tag:blogger.com,1999:blog-67713846313751756792026-06-18T11:06:37.452+01:00Detect botnets from malicious mail, and notify the responsible ISP.Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.comBlogger9369125tag:blogger.com,1999:blog-6771384631375175679.post-67506244427870243332026-06-18T11:06:37.452+01:002026-06-18T11:06:37.452+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-17 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21723<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20610<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1492</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1450</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1113</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1090</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>522</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>484</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>446</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>10</td><td>cloud</td><td align=right>316</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9266</td></tr> <tr><td>2</td><td>China</td><td align=right>4367</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>846</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>783</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>625</td></tr> <tr><td>6</td><td>Germany</td><td align=right>551</td></tr> <tr><td>7</td><td>France</td><td align=right>485</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>412</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>376</td></tr> <tr><td>10</td><td>India</td><td align=right>357</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>150199</td></tr> <tr><td>2</td><td align=right>23</td><td align=right>89925</td></tr> <tr><td>3</td><td align=right>1122</td><td align=right>59024</td></tr> <tr><td>4</td><td align=right>54321</td><td align=right>45443</td></tr> <tr><td>5</td><td align=right>9999</td><td align=right>42221</td></tr> <tr><td>6</td><td align=right>9443</td><td align=right>31161</td></tr> <tr><td>7</td><td align=right>8822</td><td align=right>28306</td></tr> <tr><td>8</td><td align=right>22</td><td align=right>28231</td></tr> <tr><td>9</td><td align=right>10000</td><td align=right>26311</td></tr> <tr><td>10</td><td align=right>8015</td><td align=right>21060</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-77917604455944825462026-06-17T11:42:46.840+01:002026-06-17T11:42:46.841+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-16 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 23475<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 22304<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1527</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1492</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1096</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>964</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>963</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>550</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>499</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>380</td></tr> <tr><td>10</td><td>cloud</td><td align=right>362</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>10427</td></tr> <tr><td>2</td><td>China</td><td align=right>4346</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>928</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>775</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>613</td></tr> <tr><td>6</td><td>Germany</td><td align=right>591</td></tr> <tr><td>7</td><td>France</td><td align=right>507</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>489</td></tr> <tr><td>9</td><td>India</td><td align=right>411</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>353</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>152697</td></tr> <tr><td>2</td><td align=right>23</td><td align=right>126642</td></tr> <tr><td>3</td><td align=right>1122</td><td align=right>58718</td></tr> <tr><td>4</td><td align=right>1234</td><td align=right>50749</td></tr> <tr><td>5</td><td align=right>54321</td><td align=right>46520</td></tr> <tr><td>6</td><td align=right>202</td><td align=right>42106</td></tr> <tr><td>7</td><td align=right>22</td><td align=right>34324</td></tr> <tr><td>8</td><td align=right>8822</td><td align=right>28332</td></tr> <tr><td>9</td><td align=right>8728</td><td align=right>26110</td></tr> <tr><td>10</td><td align=right>10000</td><td align=right>25315</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-16690290676953029462026-06-16T13:20:12.877+01:002026-06-16T13:20:12.878+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-15 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19413<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18318<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1467</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1391</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1126</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1049</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>677</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>481</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>382</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8031</td></tr> <tr><td>2</td><td>China</td><td align=right>3653</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1002</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>815</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>562</td></tr> <tr><td>6</td><td>Germany</td><td align=right>533</td></tr> <tr><td>7</td><td>France</td><td align=right>502</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>316</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>308</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>297</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>130462</td></tr> <tr><td>2</td><td align=right>2269</td><td align=right>65759</td></tr> <tr><td>3</td><td align=right>202</td><td align=right>54479</td></tr> <tr><td>4</td><td align=right>1122</td><td align=right>51505</td></tr> <tr><td>5</td><td align=right>54321</td><td align=right>38104</td></tr> <tr><td>6</td><td align=right>22025</td><td align=right>35695</td></tr> <tr><td>7</td><td align=right>22</td><td align=right>29688</td></tr> <tr><td>8</td><td align=right>8822</td><td align=right>27665</td></tr> <tr><td>9</td><td align=right>8728</td><td align=right>27140</td></tr> <tr><td>10</td><td align=right>23122</td><td align=right>24674</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-17105634203160967722026-06-15T11:31:57.246+01:002026-06-15T11:31:57.246+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-14 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19869<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19015<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1479</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1468</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1083</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1038</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>959</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>560</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>495</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>10</td><td>cloud</td><td align=right>352</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8892</td></tr> <tr><td>2</td><td>China</td><td align=right>4123</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>863</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>817</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>579</td></tr> <tr><td>6</td><td>Germany</td><td align=right>547</td></tr> <tr><td>7</td><td>France</td><td align=right>492</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>298</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>297</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>237</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>164419</td></tr> <tr><td>2</td><td align=right>12975</td><td align=right>108732</td></tr> <tr><td>3</td><td align=right>12661</td><td align=right>76379</td></tr> <tr><td>4</td><td align=right>13405</td><td align=right>65538</td></tr> <tr><td>5</td><td align=right>2269</td><td align=right>63931</td></tr> <tr><td>6</td><td align=right>202</td><td align=right>53074</td></tr> <tr><td>7</td><td align=right>12951</td><td align=right>50430</td></tr> <tr><td>8</td><td align=right>14391</td><td align=right>43214</td></tr> <tr><td>9</td><td align=right>13968</td><td align=right>41703</td></tr> <tr><td>10</td><td align=right>22025</td><td align=right>40725</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-28035180088247293602026-06-14T16:22:19.217+01:002026-06-14T16:22:19.217+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-13 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20063<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18852<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1443</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1432</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1051</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>868</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>577</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>485</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>10</td><td>cloud</td><td align=right>306</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8377</td></tr> <tr><td>2</td><td>China</td><td align=right>4088</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>901</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>836</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>597</td></tr> <tr><td>6</td><td>France</td><td align=right>529</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>317</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>312</td></tr> <tr><td>9</td><td>Germany</td><td align=right>303</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>284</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>159577</td></tr> <tr><td>2</td><td align=right>2269</td><td align=right>64363</td></tr> <tr><td>3</td><td align=right>6023</td><td align=right>62971</td></tr> <tr><td>4</td><td align=right>13265</td><td align=right>44055</td></tr> <tr><td>5</td><td align=right>9663</td><td align=right>36786</td></tr> <tr><td>6</td><td align=right>6707</td><td align=right>36465</td></tr> <tr><td>7</td><td align=right>4855</td><td align=right>35755</td></tr> <tr><td>8</td><td align=right>8822</td><td align=right>33319</td></tr> <tr><td>9</td><td align=right>3495</td><td align=right>30284</td></tr> <tr><td>10</td><td align=right>6435</td><td align=right>28385</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-17270673522626193642026-06-13T14:21:39.976+01:002026-06-13T14:21:39.976+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-12 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21417<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20368<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1448</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1427</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1063</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1047</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>566</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>523</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>447</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>10</td><td>cloud</td><td align=right>313</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8667</td></tr> <tr><td>2</td><td>China</td><td align=right>4190</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>898</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>791</td></tr> <tr><td>5</td><td>Germany</td><td align=right>619</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>609</td></tr> <tr><td>7</td><td>France</td><td align=right>528</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>412</td></tr> <tr><td>9</td><td>India</td><td align=right>402</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>365</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>134871</td></tr> <tr><td>2</td><td align=right>5901</td><td align=right>30442</td></tr> <tr><td>3</td><td align=right>22</td><td align=right>29950</td></tr> <tr><td>4</td><td align=right>6002</td><td align=right>23966</td></tr> <tr><td>5</td><td align=right>222</td><td align=right>19318</td></tr> <tr><td>6</td><td align=right>2203</td><td align=right>18331</td></tr> <tr><td>7</td><td align=right>13870</td><td align=right>18197</td></tr> <tr><td>8</td><td align=right>2269</td><td align=right>17354</td></tr> <tr><td>9</td><td align=right>2222</td><td align=right>17352</td></tr> <tr><td>10</td><td align=right>888</td><td align=right>16743</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-19663819506790203142026-06-12T11:30:54.045+01:002026-06-12T11:30:54.046+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-11 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20970<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20061<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1542</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1409</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1068</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1061</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>612</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>497</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>10</td><td>cloud</td><td align=right>339</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9185</td></tr> <tr><td>2</td><td>China</td><td align=right>4127</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>838</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>779</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>579</td></tr> <tr><td>6</td><td>Germany</td><td align=right>566</td></tr> <tr><td>7</td><td>France</td><td align=right>477</td></tr> <tr><td>8</td><td>India</td><td align=right>366</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>347</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>335</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>98645</td></tr> <tr><td>2</td><td align=right>5901</td><td align=right>38857</td></tr> <tr><td>3</td><td align=right>9011</td><td align=right>35656</td></tr> <tr><td>4</td><td align=right>22</td><td align=right>28199</td></tr> <tr><td>5</td><td align=right>222</td><td align=right>22048</td></tr> <tr><td>6</td><td align=right>23</td><td align=right>21122</td></tr> <tr><td>7</td><td align=right>9402</td><td align=right>20572</td></tr> <tr><td>8</td><td align=right>2222</td><td align=right>20358</td></tr> <tr><td>9</td><td align=right>888</td><td align=right>19551</td></tr> <tr><td>10</td><td align=right>8015</td><td align=right>19195</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-25173541311952947562026-06-11T12:38:12.042+01:002026-06-11T12:38:12.042+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-10 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20071<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19048<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1575</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1487</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1052</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>865</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>606</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>499</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>447</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>374</td></tr> <tr><td>10</td><td>cloud</td><td align=right>337</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8837</td></tr> <tr><td>2</td><td>China</td><td align=right>3772</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>832</td></tr> <tr><td>4</td><td>Germany</td><td align=right>620</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>560</td></tr> <tr><td>6</td><td>United Kingdom</td><td align=right>553</td></tr> <tr><td>7</td><td>France</td><td align=right>487</td></tr> <tr><td>8</td><td>India</td><td align=right>367</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>331</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>326</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>143577</td></tr> <tr><td>2</td><td align=right>2255</td><td align=right>80252</td></tr> <tr><td>3</td><td align=right>4444</td><td align=right>47236</td></tr> <tr><td>4</td><td align=right>6022</td><td align=right>45981</td></tr> <tr><td>5</td><td align=right>5901</td><td align=right>38281</td></tr> <tr><td>6</td><td align=right>22024</td><td align=right>36814</td></tr> <tr><td>7</td><td align=right>30</td><td align=right>31613</td></tr> <tr><td>8</td><td align=right>22</td><td align=right>29419</td></tr> <tr><td>9</td><td align=right>8222</td><td align=right>28735</td></tr> <tr><td>10</td><td align=right>9402</td><td align=right>26308</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-63666789555905458172026-06-10T11:58:15.151+01:002026-06-10T11:58:15.151+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-09 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20830<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19715<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1637</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1438</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1051</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1022</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>533</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>501</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>10</td><td>cloud</td><td align=right>301</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9588</td></tr> <tr><td>2</td><td>China</td><td align=right>3442</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>782</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>746</td></tr> <tr><td>5</td><td>Germany</td><td align=right>640</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>620</td></tr> <tr><td>7</td><td>France</td><td align=right>497</td></tr> <tr><td>8</td><td>South Korea</td><td align=right>366</td></tr> <tr><td>9</td><td>India</td><td align=right>345</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>340</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>201432</td></tr> <tr><td>2</td><td align=right>2255</td><td align=right>87254</td></tr> <tr><td>3</td><td align=right>6022</td><td align=right>60980</td></tr> <tr><td>4</td><td align=right>1111</td><td align=right>53654</td></tr> <tr><td>5</td><td align=right>6000</td><td align=right>37039</td></tr> <tr><td>6</td><td align=right>22024</td><td align=right>36631</td></tr> <tr><td>7</td><td align=right>822</td><td align=right>32430</td></tr> <tr><td>8</td><td align=right>8222</td><td align=right>30678</td></tr> <tr><td>9</td><td align=right>22</td><td align=right>27487</td></tr> <tr><td>10</td><td align=right>9402</td><td align=right>26952</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-31340509772659811982026-06-09T11:24:54.913+01:002026-06-09T11:24:54.914+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-08 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19079<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18078<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1618</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1436</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1147</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1067</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>612</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>518</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>447</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>363</td></tr> <tr><td>10</td><td>cloud</td><td align=right>346</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8843</td></tr> <tr><td>2</td><td>China</td><td align=right>3326</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>846</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>815</td></tr> <tr><td>5</td><td>Germany</td><td align=right>573</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>542</td></tr> <tr><td>7</td><td>France</td><td align=right>470</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>306</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>289</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>258</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>221610</td></tr> <tr><td>2</td><td align=right>2255</td><td align=right>87184</td></tr> <tr><td>3</td><td align=right>6022</td><td align=right>59477</td></tr> <tr><td>4</td><td align=right>6000</td><td align=right>47377</td></tr> <tr><td>5</td><td align=right>1111</td><td align=right>41975</td></tr> <tr><td>6</td><td align=right>9011</td><td align=right>40740</td></tr> <tr><td>7</td><td align=right>22</td><td align=right>31614</td></tr> <tr><td>8</td><td align=right>8222</td><td align=right>28723</td></tr> <tr><td>9</td><td align=right>7422</td><td align=right>27004</td></tr> <tr><td>10</td><td align=right>7722</td><td align=right>25945</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-75202797272843017502026-06-08T11:29:15.825+01:002026-06-08T11:29:15.825+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-07 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19683<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18572<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1653</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1422</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1038</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>879</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>607</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>505</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>351</td></tr> <tr><td>10</td><td>AT-88-Z</td><td align=right>319</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9432</td></tr> <tr><td>2</td><td>China</td><td align=right>3383</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>891</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>875</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>604</td></tr> <tr><td>6</td><td>France</td><td align=right>483</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>313</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>265</td></tr> <tr><td>9</td><td>Germany</td><td align=right>265</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>255</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>234607</td></tr> <tr><td>2</td><td align=right>6022</td><td align=right>93011</td></tr> <tr><td>3</td><td align=right>9011</td><td align=right>44181</td></tr> <tr><td>4</td><td align=right>2122</td><td align=right>39090</td></tr> <tr><td>5</td><td align=right>55522</td><td align=right>37583</td></tr> <tr><td>6</td><td align=right>8888</td><td align=right>36337</td></tr> <tr><td>7</td><td align=right>922</td><td align=right>32367</td></tr> <tr><td>8</td><td align=right>22</td><td align=right>31710</td></tr> <tr><td>9</td><td align=right>8222</td><td align=right>28327</td></tr> <tr><td>10</td><td align=right>5001</td><td align=right>27420</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-11043741488723070222026-06-07T15:21:21.658+01:002026-06-07T15:21:21.658+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-06 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18561<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17609<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1630</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1385</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1043</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>920</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>699</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>516</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>447</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>356</td></tr> <tr><td>10</td><td>AT-88-Z</td><td align=right>312</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8371</td></tr> <tr><td>2</td><td>China</td><td align=right>3523</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>955</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>908</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>589</td></tr> <tr><td>6</td><td>France</td><td align=right>478</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>314</td></tr> <tr><td>8</td><td>Germany</td><td align=right>307</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>272</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>245</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>206900</td></tr> <tr><td>2</td><td align=right>6022</td><td align=right>125517</td></tr> <tr><td>3</td><td align=right>2122</td><td align=right>53629</td></tr> <tr><td>4</td><td align=right>55522</td><td align=right>42164</td></tr> <tr><td>5</td><td align=right>4321</td><td align=right>38616</td></tr> <tr><td>6</td><td align=right>922</td><td align=right>38303</td></tr> <tr><td>7</td><td align=right>5001</td><td align=right>30075</td></tr> <tr><td>8</td><td align=right>2024</td><td align=right>29142</td></tr> <tr><td>9</td><td align=right>22</td><td align=right>28408</td></tr> <tr><td>10</td><td align=right>8022</td><td align=right>27403</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-42768324729751303232026-06-07T00:30:46.002+01:002026-06-07T00:30:46.003+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-05 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18328<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17129<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1626</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1354</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1061</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>964</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>705</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>577</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>507</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>351</td></tr> <tr><td>10</td><td>AT-88-Z</td><td align=right>282</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8258</td></tr> <tr><td>2</td><td>China</td><td align=right>3294</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>946</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>680</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>589</td></tr> <tr><td>6</td><td>France</td><td align=right>483</td></tr> <tr><td>7</td><td>Germany</td><td align=right>325</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>307</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>290</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>227</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>183213</td></tr> <tr><td>2</td><td align=right>6022</td><td align=right>109163</td></tr> <tr><td>3</td><td align=right>2122</td><td align=right>55302</td></tr> <tr><td>4</td><td align=right>4321</td><td align=right>38636</td></tr> <tr><td>5</td><td align=right>55522</td><td align=right>36980</td></tr> <tr><td>6</td><td align=right>22</td><td align=right>28364</td></tr> <tr><td>7</td><td align=right>12222</td><td align=right>27958</td></tr> <tr><td>8</td><td align=right>2024</td><td align=right>25145</td></tr> <tr><td>9</td><td align=right>5001</td><td align=right>24348</td></tr> <tr><td>10</td><td align=right>8022</td><td align=right>23909</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-42493185364858690072026-06-06T16:14:41.298+01:002026-06-06T16:14:41.298+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-02 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 22111<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21092<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1868</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1725</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1152</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1040</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>971</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>746</td></tr> <tr><td>7</td><td>cloud</td><td align=right>544</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>528</td></tr> <tr><td>9</td><td>FR-ONYPHE-20191111</td><td align=right>447</td></tr> <tr><td>10</td><td>CENSY</td><td align=right>380</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>10331</td></tr> <tr><td>2</td><td>China</td><td align=right>3923</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1049</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>914</td></tr> <tr><td>5</td><td>Germany</td><td align=right>648</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>630</td></tr> <tr><td>7</td><td>France</td><td align=right>484</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>359</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>356</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>285</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>175020</td></tr> <tr><td>2</td><td align=right>2265</td><td align=right>74270</td></tr> <tr><td>3</td><td align=right>6022</td><td align=right>50576</td></tr> <tr><td>4</td><td align=right>5922</td><td align=right>37761</td></tr> <tr><td>5</td><td align=right>2023</td><td align=right>25325</td></tr> <tr><td>6</td><td align=right>23</td><td align=right>23781</td></tr> <tr><td>7</td><td align=right>4714</td><td align=right>22727</td></tr> <tr><td>8</td><td align=right>5001</td><td align=right>22448</td></tr> <tr><td>9</td><td align=right>4708</td><td align=right>22161</td></tr> <tr><td>10</td><td align=right>1322</td><td align=right>21484</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-66299825021528733812026-06-02T13:24:44.212+01:002026-06-02T13:24:44.213+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/06/daily-zombie-lists-for-june-2026202606ip.html">Daily Zombie IP Lists for June 2026</a>.<br /> detection period: 2026-06-01 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21372<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20157<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1869</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1495</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1169</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1060</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>963</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>667</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>534</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>372</td></tr> <tr><td>10</td><td>cloud</td><td align=right>309</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8982</td></tr> <tr><td>2</td><td>China</td><td align=right>3874</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1193</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>912</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>602</td></tr> <tr><td>6</td><td>Germany</td><td align=right>597</td></tr> <tr><td>7</td><td>France</td><td align=right>501</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>379</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>364</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>284</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>174834</td></tr> <tr><td>2</td><td align=right>2265</td><td align=right>74413</td></tr> <tr><td>3</td><td align=right>2023</td><td align=right>39898</td></tr> <tr><td>4</td><td align=right>5001</td><td align=right>24762</td></tr> <tr><td>5</td><td align=right>6022</td><td align=right>23738</td></tr> <tr><td>6</td><td align=right>8899</td><td align=right>22903</td></tr> <tr><td>7</td><td align=right>4714</td><td align=right>22482</td></tr> <tr><td>8</td><td align=right>4708</td><td align=right>21873</td></tr> <tr><td>9</td><td align=right>7105</td><td align=right>20908</td></tr> <tr><td>10</td><td align=right>7422</td><td align=right>20675</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-3246639185868389142026-06-02T13:09:12.029+01:002026-06-18T05:03:59.911+01:00To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:<div>為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：</div><div><br /></div> <div>Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;</div><div>第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；</div> <div>Column 2: Zombie IP;</div><div>第2欄：該殭屍電腦的IP位址；</div> <div>Column 3: TCP destination port number scanned by the zombie.</div><div>第3欄：該殭屍電腦所掃描的TCP埠號。</div><div><br /></div> <div>Join the "<a href="https://t.me/szipl">Suspected Zombie IP List</a>" Telegram channel to get notified when the latest data are ready for download.</div><div>想在第一時間取得資料下載網址？請加入<a href="https://t.me/szipl">Suspected Zombie IP List</a>的Telegram頻道。</div><div><br /></div> <div>Here are the download links of the daily zombie IP lists for June 2026 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):</div><div>以下是2026年06月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：</div><div><br /></div> <div>06/01: <a href="https://www.mediafire.com/file/yrez5vhvhnw80is/260601_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 30edaccd225a11593a57c6fa4a0502a1</div> <div>06/02: <a href="https://www.mediafire.com/file/9r764g3phonmld8/260602_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 670e2644b66d3bf8e2c2ce1c9d84e843</div> <div>06/05: <a href="https://www.mediafire.com/file/7pyvvyj0r54fonk/260605_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: ee2e6d874dc9f9eb1f2963f7cd9889de</div> <div>06/06: <a href="https://www.mediafire.com/file/jqw7pooicb3vong/260606_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 8b990173b7602f1676a33f6f8782a1a8</div> <div>06/07: <a href="https://www.mediafire.com/file/jchqqlo2cvlviep/260607_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 4df2b94f38c64360f2c2d5ba34b59add</div> <div>06/08: <a href="https://www.mediafire.com/file/okqvc6aowrlgvx4/260608_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: c98e108b937957da470721886ac6ce11</div> <div>06/09: <a href="https://www.mediafire.com/file/ty6nbq62hvc4spd/260609_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: f803e6a1fe8ba935873ab68ba920bed1</div> <div>06/10: <a href="https://www.mediafire.com/file/tfoqedqu5v37yba/260610_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 2fc5caeb065d69218f549098192c0ff4</div> <div>06/11: <a href="https://www.mediafire.com/file/4v53ej933kzwlkw/260611_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: c568e3cb6e5c812d48678fe923927bec</div> <div>06/12: <a href="https://www.mediafire.com/file/ipcodrc8iox1h9f/260612_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 5387354f1a779fda44b3544f5de5c775</div> <div>06/13: <a href="https://www.mediafire.com/file/3kaen7cwu72kewi/260613_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 44ae5144ad2c659c686a3fcf2fd65aaa</div> <div>06/14: <a href="https://www.mediafire.com/file/a50cteoqmxcs43x/260614_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 55a77ba51cd595297da634c2417fe552</div> <div>06/15: <a href="https://www.mediafire.com/file/6qos2friv6uwj6c/260615_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: b27583606837119654b785dafb4d8564</div> <div>06/16: <a href="https://www.mediafire.com/file/o1vt9b1lxal06do/260616_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 18236cc43059e1c3e7884749e533cbdb</div> <div>06/17: <a href="https://www.mediafire.com/file/0kmew9u1j58n130/260617_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 565159d6689218ecb129c5f33d479701</div> <div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-67100155460129761312026-06-01T16:30:35.316+01:002026-06-01T16:30:35.316+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-31 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20074<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19129<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1703</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1406</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1092</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1046</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>603</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>510</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>10</td><td>cloud</td><td align=right>319</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9295</td></tr> <tr><td>2</td><td>China</td><td align=right>3719</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1014</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>814</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>599</td></tr> <tr><td>6</td><td>Germany</td><td align=right>552</td></tr> <tr><td>7</td><td>France</td><td align=right>467</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>334</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>288</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>232</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>162450</td></tr> <tr><td>2</td><td align=right>2265</td><td align=right>74268</td></tr> <tr><td>3</td><td align=right>2023</td><td align=right>36396</td></tr> <tr><td>4</td><td align=right>5001</td><td align=right>30224</td></tr> <tr><td>5</td><td align=right>2000</td><td align=right>26118</td></tr> <tr><td>6</td><td align=right>8015</td><td align=right>25356</td></tr> <tr><td>7</td><td align=right>2222</td><td align=right>22467</td></tr> <tr><td>8</td><td align=right>4714</td><td align=right>22401</td></tr> <tr><td>9</td><td align=right>8022</td><td align=right>21781</td></tr> <tr><td>10</td><td align=right>4708</td><td align=right>21573</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-84433548242877318862026-05-31T11:30:40.216+01:002026-05-31T11:30:40.217+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-30 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19491<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18394<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1795</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1393</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1178</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1050</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>656</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>506</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>228</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8637</td></tr> <tr><td>2</td><td>China</td><td align=right>3623</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>996</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>834</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>598</td></tr> <tr><td>6</td><td>Germany</td><td align=right>590</td></tr> <tr><td>7</td><td>France</td><td align=right>466</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>358</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>306</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>261</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>158896</td></tr> <tr><td>2</td><td align=right>2265</td><td align=right>46664</td></tr> <tr><td>3</td><td align=right>2023</td><td align=right>41857</td></tr> <tr><td>4</td><td align=right>5001</td><td align=right>30243</td></tr> <tr><td>5</td><td align=right>7777</td><td align=right>29149</td></tr> <tr><td>6</td><td align=right>8010</td><td align=right>26878</td></tr> <tr><td>7</td><td align=right>23</td><td align=right>24062</td></tr> <tr><td>8</td><td align=right>8015</td><td align=right>23027</td></tr> <tr><td>9</td><td align=right>4714</td><td align=right>22404</td></tr> <tr><td>10</td><td align=right>8022</td><td align=right>22393</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-58314010370474581442026-05-30T16:38:20.470+01:002026-05-30T16:38:20.470+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-29 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20203<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19259<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1810</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1412</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1162</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1045</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>701</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>505</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>10</td><td>cloud</td><td align=right>310</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9006</td></tr> <tr><td>2</td><td>China</td><td align=right>3643</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1061</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>940</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>641</td></tr> <tr><td>6</td><td>Germany</td><td align=right>634</td></tr> <tr><td>7</td><td>France</td><td align=right>486</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>376</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>299</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>256</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>140809</td></tr> <tr><td>2</td><td align=right>4122</td><td align=right>41589</td></tr> <tr><td>3</td><td align=right>2023</td><td align=right>38686</td></tr> <tr><td>4</td><td align=right>2211</td><td align=right>34595</td></tr> <tr><td>5</td><td align=right>8999</td><td align=right>33538</td></tr> <tr><td>6</td><td align=right>8010</td><td align=right>32303</td></tr> <tr><td>7</td><td align=right>7777</td><td align=right>27193</td></tr> <tr><td>8</td><td align=right>5001</td><td align=right>26801</td></tr> <tr><td>9</td><td align=right>23</td><td align=right>24526</td></tr> <tr><td>10</td><td align=right>8015</td><td align=right>24095</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-83987334842311762632026-05-29T13:08:44.608+01:002026-05-29T13:08:44.608+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-28 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20943<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19657<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1841</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1435</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1062</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>720</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>717</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>509</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>371</td></tr> <tr><td>10</td><td>cloud</td><td align=right>296</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9599</td></tr> <tr><td>2</td><td>China</td><td align=right>3799</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1091</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>660</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>638</td></tr> <tr><td>6</td><td>France</td><td align=right>480</td></tr> <tr><td>7</td><td>Germany</td><td align=right>392</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>369</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>320</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>266</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>237800</td></tr> <tr><td>2</td><td align=right>2211</td><td align=right>42385</td></tr> <tr><td>3</td><td align=right>4122</td><td align=right>38191</td></tr> <tr><td>4</td><td align=right>8999</td><td align=right>35428</td></tr> <tr><td>5</td><td align=right>8010</td><td align=right>35346</td></tr> <tr><td>6</td><td align=right>1722</td><td align=right>32980</td></tr> <tr><td>7</td><td align=right>7777</td><td align=right>30440</td></tr> <tr><td>8</td><td align=right>8001</td><td align=right>29488</td></tr> <tr><td>9</td><td align=right>8015</td><td align=right>29427</td></tr> <tr><td>10</td><td align=right>5001</td><td align=right>27858</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-88582386257470130662026-05-28T11:26:20.170+01:002026-05-28T11:26:20.170+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-27 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19090<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18117<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1735</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1428</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1051</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>966</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>636</td></tr> <tr><td>6</td><td>VOLCANO-ENGINE</td><td align=right>506</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>407</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>9</td><td>cloud</td><td align=right>302</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>244</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8889</td></tr> <tr><td>2</td><td>China</td><td align=right>3801</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1023</td></tr> <tr><td>4</td><td>France</td><td align=right>479</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>368</td></tr> <tr><td>6</td><td>Germany</td><td align=right>340</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>323</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>293</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>286</td></tr> <tr><td>10</td><td>Viet Nam</td><td align=right>240</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>251056</td></tr> <tr><td>2</td><td align=right>9999</td><td align=right>42802</td></tr> <tr><td>3</td><td align=right>2211</td><td align=right>41367</td></tr> <tr><td>4</td><td align=right>8010</td><td align=right>38113</td></tr> <tr><td>5</td><td align=right>8999</td><td align=right>37991</td></tr> <tr><td>6</td><td align=right>8001</td><td align=right>33328</td></tr> <tr><td>7</td><td align=right>1722</td><td align=right>32473</td></tr> <tr><td>8</td><td align=right>7102</td><td align=right>29321</td></tr> <tr><td>9</td><td align=right>8007</td><td align=right>29163</td></tr> <tr><td>10</td><td align=right>4714</td><td align=right>28711</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-59053242885335894102026-05-27T12:07:23.822+01:002026-05-27T12:07:23.822+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-26 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19527<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18527<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1623</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1450</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1050</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>611</td></tr> <tr><td>6</td><td>VOLCANO-ENGINE</td><td align=right>485</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>378</td></tr> <tr><td>9</td><td>cloud</td><td align=right>302</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>243</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9406</td></tr> <tr><td>2</td><td>China</td><td align=right>3529</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1013</td></tr> <tr><td>4</td><td>France</td><td align=right>475</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>372</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>357</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>332</td></tr> <tr><td>8</td><td>Germany</td><td align=right>319</td></tr> <tr><td>9</td><td>United Kingdom</td><td align=right>287</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>280</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>284039</td></tr> <tr><td>2</td><td align=right>22</td><td align=right>38857</td></tr> <tr><td>3</td><td align=right>2021</td><td align=right>37951</td></tr> <tr><td>4</td><td align=right>8999</td><td align=right>37602</td></tr> <tr><td>5</td><td align=right>8001</td><td align=right>37458</td></tr> <tr><td>6</td><td align=right>8010</td><td align=right>35949</td></tr> <tr><td>7</td><td align=right>2211</td><td align=right>35024</td></tr> <tr><td>8</td><td align=right>7022</td><td align=right>32795</td></tr> <tr><td>9</td><td align=right>8015</td><td align=right>30048</td></tr> <tr><td>10</td><td align=right>4714</td><td align=right>29463</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-74234981087067023902026-05-27T00:19:55.209+01:002026-05-27T00:19:55.209+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-25 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20142<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19019<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1777</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1438</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1050</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>618</td></tr> <tr><td>6</td><td>INFRAWATCH</td><td align=right>568</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>495</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>378</td></tr> <tr><td>10</td><td>cloud</td><td align=right>306</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9045</td></tr> <tr><td>2</td><td>China</td><td align=right>3750</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>978</td></tr> <tr><td>4</td><td>Netherlands</td><td align=right>613</td></tr> <tr><td>5</td><td>Germany</td><td align=right>590</td></tr> <tr><td>6</td><td>France</td><td align=right>489</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>357</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>333</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>318</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>284</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>349840</td></tr> <tr><td>2</td><td align=right>2021</td><td align=right>67295</td></tr> <tr><td>3</td><td align=right>2211</td><td align=right>48795</td></tr> <tr><td>4</td><td align=right>22021</td><td align=right>31604</td></tr> <tr><td>5</td><td align=right>4714</td><td align=right>30318</td></tr> <tr><td>6</td><td align=right>23</td><td align=right>26905</td></tr> <tr><td>7</td><td align=right>5005</td><td align=right>26714</td></tr> <tr><td>8</td><td align=right>1122</td><td align=right>26150</td></tr> <tr><td>9</td><td align=right>1722</td><td align=right>24936</td></tr> <tr><td>10</td><td align=right>22</td><td align=right>23273</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-67491595546426261242026-05-25T15:47:02.625+01:002026-05-25T15:47:02.626+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-24 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21668<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20415<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1534</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1418</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1178</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1038</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>963</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>517</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>465</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>378</td></tr> <tr><td>10</td><td>cloud</td><td align=right>281</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9561</td></tr> <tr><td>2</td><td>China</td><td align=right>3557</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>909</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>859</td></tr> <tr><td>5</td><td>Germany</td><td align=right>655</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>592</td></tr> <tr><td>7</td><td>France</td><td align=right>473</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>397</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>394</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>351</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>403543</td></tr> <tr><td>2</td><td align=right>5525</td><td align=right>90877</td></tr> <tr><td>3</td><td align=right>2021</td><td align=right>69188</td></tr> <tr><td>4</td><td align=right>2211</td><td align=right>53511</td></tr> <tr><td>5</td><td align=right>8122</td><td align=right>50314</td></tr> <tr><td>6</td><td align=right>22021</td><td align=right>49690</td></tr> <tr><td>7</td><td align=right>200</td><td align=right>48444</td></tr> <tr><td>8</td><td align=right>23</td><td align=right>42538</td></tr> <tr><td>9</td><td align=right>2026</td><td align=right>37828</td></tr> <tr><td>10</td><td align=right>400</td><td align=right>37447</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-7756223807991841042026-05-24T16:10:24.759+01:002026-05-24T16:10:24.760+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-23 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21349<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20084<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1610</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1462</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1139</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1027</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>CLOUDFLARENET</td><td align=right>734</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>551</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>452</td></tr> <tr><td>9</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>10</td><td>CENSY</td><td align=right>378</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9474</td></tr> <tr><td>2</td><td>China</td><td align=right>3629</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>862</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>814</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>605</td></tr> <tr><td>6</td><td>Germany</td><td align=right>601</td></tr> <tr><td>7</td><td>France</td><td align=right>488</td></tr> <tr><td>8</td><td>Brazil</td><td align=right>396</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>392</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>318</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>366970</td></tr> <tr><td>2</td><td align=right>2021</td><td align=right>69023</td></tr> <tr><td>3</td><td align=right>300</td><td align=right>58543</td></tr> <tr><td>4</td><td align=right>49322</td><td align=right>50916</td></tr> <tr><td>5</td><td align=right>49222</td><td align=right>45777</td></tr> <tr><td>6</td><td align=right>49422</td><td align=right>45491</td></tr> <tr><td>7</td><td align=right>49122</td><td align=right>45097</td></tr> <tr><td>8</td><td align=right>22021</td><td align=right>39203</td></tr> <tr><td>9</td><td align=right>23</td><td align=right>39042</td></tr> <tr><td>10</td><td align=right>100</td><td align=right>33042</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0