>6</td><td align=right>9222</td><td align=right>29285</td></tr> <tr><td>7</td><td align=right>5822</td><td align=right>28712</td></tr> <tr><td>8</td><td align=right>222</td><td align=right>28627</td></tr> <tr><td>9</td><td align=right>6522</td><td align=right>28152</td></tr> <tr><td>10</td><td align=right>4722</td><td align=right>27861</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-11064334164528926732026-07-16T14:10:03.022+01:002026-07-16T14:10:03.022+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-15 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17993<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16942<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1327</td></tr> <tr><td>2</td><td>GOOGLE-CLOUD</td><td align=right>1044</td></tr> <tr><td>3</td><td>AL-3</td><td align=right>968</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>892</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>341</td></tr> <tr><td>9</td><td>cloud</td><td align=right>247</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7990</td></tr> <tr><td>2</td><td>China</td><td align=right>3649</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1057</td></tr> <tr><td>4</td><td>Netherlands</td><td align=right>536</td></tr> <tr><td>5</td><td>France</td><td align=right>429</td></tr> <tr><td>6</td><td>Singapore</td><td align=right>425</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>279</td></tr> <tr><td>8</td><td>India</td><td align=right>250</td></tr> <tr><td>9</td><td>Germany</td><td align=right>235</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>197</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5822</td><td align=right>91180</td></tr> <tr><td>2</td><td align=right>7022</td><td align=right>54676</td></tr> <tr><td>3</td><td align=right>8559</td><td align=right>43550</td></tr> <tr><td>4</td><td align=right>2122</td><td align=right>34780</td></tr> <tr><td>5</td><td align=right>4122</td><td align=right>33964</td></tr> <tr><td>6</td><td align=right>1022</td><td align=right>33144</td></tr> <tr><td>7</td><td align=right>5900</td><td align=right>31268</td></tr> <tr><td>8</td><td align=right>822</td><td align=right>30525</td></tr> <tr><td>9</td><td align=right>4322</td><td align=right>30464</td></tr> <tr><td>10</td><td align=right>622</td><td align=right>29964</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-70596673916157920612026-07-15T14:18:35.483+01:002026-07-15T14:18:35.483+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-14 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21085<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20188<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1401</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1387</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1118</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1040</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>522</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>469</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>10</td><td>cloud</td><td align=right>314</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8775</td></tr> <tr><td>2</td><td>China</td><td align=right>5005</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1042</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>709</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>578</td></tr> <tr><td>6</td><td>Germany</td><td align=right>488</td></tr> <tr><td>7</td><td>France</td><td align=right>419</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>323</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>306</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>275</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>14406</td><td align=right>46907</td></tr> <tr><td>2</td><td align=right>7606</td><td align=right>43777</td></tr> <tr><td>3</td><td align=right>4910</td><td align=right>42055</td></tr> <tr><td>4</td><td align=right>9872</td><td align=right>38823</td></tr> <tr><td>5</td><td align=right>1522</td><td align=right>35668</td></tr> <tr><td>6</td><td align=right>2122</td><td align=right>35211</td></tr> <tr><td>7</td><td align=right>4122</td><td align=right>34054</td></tr> <tr><td>8</td><td align=right>5900</td><td align=right>33456</td></tr> <tr><td>9</td><td align=right>5822</td><td align=right>33020</td></tr> <tr><td>10</td><td align=right>9999</td><td align=right>32036</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-56860860875830911482026-07-14T12:50:14.944+01:002026-07-14T12:50:14.944+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-13 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20643<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19737<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1397</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1397</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1061</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1056</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>963</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>523</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>462</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>10</td><td>cloud</td><td align=right>322</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8529</td></tr> <tr><td>2</td><td>China</td><td align=right>4963</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>803</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>721</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>604</td></tr> <tr><td>6</td><td>Germany</td><td align=right>470</td></tr> <tr><td>7</td><td>France</td><td align=right>423</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>317</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>317</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>275</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>9999</td><td align=right>57595</td></tr> <tr><td>2</td><td align=right>9011</td><td align=right>39039</td></tr> <tr><td>3</td><td align=right>22</td><td align=right>38869</td></tr> <tr><td>4</td><td align=right>3333</td><td align=right>35960</td></tr> <tr><td>5</td><td align=right>622</td><td align=right>34221</td></tr> <tr><td>6</td><td align=right>14387</td><td align=right>34094</td></tr> <tr><td>7</td><td align=right>4122</td><td align=right>33130</td></tr> <tr><td>8</td><td align=right>4322</td><td align=right>31568</td></tr> <tr><td>9</td><td align=right>2122</td><td align=right>31202</td></tr> <tr><td>10</td><td align=right>5781</td><td align=right>31002</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-75095400140984638932026-07-13T11:38:18.595+01:002026-07-13T11:38:18.596+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-12 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21541<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20634<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1412</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1381</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1067</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1057</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>567</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>471</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>383</td></tr> <tr><td>10</td><td>cloud</td><td align=right>332</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8928</td></tr> <tr><td>2</td><td>China</td><td align=right>4948</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1179</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>798</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>621</td></tr> <tr><td>6</td><td>Germany</td><td align=right>522</td></tr> <tr><td>7</td><td>France</td><td align=right>440</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>322</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>286</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>279</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>622</td><td align=right>38284</td></tr> <tr><td>2</td><td align=right>4122</td><td align=right>38027</td></tr> <tr><td>3</td><td align=right>4322</td><td align=right>37648</td></tr> <tr><td>4</td><td align=right>2023</td><td align=right>37052</td></tr> <tr><td>5</td><td align=right>9999</td><td align=right>35501</td></tr> <tr><td>6</td><td align=right>222</td><td align=right>34435</td></tr> <tr><td>7</td><td align=right>9022</td><td align=right>34046</td></tr> <tr><td>8</td><td align=right>4722</td><td align=right>31777</td></tr> <tr><td>9</td><td align=right>2022</td><td align=right>31450</td></tr> <tr><td>10</td><td align=right>5322</td><td align=right>31444</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-8944439190366486482026-07-12T16:18:23.335+01:002026-07-12T16:18:23.336+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-11 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 22091<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21089<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1489</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1362</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1087</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1048</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>517</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>468</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>286</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8222</td></tr> <tr><td>2</td><td>China</td><td align=right>6122</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1078</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>715</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>629</td></tr> <tr><td>6</td><td>Germany</td><td align=right>535</td></tr> <tr><td>7</td><td>France</td><td align=right>447</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>326</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>307</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>290</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>2023</td><td align=right>104123</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>99660</td></tr> <tr><td>3</td><td align=right>3322</td><td align=right>44636</td></tr> <tr><td>4</td><td align=right>4122</td><td align=right>41076</td></tr> <tr><td>5</td><td align=right>4322</td><td align=right>38750</td></tr> <tr><td>6</td><td align=right>622</td><td align=right>36927</td></tr> <tr><td>7</td><td align=right>222</td><td align=right>35057</td></tr> <tr><td>8</td><td align=right>2022</td><td align=right>34584</td></tr> <tr><td>9</td><td align=right>5222</td><td align=right>33775</td></tr> <tr><td>10</td><td align=right>5322</td><td align=right>33682</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-31500249655440856612026-07-11T15:06:57.682+01:002026-07-11T15:06:57.683+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-10 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 24661<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 23688<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1379</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1378</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1089</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1057</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>512</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>470</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>UNICOM</td><td align=right>427</td></tr> <tr><td>10</td><td>CENSY</td><td align=right>381</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>China</td><td align=right>8597</td></tr> <tr><td>2</td><td>United States</td><td align=right>8287</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1031</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>707</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>609</td></tr> <tr><td>6</td><td>Germany</td><td align=right>566</td></tr> <tr><td>7</td><td>France</td><td align=right>469</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>328</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>323</td></tr> <tr><td>10</td><td>India</td><td align=right>315</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>128099</td></tr> <tr><td>2</td><td align=right>2023</td><td align=right>56007</td></tr> <tr><td>3</td><td align=right>3322</td><td align=right>50226</td></tr> <tr><td>4</td><td align=right>4122</td><td align=right>37820</td></tr> <tr><td>5</td><td align=right>622</td><td align=right>36140</td></tr> <tr><td>6</td><td align=right>9022</td><td align=right>35345</td></tr> <tr><td>7</td><td align=right>222</td><td align=right>35076</td></tr> <tr><td>8</td><td align=right>4322</td><td align=right>35005</td></tr> <tr><td>9</td><td align=right>5222</td><td align=right>33800</td></tr> <tr><td>10</td><td align=right>2022</td><td align=right>33403</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-18162007886771508232026-07-10T14:56:55.804+01:002026-07-10T14:56:55.805+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-09 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20781<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19624<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1429</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1393</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1090</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1044</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>548</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>473</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>373</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8479</td></tr> <tr><td>2</td><td>China</td><td align=right>3986</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1037</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>797</td></tr> <tr><td>5</td><td>Germany</td><td align=right>684</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>645</td></tr> <tr><td>7</td><td>France</td><td align=right>493</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>340</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>337</td></tr> <tr><td>10</td><td>India</td><td align=right>300</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>125900</td></tr> <tr><td>2</td><td align=right>622</td><td align=right>38450</td></tr> <tr><td>3</td><td align=right>9022</td><td align=right>38096</td></tr> <tr><td>4</td><td align=right>222</td><td align=right>37833</td></tr> <tr><td>5</td><td align=right>2022</td><td align=right>36951</td></tr> <tr><td>6</td><td align=right>8522</td><td align=right>36497</td></tr> <tr><td>7</td><td align=right>9222</td><td align=right>35974</td></tr> <tr><td>8</td><td align=right>822</td><td align=right>34867</td></tr> <tr><td>9</td><td align=right>1522</td><td align=right>34705</td></tr> <tr><td>10</td><td align=right>7022</td><td align=right>34533</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-47974427104021457102026-07-09T12:51:22.675+01:002026-07-09T12:51:22.675+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-08 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21151<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20135<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1426</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1408</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1081</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1049</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>959</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>563</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>511</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>10</td><td>cloud</td><td align=right>285</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8639</td></tr> <tr><td>2</td><td>China</td><td align=right>3819</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1081</td></tr> <tr><td>4</td><td>Germany</td><td align=right>918</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>823</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>605</td></tr> <tr><td>7</td><td>France</td><td align=right>465</td></tr> <tr><td>8</td><td>India</td><td align=right>365</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>356</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>303</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>125382</td></tr> <tr><td>2</td><td align=right>8522</td><td align=right>40731</td></tr> <tr><td>3</td><td align=right>9022</td><td align=right>39822</td></tr> <tr><td>4</td><td align=right>1022</td><td align=right>38945</td></tr> <tr><td>5</td><td align=right>422</td><td align=right>37915</td></tr> <tr><td>6</td><td align=right>622</td><td align=right>37821</td></tr> <tr><td>7</td><td align=right>6522</td><td align=right>36408</td></tr> <tr><td>8</td><td align=right>1522</td><td align=right>35988</td></tr> <tr><td>9</td><td align=right>922</td><td align=right>35769</td></tr> <tr><td>10</td><td align=right>822</td><td align=right>35611</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-69401062830272678692026-07-08T13:32:33.213+01:002026-07-08T13:32:33.214+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-07 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20182<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19066<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1522</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1364</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1064</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>858</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>548</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>463</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>372</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8803</td></tr> <tr><td>2</td><td>China</td><td align=right>3625</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1107</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>777</td></tr> <tr><td>5</td><td>Germany</td><td align=right>761</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>563</td></tr> <tr><td>7</td><td>France</td><td align=right>492</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>295</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>265</td></tr> <tr><td>10</td><td>India</td><td align=right>254</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>139753</td></tr> <tr><td>2</td><td align=right>2222</td><td align=right>39736</td></tr> <tr><td>3</td><td align=right>22</td><td align=right>32992</td></tr> <tr><td>4</td><td align=right>422</td><td align=right>31711</td></tr> <tr><td>5</td><td align=right>922</td><td align=right>30515</td></tr> <tr><td>6</td><td align=right>6522</td><td align=right>29887</td></tr> <tr><td>7</td><td align=right>8522</td><td align=right>28399</td></tr> <tr><td>8</td><td align=right>1922</td><td align=right>27800</td></tr> <tr><td>9</td><td align=right>1022</td><td align=right>26968</td></tr> <tr><td>10</td><td align=right>1122</td><td align=right>26542</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-90686870460960666162026-07-07T13:01:57.784+01:002026-07-07T13:01:57.785+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-06 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19961<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19126<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1494</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1418</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1112</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1074</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>965</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>537</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>459</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>371</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>363</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8547</td></tr> <tr><td>2</td><td>China</td><td align=right>3790</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1142</td></tr> <tr><td>4</td><td>Germany</td><td align=right>990</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>788</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>544</td></tr> <tr><td>7</td><td>France</td><td align=right>468</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>285</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>278</td></tr> <tr><td>10</td><td>India</td><td align=right>237</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>59051</td></tr> <tr><td>2</td><td align=right>22</td><td align=right>38301</td></tr> <tr><td>3</td><td align=right>1433</td><td align=right>31366</td></tr> <tr><td>4</td><td align=right>2122</td><td align=right>27636</td></tr> <tr><td>5</td><td align=right>33222</td><td align=right>19656</td></tr> <tr><td>6</td><td align=right>6001</td><td align=right>16676</td></tr> <tr><td>7</td><td align=right>23</td><td align=right>14625</td></tr> <tr><td>8</td><td align=right>5902</td><td align=right>13386</td></tr> <tr><td>9</td><td align=right>10000</td><td align=right>13150</td></tr> <tr><td>10</td><td align=right>30011</td><td align=right>11361</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-77565427695413066722026-07-06T12:20:35.687+01:002026-07-06T12:20:35.687+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-05 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20664<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19810<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1446</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1394</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1047</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>806</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>559</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>464</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>cloud</td><td align=right>323</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>322</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9080</td></tr> <tr><td>2</td><td>China</td><td align=right>4103</td></tr> <tr><td>3</td><td>Germany</td><td align=right>889</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>807</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>711</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>535</td></tr> <tr><td>7</td><td>France</td><td align=right>470</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>316</td></tr> <tr><td>9</td><td>India</td><td align=right>305</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>304</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>66244</td></tr> <tr><td>2</td><td align=right>8015</td><td align=right>53588</td></tr> <tr><td>3</td><td align=right>22</td><td align=right>53003</td></tr> <tr><td>4</td><td align=right>888</td><td align=right>37213</td></tr> <tr><td>5</td><td align=right>2078</td><td align=right>37029</td></tr> <tr><td>6</td><td align=right>2222</td><td align=right>34335</td></tr> <tr><td>7</td><td align=right>1433</td><td align=right>33030</td></tr> <tr><td>8</td><td align=right>2122</td><td align=right>32299</td></tr> <tr><td>9</td><td align=right>9011</td><td align=right>29873</td></tr> <tr><td>10</td><td align=right>8082</td><td align=right>29182</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-22451233810670301762026-07-05T14:39:47.871+01:002026-07-05T14:39:47.872+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-04 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20500<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19650<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1408</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1367</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1133</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1055</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>963</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>571</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>473</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>cloud</td><td align=right>325</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>322</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8241</td></tr> <tr><td>2</td><td>China</td><td align=right>4042</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1097</td></tr> <tr><td>4</td><td>Germany</td><td align=right>948</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>830</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>557</td></tr> <tr><td>7</td><td>France</td><td align=right>478</td></tr> <tr><td>8</td><td>India</td><td align=right>352</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>316</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>308</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>6371</td><td align=right>117601</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>71036</td></tr> <tr><td>3</td><td align=right>5640</td><td align=right>62819</td></tr> <tr><td>4</td><td align=right>6911</td><td align=right>61271</td></tr> <tr><td>5</td><td align=right>7348</td><td align=right>59257</td></tr> <tr><td>6</td><td align=right>9294</td><td align=right>55041</td></tr> <tr><td>7</td><td align=right>2684</td><td align=right>54438</td></tr> <tr><td>8</td><td align=right>8015</td><td align=right>54177</td></tr> <tr><td>9</td><td align=right>14177</td><td align=right>51657</td></tr> <tr><td>10</td><td align=right>11382</td><td align=right>48021</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-21176717671232524432026-07-04T15:11:46.406+01:002026-07-04T15:11:46.406+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-03 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21313<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20398<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1540</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1417</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1116</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1079</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>965</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>510</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>466</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>373</td></tr> <tr><td>10</td><td>cloud</td><td align=right>293</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9255</td></tr> <tr><td>2</td><td>China</td><td align=right>3924</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1113</td></tr> <tr><td>4</td><td>Germany</td><td align=right>815</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>770</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>568</td></tr> <tr><td>7</td><td>France</td><td align=right>476</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>341</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>312</td></tr> <tr><td>10</td><td>India</td><td align=right>300</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>6879</td><td align=right>133373</td></tr> <tr><td>2</td><td align=right>9665</td><td align=right>96327</td></tr> <tr><td>3</td><td align=right>4771</td><td align=right>69795</td></tr> <tr><td>4</td><td align=right>4683</td><td align=right>69551</td></tr> <tr><td>5</td><td align=right>5900</td><td align=right>65386</td></tr> <tr><td>6</td><td align=right>888</td><td align=right>65376</td></tr> <tr><td>7</td><td align=right>8015</td><td align=right>57532</td></tr> <tr><td>8</td><td align=right>12007</td><td align=right>50323</td></tr> <tr><td>9</td><td align=right>2078</td><td align=right>48866</td></tr> <tr><td>10</td><td align=right>13490</td><td align=right>42977</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-86616374949697455402026-07-03T11:40:44.637+01:002026-07-03T11:40:44.638+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-02 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 24479<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 23604<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1435</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1379</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1075</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1064</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>964</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>551</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>470</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>10</td><td>UNICOM</td><td align=right>359</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9045</td></tr> <tr><td>2</td><td>China</td><td align=right>7734</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>849</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>808</td></tr> <tr><td>5</td><td>Germany</td><td align=right>786</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>572</td></tr> <tr><td>7</td><td>France</td><td align=right>492</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>331</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>328</td></tr> <tr><td>10</td><td>India</td><td align=right>312</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>2282</td><td align=right>84318</td></tr> <tr><td>2</td><td align=right>888</td><td align=right>74481</td></tr> <tr><td>3</td><td align=right>5900</td><td align=right>60973</td></tr> <tr><td>4</td><td align=right>8015</td><td align=right>60432</td></tr> <tr><td>5</td><td align=right>2078</td><td align=right>53679</td></tr> <tr><td>6</td><td align=right>9901</td><td align=right>49198</td></tr> <tr><td>7</td><td align=right>2122</td><td align=right>47310</td></tr> <tr><td>8</td><td align=right>2222</td><td align=right>44780</td></tr> <tr><td>9</td><td align=right>8088</td><td align=right>40596</td></tr> <tr><td>10</td><td align=right>7777</td><td align=right>33791</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-22630308102461573692026-07-02T12:42:30.565+01:002026-07-02T12:42:30.565+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/07/daily-zombie-lists-for-july-2026202607ip.html">Daily Zombie IP Lists for July 2026</a>.<br /> detection period: 2026-07-01 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20929<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19851<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1438</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1423</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1075</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1044</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>575</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>475</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>382</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>278</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8460</td></tr> <tr><td>2</td><td>China</td><td align=right>3980</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>994</td></tr> <tr><td>4</td><td>Germany</td><td align=right>867</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>803</td></tr> <tr><td>6</td><td>France</td><td align=right>561</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>554</td></tr> <tr><td>8</td><td>India</td><td align=right>358</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>349</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>337</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>2282</td><td align=right>84415</td></tr> <tr><td>2</td><td align=right>888</td><td align=right>74806</td></tr> <tr><td>3</td><td align=right>9443</td><td align=right>60425</td></tr> <tr><td>4</td><td align=right>2122</td><td align=right>51959</td></tr> <tr><td>5</td><td align=right>5900</td><td align=right>50633</td></tr> <tr><td>6</td><td align=right>8015</td><td align=right>50594</td></tr> <tr><td>7</td><td align=right>2078</td><td align=right>49555</td></tr> <tr><td>8</td><td align=right>8088</td><td align=right>45554</td></tr> <tr><td>9</td><td align=right>2222</td><td align=right>44750</td></tr> <tr><td>10</td><td align=right>25</td><td align=right>34357</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-68510745599551886722026-07-02T12:33:50.022+01:002026-07-17T11:22:50.618+01:00To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:<div>為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：</div><div><br /></div> <div>Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;</div><div>第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；</div> <div>Column 2: Zombie IP;</div><div>第2欄：該殭屍電腦的IP位址；</div> <div>Column 3: TCP destination port number scanned by the zombie.</div><div>第3欄：該殭屍電腦所掃描的TCP埠號。</div><div><br /></div> <div>Join the "<a href="https://t.me/szipl">Suspected Zombie IP List</a>" Telegram channel to get notified when the latest data are ready for download.</div><div>想在第一時間取得資料下載網址？請加入<a href="https://t.me/szipl">Suspected Zombie IP List</a>的Telegram頻道。</div><div><br /></div> <div>Here are the download links of the daily zombie IP lists for July 2026 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):</div><div>以下是2026年07月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：</div><div><br /></div> <div>07/01: <a href="https://www.mediafire.com/file/pekp0kgdgtu2gcz/260701_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: b3e4c8ad8df9432cac685a646a872449</div> <div>07/02: <a href="https://www.mediafire.com/file/lf42n8g5vboopas/260702_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: e3bb8592a0312dd8432ad656b2f4b5ed</div> <div>07/03: <a href="https://www.mediafire.com/file/9glhpw0mg4imyzz/260703_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: b189b6fcb8806442a7c8cbd7d28aa071</div> <div>07/04: <a href="https://www.mediafire.com/file/jkneev0z7yxvwta/260704_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: ab4d1f3035f7cbcc47f546844e416058</div> <div>07/05: <a href="https://www.mediafire.com/file/05xheismxpbuptr/260705_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 8481e0d41e122c844b8d5bb4b3edae30</div> <div>07/06: <a href="https://www.mediafire.com/file/d1libvzp0s3vz79/260706_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 1921299c39822aca61f0ad11f06a6f2a</div> <div>07/07: <a href="https://www.mediafire.com/file/zf6k06c1hei3jzg/260707_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 5abab387b2d0bc4d65f010a1c54d6fbf</div> <div>07/08: <a href="https://www.mediafire.com/file/mrlvvyec0j3tedk/260708_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 3c56031ec051f885013db9ee34807ead</div> <div>07/09: <a href="https://www.mediafire.com/file/efcep8f5bkx246p/260709_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 3a67ab48f2427b326385dc61da3e604a</div> <div>07/10: <a href="https://www.mediafire.com/file/mfhegyc2kpx1i2l/260710_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 230b99e78f2fc743341abdbe95fcc893</div> <div>07/11: <a href="https://www.mediafire.com/file/drwrt0wvpj3f0a2/260711_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: d96ddbcdb50660b8b2343cbfde9135df</div> <div>07/12: <a href="https://www.mediafire.com/file/wt7ps4vtpzpw1q9/260712_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 4369c4bef5e8d492cef2a8f93defd9df</div> <div>07/13: <a href="https://www.mediafire.com/file/1fm77dtc9b4mjr4/260713_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 2f070b3f0b1847493c9e745795da4e94</div> <div>07/14: <a href="https://www.mediafire.com/file/e934lz5cd0x95q1/260714_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 7dc07fabc360366ca4974d480ebfeec0</div> <div>07/15: <a href="https://www.mediafire.com/file/tgdxwve2t80ox2q/260715_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 9e89dd23cafe428050ce89e2a04ac287</div> <div>07/16: <a href="https://www.mediafire.com/file/gf7lekmyjvcv7kj/260716_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: ad0b08fcc67232160c98179aa9a2459c</div> <div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-22267386389025454612026-07-01T10:53:25.840+01:002026-07-01T10:53:25.840+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-30 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21522<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20549<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1436</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1399</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1137</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1045</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>574</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>479</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>378</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>323</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8933</td></tr> <tr><td>2</td><td>China</td><td align=right>3915</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1075</td></tr> <tr><td>4</td><td>Germany</td><td align=right>965</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>813</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>581</td></tr> <tr><td>7</td><td>France</td><td align=right>563</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>365</td></tr> <tr><td>9</td><td>India</td><td align=right>362</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>336</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>2282</td><td align=right>65544</td></tr> <tr><td>2</td><td align=right>888</td><td align=right>63247</td></tr> <tr><td>3</td><td align=right>9443</td><td align=right>51779</td></tr> <tr><td>4</td><td align=right>3306</td><td align=right>48689</td></tr> <tr><td>5</td><td align=right>5900</td><td align=right>48407</td></tr> <tr><td>6</td><td align=right>2122</td><td align=right>43054</td></tr> <tr><td>7</td><td align=right>8015</td><td align=right>42059</td></tr> <tr><td>8</td><td align=right>8088</td><td align=right>41619</td></tr> <tr><td>9</td><td align=right>2078</td><td align=right>31909</td></tr> <tr><td>10</td><td align=right>2222</td><td align=right>31282</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-63518685143134558782026-06-30T15:08:59.787+01:002026-06-30T15:08:59.788+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-29 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20945<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19767<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1436</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1429</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1066</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>840</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>559</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>489</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>378</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>345</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8736</td></tr> <tr><td>2</td><td>China</td><td align=right>3947</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>831</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>741</td></tr> <tr><td>5</td><td>Germany</td><td align=right>629</td></tr> <tr><td>6</td><td>France</td><td align=right>602</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>574</td></tr> <tr><td>8</td><td>India</td><td align=right>375</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>340</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>337</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>51248</td></tr> <tr><td>2</td><td align=right>4464</td><td align=right>37941</td></tr> <tr><td>3</td><td align=right>12409</td><td align=right>28770</td></tr> <tr><td>4</td><td align=right>9443</td><td align=right>24264</td></tr> <tr><td>5</td><td align=right>3306</td><td align=right>23752</td></tr> <tr><td>6</td><td align=right>7194</td><td align=right>22506</td></tr> <tr><td>7</td><td align=right>888</td><td align=right>20608</td></tr> <tr><td>8</td><td align=right>8712</td><td align=right>20517</td></tr> <tr><td>9</td><td align=right>23</td><td align=right>19756</td></tr> <tr><td>10</td><td align=right>8015</td><td align=right>19539</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-84351918415005721622026-06-29T12:30:59.641+01:002026-06-29T12:30:59.641+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-28 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19580<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18790<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1455</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1433</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1048</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>963</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>779</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>592</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>454</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>320</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8961</td></tr> <tr><td>2</td><td>China</td><td align=right>3797</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>785</td></tr> <tr><td>4</td><td>Germany</td><td align=right>632</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>622</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>574</td></tr> <tr><td>7</td><td>France</td><td align=right>554</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>313</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>296</td></tr> <tr><td>10</td><td>India</td><td align=right>277</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>14069</td><td align=right>91356</td></tr> <tr><td>2</td><td align=right>4179</td><td align=right>80079</td></tr> <tr><td>3</td><td align=right>5357</td><td align=right>75610</td></tr> <tr><td>4</td><td align=right>7777</td><td align=right>75211</td></tr> <tr><td>5</td><td align=right>5900</td><td align=right>72396</td></tr> <tr><td>6</td><td align=right>3306</td><td align=right>65641</td></tr> <tr><td>7</td><td align=right>13593</td><td align=right>58091</td></tr> <tr><td>8</td><td align=right>9443</td><td align=right>51496</td></tr> <tr><td>9</td><td align=right>8088</td><td align=right>47721</td></tr> <tr><td>10</td><td align=right>2095</td><td align=right>46742</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-88253019205854094142026-06-28T12:43:26.932+01:002026-06-28T12:43:26.933+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-27 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18615<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17843<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1419</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1400</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1049</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>958</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>868</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>592</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>452</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>411</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>378</td></tr> <tr><td>10</td><td>cloud</td><td align=right>339</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8036</td></tr> <tr><td>2</td><td>China</td><td align=right>3829</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>768</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>636</td></tr> <tr><td>5</td><td>Germany</td><td align=right>607</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>572</td></tr> <tr><td>7</td><td>France</td><td align=right>511</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>327</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>307</td></tr> <tr><td>10</td><td>India</td><td align=right>281</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>2272</td><td align=right>117114</td></tr> <tr><td>2</td><td align=right>7777</td><td align=right>114462</td></tr> <tr><td>3</td><td align=right>5900</td><td align=right>92461</td></tr> <tr><td>4</td><td align=right>5357</td><td align=right>66704</td></tr> <tr><td>5</td><td align=right>1122</td><td align=right>56442</td></tr> <tr><td>6</td><td align=right>2095</td><td align=right>53989</td></tr> <tr><td>7</td><td align=right>3306</td><td align=right>53801</td></tr> <tr><td>8</td><td align=right>9443</td><td align=right>50604</td></tr> <tr><td>9</td><td align=right>8015</td><td align=right>48316</td></tr> <tr><td>10</td><td align=right>58603</td><td align=right>47563</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-20884038749049534562026-06-27T11:53:31.177+01:002026-06-27T11:53:31.178+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-26 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19271<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18487<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1391</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1366</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1063</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1039</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>546</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>457</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>341</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8322</td></tr> <tr><td>2</td><td>China</td><td align=right>3779</td></tr> <tr><td>3</td><td>Germany</td><td align=right>804</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>755</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>748</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>526</td></tr> <tr><td>7</td><td>France</td><td align=right>497</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>331</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>325</td></tr> <tr><td>10</td><td>India</td><td align=right>299</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>7777</td><td align=right>128151</td></tr> <tr><td>2</td><td align=right>2272</td><td align=right>104552</td></tr> <tr><td>3</td><td align=right>5900</td><td align=right>102871</td></tr> <tr><td>4</td><td align=right>2095</td><td align=right>83713</td></tr> <tr><td>5</td><td align=right>8082</td><td align=right>81573</td></tr> <tr><td>6</td><td align=right>5357</td><td align=right>74107</td></tr> <tr><td>7</td><td align=right>8015</td><td align=right>72875</td></tr> <tr><td>8</td><td align=right>9443</td><td align=right>69773</td></tr> <tr><td>9</td><td align=right>8085</td><td align=right>64968</td></tr> <tr><td>10</td><td align=right>1122</td><td align=right>64886</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-28908308593604890802026-06-26T11:40:26.795+01:002026-06-26T11:40:26.796+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-25 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19970<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18962<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1454</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1384</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1044</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1034</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>964</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>522</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>467</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>447</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>378</td></tr> <tr><td>10</td><td>DE-ALPHA</td><td align=right>332</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8602</td></tr> <tr><td>2</td><td>China</td><td align=right>3920</td></tr> <tr><td>3</td><td>Germany</td><td align=right>795</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>758</td></tr> <tr><td>5</td><td>Singapore</td><td align=right>711</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>564</td></tr> <tr><td>7</td><td>France</td><td align=right>480</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>356</td></tr> <tr><td>9</td><td>India</td><td align=right>328</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>309</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>7777</td><td align=right>99033</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>90155</td></tr> <tr><td>3</td><td align=right>1122</td><td align=right>62022</td></tr> <tr><td>4</td><td align=right>8082</td><td align=right>59665</td></tr> <tr><td>5</td><td align=right>2095</td><td align=right>56383</td></tr> <tr><td>6</td><td align=right>5357</td><td align=right>54497</td></tr> <tr><td>7</td><td align=right>9443</td><td align=right>52349</td></tr> <tr><td>8</td><td align=right>8015</td><td align=right>52218</td></tr> <tr><td>9</td><td align=right>9022</td><td align=right>47100</td></tr> <tr><td>10</td><td align=right>8085</td><td align=right>43389</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-91225978677633978682026-06-25T11:51:11.281+01:002026-06-25T11:51:11.282+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-24 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19527<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18559<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1421</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1416</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1065</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>925</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>551</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>467</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>384</td></tr> <tr><td>10</td><td>cloud</td><td align=right>307</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8353</td></tr> <tr><td>2</td><td>China</td><td align=right>3869</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>798</td></tr> <tr><td>4</td><td>Germany</td><td align=right>741</td></tr> <tr><td>5</td><td>United Kingdom</td><td align=right>609</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>552</td></tr> <tr><td>7</td><td>France</td><td align=right>504</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>365</td></tr> <tr><td>9</td><td>India</td><td align=right>351</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>322</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>83029</td></tr> <tr><td>2</td><td align=right>7777</td><td align=right>73793</td></tr> <tr><td>3</td><td align=right>1122</td><td align=right>59518</td></tr> <tr><td>4</td><td align=right>9022</td><td align=right>49357</td></tr> <tr><td>5</td><td align=right>2000</td><td align=right>47578</td></tr> <tr><td>6</td><td align=right>8082</td><td align=right>47297</td></tr> <tr><td>7</td><td align=right>5357</td><td align=right>42620</td></tr> <tr><td>8</td><td align=right>9443</td><td align=right>39687</td></tr> <tr><td>9</td><td align=right>2222</td><td align=right>34618</td></tr> <tr><td>10</td><td align=right>8015</td><td align=right>34582</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-37781192665824502902026-06-24T11:36:46.684+01:002026-06-24T11:36:46.684+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-23 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19711<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18526<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1402</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1400</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1054</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>914</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>541</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>460</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>287</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8622</td></tr> <tr><td>2</td><td>China</td><td align=right>3871</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>773</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>620</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>588</td></tr> <tr><td>6</td><td>Germany</td><td align=right>545</td></tr> <tr><td>7</td><td>France</td><td align=right>492</td></tr> <tr><td>8</td><td>India</td><td align=right>348</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>329</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>298</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>2271</td><td align=right>110876</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>104585</td></tr> <tr><td>3</td><td align=right>1122</td><td align=right>61547</td></tr> <tr><td>4</td><td align=right>9022</td><td align=right>44642</td></tr> <tr><td>5</td><td align=right>7777</td><td align=right>43423</td></tr> <tr><td>6</td><td align=right>8082</td><td align=right>35227</td></tr> <tr><td>7</td><td align=right>8807</td><td align=right>30786</td></tr> <tr><td>8</td><td align=right>8825</td><td align=right>29441</td></tr> <tr><td>9</td><td align=right>8015</td><td align=right>28337</td></tr> <tr><td>10</td><td align=right>5357</td><td align=right>27850</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0