tag:blogger.com,1999:blog-67713846313751756792026-05-29T13:08:44.608+01:00Detect botnets from malicious mail, and notify the responsible ISP.Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.comBlogger9350125tag:blogger.com,1999:blog-6771384631375175679.post-83987334842311762632026-05-29T13:08:44.608+01:002026-05-29T13:08:44.608+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-28 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20943<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19657<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1841</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1435</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1062</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>720</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>717</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>509</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>371</td></tr> <tr><td>10</td><td>cloud</td><td align=right>296</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9599</td></tr> <tr><td>2</td><td>China</td><td align=right>3799</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1091</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>660</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>638</td></tr> <tr><td>6</td><td>France</td><td align=right>480</td></tr> <tr><td>7</td><td>Germany</td><td align=right>392</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>369</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>320</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>266</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>237800</td></tr> <tr><td>2</td><td align=right>2211</td><td align=right>42385</td></tr> <tr><td>3</td><td align=right>4122</td><td align=right>38191</td></tr> <tr><td>4</td><td align=right>8999</td><td align=right>35428</td></tr> <tr><td>5</td><td align=right>8010</td><td align=right>35346</td></tr> <tr><td>6</td><td align=right>1722</td><td align=right>32980</td></tr> <tr><td>7</td><td align=right>7777</td><td align=right>30440</td></tr> <tr><td>8</td><td align=right>8001</td><td align=right>29488</td></tr> <tr><td>9</td><td align=right>8015</td><td align=right>29427</td></tr> <tr><td>10</td><td align=right>5001</td><td align=right>27858</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-88582386257470130662026-05-28T11:26:20.170+01:002026-05-28T11:26:20.170+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-27 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19090<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18117<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1735</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1428</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1051</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>966</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>636</td></tr> <tr><td>6</td><td>VOLCANO-ENGINE</td><td align=right>506</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>407</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>9</td><td>cloud</td><td align=right>302</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>244</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8889</td></tr> <tr><td>2</td><td>China</td><td align=right>3801</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1023</td></tr> <tr><td>4</td><td>France</td><td align=right>479</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>368</td></tr> <tr><td>6</td><td>Germany</td><td align=right>340</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>323</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>293</td></tr> <tr><td>9</td><td>South Korea</td><td align=right>286</td></tr> <tr><td>10</td><td>Viet Nam</td><td align=right>240</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>251056</td></tr> <tr><td>2</td><td align=right>9999</td><td align=right>42802</td></tr> <tr><td>3</td><td align=right>2211</td><td align=right>41367</td></tr> <tr><td>4</td><td align=right>8010</td><td align=right>38113</td></tr> <tr><td>5</td><td align=right>8999</td><td align=right>37991</td></tr> <tr><td>6</td><td align=right>8001</td><td align=right>33328</td></tr> <tr><td>7</td><td align=right>1722</td><td align=right>32473</td></tr> <tr><td>8</td><td align=right>7102</td><td align=right>29321</td></tr> <tr><td>9</td><td align=right>8007</td><td align=right>29163</td></tr> <tr><td>10</td><td align=right>4714</td><td align=right>28711</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-59053242885335894102026-05-27T12:07:23.822+01:002026-05-27T12:07:23.822+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-26 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19527<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18527<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1623</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1450</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1050</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>611</td></tr> <tr><td>6</td><td>VOLCANO-ENGINE</td><td align=right>485</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>378</td></tr> <tr><td>9</td><td>cloud</td><td align=right>302</td></tr> <tr><td>10</td><td>CMNET</td><td align=right>243</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9406</td></tr> <tr><td>2</td><td>China</td><td align=right>3529</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1013</td></tr> <tr><td>4</td><td>France</td><td align=right>475</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>372</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>357</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>332</td></tr> <tr><td>8</td><td>Germany</td><td align=right>319</td></tr> <tr><td>9</td><td>United Kingdom</td><td align=right>287</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>280</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>284039</td></tr> <tr><td>2</td><td align=right>22</td><td align=right>38857</td></tr> <tr><td>3</td><td align=right>2021</td><td align=right>37951</td></tr> <tr><td>4</td><td align=right>8999</td><td align=right>37602</td></tr> <tr><td>5</td><td align=right>8001</td><td align=right>37458</td></tr> <tr><td>6</td><td align=right>8010</td><td align=right>35949</td></tr> <tr><td>7</td><td align=right>2211</td><td align=right>35024</td></tr> <tr><td>8</td><td align=right>7022</td><td align=right>32795</td></tr> <tr><td>9</td><td align=right>8015</td><td align=right>30048</td></tr> <tr><td>10</td><td align=right>4714</td><td align=right>29463</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-74234981087067023902026-05-27T00:19:55.209+01:002026-05-27T00:19:55.209+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-25 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20142<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19019<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1777</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1438</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1050</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>618</td></tr> <tr><td>6</td><td>INFRAWATCH</td><td align=right>568</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>495</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>378</td></tr> <tr><td>10</td><td>cloud</td><td align=right>306</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9045</td></tr> <tr><td>2</td><td>China</td><td align=right>3750</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>978</td></tr> <tr><td>4</td><td>Netherlands</td><td align=right>613</td></tr> <tr><td>5</td><td>Germany</td><td align=right>590</td></tr> <tr><td>6</td><td>France</td><td align=right>489</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>357</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>333</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>318</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>284</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>349840</td></tr> <tr><td>2</td><td align=right>2021</td><td align=right>67295</td></tr> <tr><td>3</td><td align=right>2211</td><td align=right>48795</td></tr> <tr><td>4</td><td align=right>22021</td><td align=right>31604</td></tr> <tr><td>5</td><td align=right>4714</td><td align=right>30318</td></tr> <tr><td>6</td><td align=right>23</td><td align=right>26905</td></tr> <tr><td>7</td><td align=right>5005</td><td align=right>26714</td></tr> <tr><td>8</td><td align=right>1122</td><td align=right>26150</td></tr> <tr><td>9</td><td align=right>1722</td><td align=right>24936</td></tr> <tr><td>10</td><td align=right>22</td><td align=right>23273</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-67491595546426261242026-05-25T15:47:02.625+01:002026-05-25T15:47:02.626+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-24 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21668<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20415<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1534</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1418</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1178</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1038</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>963</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>517</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>465</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>378</td></tr> <tr><td>10</td><td>cloud</td><td align=right>281</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9561</td></tr> <tr><td>2</td><td>China</td><td align=right>3557</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>909</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>859</td></tr> <tr><td>5</td><td>Germany</td><td align=right>655</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>592</td></tr> <tr><td>7</td><td>France</td><td align=right>473</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>397</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>394</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>351</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>403543</td></tr> <tr><td>2</td><td align=right>5525</td><td align=right>90877</td></tr> <tr><td>3</td><td align=right>2021</td><td align=right>69188</td></tr> <tr><td>4</td><td align=right>2211</td><td align=right>53511</td></tr> <tr><td>5</td><td align=right>8122</td><td align=right>50314</td></tr> <tr><td>6</td><td align=right>22021</td><td align=right>49690</td></tr> <tr><td>7</td><td align=right>200</td><td align=right>48444</td></tr> <tr><td>8</td><td align=right>23</td><td align=right>42538</td></tr> <tr><td>9</td><td align=right>2026</td><td align=right>37828</td></tr> <tr><td>10</td><td align=right>400</td><td align=right>37447</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-7756223807991841042026-05-24T16:10:24.759+01:002026-05-24T16:10:24.760+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-23 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21349<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20084<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1610</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1462</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1139</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1027</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>CLOUDFLARENET</td><td align=right>734</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>551</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>452</td></tr> <tr><td>9</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>10</td><td>CENSY</td><td align=right>378</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9474</td></tr> <tr><td>2</td><td>China</td><td align=right>3629</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>862</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>814</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>605</td></tr> <tr><td>6</td><td>Germany</td><td align=right>601</td></tr> <tr><td>7</td><td>France</td><td align=right>488</td></tr> <tr><td>8</td><td>Brazil</td><td align=right>396</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>392</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>318</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>366970</td></tr> <tr><td>2</td><td align=right>2021</td><td align=right>69023</td></tr> <tr><td>3</td><td align=right>300</td><td align=right>58543</td></tr> <tr><td>4</td><td align=right>49322</td><td align=right>50916</td></tr> <tr><td>5</td><td align=right>49222</td><td align=right>45777</td></tr> <tr><td>6</td><td align=right>49422</td><td align=right>45491</td></tr> <tr><td>7</td><td align=right>49122</td><td align=right>45097</td></tr> <tr><td>8</td><td align=right>22021</td><td align=right>39203</td></tr> <tr><td>9</td><td align=right>23</td><td align=right>39042</td></tr> <tr><td>10</td><td align=right>100</td><td align=right>33042</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-73887458616243942742026-05-23T16:57:02.434+01:002026-05-23T16:57:02.434+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-22 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20244<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18953<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1626</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1444</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1135</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1045</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>559</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>457</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>374</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>246</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8663</td></tr> <tr><td>2</td><td>China</td><td align=right>3422</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>918</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>883</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>597</td></tr> <tr><td>6</td><td>Germany</td><td align=right>545</td></tr> <tr><td>7</td><td>France</td><td align=right>511</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>370</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>342</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>339</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>270234</td></tr> <tr><td>2</td><td align=right>2021</td><td align=right>62929</td></tr> <tr><td>3</td><td align=right>23</td><td align=right>41170</td></tr> <tr><td>4</td><td align=right>1722</td><td align=right>35376</td></tr> <tr><td>5</td><td align=right>1122</td><td align=right>32407</td></tr> <tr><td>6</td><td align=right>10222</td><td align=right>31622</td></tr> <tr><td>7</td><td align=right>4714</td><td align=right>30123</td></tr> <tr><td>8</td><td align=right>5005</td><td align=right>29576</td></tr> <tr><td>9</td><td align=right>5902</td><td align=right>29204</td></tr> <tr><td>10</td><td align=right>222</td><td align=right>27495</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-42257548457473484012026-05-22T16:30:37.435+01:002026-05-22T16:30:37.436+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-21 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 22032<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20728<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1709</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1430</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1054</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1030</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>960</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>594</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>460</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>10</td><td>cloud</td><td align=right>325</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9798</td></tr> <tr><td>2</td><td>China</td><td align=right>3577</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1008</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>757</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>625</td></tr> <tr><td>6</td><td>Germany</td><td align=right>557</td></tr> <tr><td>7</td><td>France</td><td align=right>519</td></tr> <tr><td>8</td><td>Brazil</td><td align=right>414</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>396</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>379</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>258342</td></tr> <tr><td>2</td><td align=right>2021</td><td align=right>61526</td></tr> <tr><td>3</td><td align=right>1722</td><td align=right>46487</td></tr> <tr><td>4</td><td align=right>23</td><td align=right>41389</td></tr> <tr><td>5</td><td align=right>1122</td><td align=right>40310</td></tr> <tr><td>6</td><td align=right>4714</td><td align=right>29708</td></tr> <tr><td>7</td><td align=right>7822</td><td align=right>27701</td></tr> <tr><td>8</td><td align=right>5902</td><td align=right>26355</td></tr> <tr><td>9</td><td align=right>5005</td><td align=right>26343</td></tr> <tr><td>10</td><td align=right>4717</td><td align=right>25845</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-37485855427077259852026-05-21T14:58:09.304+01:002026-05-21T14:58:09.304+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-20 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20047<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18879<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1595</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1443</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1056</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>859</td></tr> <tr><td>6</td><td>ACEVILLEPTELTD-SG</td><td align=right>728</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>569</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>424</td></tr> <tr><td>10</td><td>CENSY</td><td align=right>372</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8764</td></tr> <tr><td>2</td><td>China</td><td align=right>3720</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1380</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>842</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>606</td></tr> <tr><td>6</td><td>France</td><td align=right>458</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>358</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>284</td></tr> <tr><td>9</td><td>Germany</td><td align=right>282</td></tr> <tr><td>10</td><td>South Korea</td><td align=right>273</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>296862</td></tr> <tr><td>2</td><td align=right>2261</td><td align=right>66170</td></tr> <tr><td>3</td><td align=right>1722</td><td align=right>47385</td></tr> <tr><td>4</td><td align=right>22020</td><td align=right>34436</td></tr> <tr><td>5</td><td align=right>2332</td><td align=right>33821</td></tr> <tr><td>6</td><td align=right>1122</td><td align=right>30719</td></tr> <tr><td>7</td><td align=right>4714</td><td align=right>30085</td></tr> <tr><td>8</td><td align=right>822</td><td align=right>27570</td></tr> <tr><td>9</td><td align=right>4717</td><td align=right>26741</td></tr> <tr><td>10</td><td align=right>5902</td><td align=right>25766</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-10542701520467413372026-05-20T11:43:45.435+01:002026-05-20T11:43:45.435+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-19 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 22775<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21784<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1709</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1435</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1076</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1051</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>961</td></tr> <tr><td>6</td><td>ACEVILLEPTELTD-SG</td><td align=right>822</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>583</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>426</td></tr> <tr><td>10</td><td>CENSY</td><td align=right>375</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9887</td></tr> <tr><td>2</td><td>China</td><td align=right>4735</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1473</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>973</td></tr> <tr><td>5</td><td>Germany</td><td align=right>591</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>567</td></tr> <tr><td>7</td><td>France</td><td align=right>485</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>356</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>283</td></tr> <tr><td>10</td><td>India</td><td align=right>264</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>182235</td></tr> <tr><td>2</td><td align=right>2261</td><td align=right>85221</td></tr> <tr><td>3</td><td align=right>2332</td><td align=right>80879</td></tr> <tr><td>4</td><td align=right>1722</td><td align=right>47916</td></tr> <tr><td>5</td><td align=right>22020</td><td align=right>33974</td></tr> <tr><td>6</td><td align=right>23</td><td align=right>30682</td></tr> <tr><td>7</td><td align=right>4714</td><td align=right>30468</td></tr> <tr><td>8</td><td align=right>1122</td><td align=right>27464</td></tr> <tr><td>9</td><td align=right>4717</td><td align=right>26648</td></tr> <tr><td>10</td><td align=right>5902</td><td align=right>25273</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-52480025919602203962026-05-19T14:03:07.434+01:002026-05-19T14:03:07.434+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-18 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20607<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19638<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1707</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1442</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1108</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1054</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>ACEVILLEPTELTD-SG</td><td align=right>845</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>617</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>436</td></tr> <tr><td>10</td><td>CENSY</td><td align=right>374</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9004</td></tr> <tr><td>2</td><td>China</td><td align=right>3287</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1633</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>957</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>612</td></tr> <tr><td>6</td><td>Germany</td><td align=right>586</td></tr> <tr><td>7</td><td>France</td><td align=right>475</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>358</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>322</td></tr> <tr><td>10</td><td>India</td><td align=right>261</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>167334</td></tr> <tr><td>2</td><td align=right>2332</td><td align=right>44290</td></tr> <tr><td>3</td><td align=right>1722</td><td align=right>43348</td></tr> <tr><td>4</td><td align=right>9011</td><td align=right>38957</td></tr> <tr><td>5</td><td align=right>23</td><td align=right>32605</td></tr> <tr><td>6</td><td align=right>2048</td><td align=right>32262</td></tr> <tr><td>7</td><td align=right>2020</td><td align=right>31597</td></tr> <tr><td>8</td><td align=right>5005</td><td align=right>29410</td></tr> <tr><td>9</td><td align=right>4714</td><td align=right>27040</td></tr> <tr><td>10</td><td align=right>7922</td><td align=right>26013</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-78181331763726967752026-05-18T13:45:20.389+01:002026-05-19T13:59:57.113+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-17 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21099<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20081<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1669</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1425</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1024</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>952</td></tr> <tr><td>5</td><td>ACEVILLEPTELTD-SG</td><td align=right>843</td></tr> <tr><td>6</td><td>INFRAWATCH</td><td align=right>784</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>581</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>425</td></tr> <tr><td>10</td><td>CENSY</td><td align=right>374</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9394</td></tr> <tr><td>2</td><td>China</td><td align=right>3490</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1543</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>729</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>560</td></tr> <tr><td>6</td><td>Germany</td><td align=right>528</td></tr> <tr><td>7</td><td>France</td><td align=right>480</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>359</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>329</td></tr> <tr><td>10</td><td>India</td><td align=right>290</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>228987</td></tr> <tr><td>2</td><td align=right>1722</td><td align=right>39765</td></tr> <tr><td>3</td><td align=right>23</td><td align=right>38639</td></tr> <tr><td>4</td><td align=right>2020</td><td align=right>30385</td></tr> <tr><td>5</td><td align=right>5005</td><td align=right>29226</td></tr> <tr><td>6</td><td align=right>7922</td><td align=right>28865</td></tr> <tr><td>7</td><td align=right>2048</td><td align=right>27599</td></tr> <tr><td>8</td><td align=right>5902</td><td align=right>26847</td></tr> <tr><td>9</td><td align=right>5322</td><td align=right>25204</td></tr> <tr><td>10</td><td align=right>2122</td><td align=right>24765</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-39893940172176634062026-05-17T11:24:07.857+01:002026-05-17T11:24:07.857+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-16 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20671<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19482<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1677</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1445</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1028</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>956</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>890</td></tr> <tr><td>6</td><td>ACEVILLEPTELTD-SG</td><td align=right>843</td></tr> <tr><td>7</td><td>ASEPL-SG</td><td align=right>515</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>429</td></tr> <tr><td>10</td><td>CENSY</td><td align=right>380</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8788</td></tr> <tr><td>2</td><td>China</td><td align=right>3377</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1431</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>743</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>614</td></tr> <tr><td>6</td><td>Germany</td><td align=right>532</td></tr> <tr><td>7</td><td>France</td><td align=right>489</td></tr> <tr><td>8</td><td>India</td><td align=right>401</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>364</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>357</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>197954</td></tr> <tr><td>2</td><td align=right>2210</td><td align=right>55384</td></tr> <tr><td>3</td><td align=right>1722</td><td align=right>38868</td></tr> <tr><td>4</td><td align=right>2020</td><td align=right>38796</td></tr> <tr><td>5</td><td align=right>5432</td><td align=right>38210</td></tr> <tr><td>6</td><td align=right>23</td><td align=right>30396</td></tr> <tr><td>7</td><td align=right>7922</td><td align=right>28222</td></tr> <tr><td>8</td><td align=right>5005</td><td align=right>26986</td></tr> <tr><td>9</td><td align=right>5902</td><td align=right>25321</td></tr> <tr><td>10</td><td align=right>5322</td><td align=right>24958</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-59941225766759957332026-05-16T16:06:25.767+01:002026-05-16T16:06:25.767+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-15 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21860<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20720<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1706</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1470</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1090</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1038</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>962</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>607</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>435</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>10</td><td>AT-88-Z</td><td align=right>355</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9600</td></tr> <tr><td>2</td><td>China</td><td align=right>3669</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>985</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>902</td></tr> <tr><td>5</td><td>Germany</td><td align=right>656</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>649</td></tr> <tr><td>7</td><td>France</td><td align=right>575</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>380</td></tr> <tr><td>9</td><td>India</td><td align=right>370</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>367</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>226993</td></tr> <tr><td>2</td><td align=right>2210</td><td align=right>103122</td></tr> <tr><td>3</td><td align=right>4822</td><td align=right>90055</td></tr> <tr><td>4</td><td align=right>2239</td><td align=right>85952</td></tr> <tr><td>5</td><td align=right>2020</td><td align=right>43779</td></tr> <tr><td>6</td><td align=right>1722</td><td align=right>37690</td></tr> <tr><td>7</td><td align=right>23</td><td align=right>34903</td></tr> <tr><td>8</td><td align=right>7922</td><td align=right>27941</td></tr> <tr><td>9</td><td align=right>5005</td><td align=right>26718</td></tr> <tr><td>10</td><td align=right>5902</td><td align=right>24968</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-65967613588202895272026-05-15T14:30:47.286+01:002026-05-15T14:30:47.287+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-14 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 22100<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20791<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1516</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1435</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1073</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1046</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>964</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>500</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>440</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>10</td><td>AT-88-Z</td><td align=right>378</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9476</td></tr> <tr><td>2</td><td>China</td><td align=right>3457</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>927</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>908</td></tr> <tr><td>5</td><td>Germany</td><td align=right>682</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>674</td></tr> <tr><td>7</td><td>France</td><td align=right>593</td></tr> <tr><td>8</td><td>Brazil</td><td align=right>400</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>381</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>380</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>266409</td></tr> <tr><td>2</td><td align=right>2210</td><td align=right>144612</td></tr> <tr><td>3</td><td align=right>2239</td><td align=right>100721</td></tr> <tr><td>4</td><td align=right>8015</td><td align=right>58245</td></tr> <tr><td>5</td><td align=right>4822</td><td align=right>37892</td></tr> <tr><td>6</td><td align=right>1722</td><td align=right>37692</td></tr> <tr><td>7</td><td align=right>2020</td><td align=right>36912</td></tr> <tr><td>8</td><td align=right>8000</td><td align=right>31726</td></tr> <tr><td>9</td><td align=right>5322</td><td align=right>27662</td></tr> <tr><td>10</td><td align=right>5005</td><td align=right>25618</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-67937055302884495992026-05-14T12:07:42.910+01:002026-05-14T12:07:42.910+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-13 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21221<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19980<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1568</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1469</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1114</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1031</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>491</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>449</td></tr> <tr><td>8</td><td>FR-ONYPHE-20191111</td><td align=right>447</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>374</td></tr> <tr><td>10</td><td>cloud</td><td align=right>331</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8669</td></tr> <tr><td>2</td><td>China</td><td align=right>3444</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>890</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>852</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>674</td></tr> <tr><td>6</td><td>France</td><td align=right>603</td></tr> <tr><td>7</td><td>Germany</td><td align=right>589</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>475</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>387</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>386</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>235972</td></tr> <tr><td>2</td><td align=right>8000</td><td align=right>175907</td></tr> <tr><td>3</td><td align=right>2210</td><td align=right>150165</td></tr> <tr><td>4</td><td align=right>9443</td><td align=right>91789</td></tr> <tr><td>5</td><td align=right>2239</td><td align=right>85828</td></tr> <tr><td>6</td><td align=right>2000</td><td align=right>79546</td></tr> <tr><td>7</td><td align=right>8015</td><td align=right>78504</td></tr> <tr><td>8</td><td align=right>2222</td><td align=right>77927</td></tr> <tr><td>9</td><td align=right>7777</td><td align=right>64548</td></tr> <tr><td>10</td><td align=right>5357</td><td align=right>57893</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-38230955130150110982026-05-13T13:54:17.978+01:002026-05-13T13:54:17.978+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-12 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 23495<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21859<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1752</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1434</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1029</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>889</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>637</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>439</td></tr> <tr><td>9</td><td>CENSY</td><td align=right>373</td></tr> <tr><td>10</td><td>cloud</td><td align=right>291</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9405</td></tr> <tr><td>2</td><td>China</td><td align=right>3575</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>1086</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>887</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>745</td></tr> <tr><td>6</td><td>France</td><td align=right>596</td></tr> <tr><td>7</td><td>India</td><td align=right>509</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>493</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>486</td></tr> <tr><td>10</td><td>Germany</td><td align=right>440</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>275627</td></tr> <tr><td>2</td><td align=right>2210</td><td align=right>149987</td></tr> <tr><td>3</td><td align=right>1840</td><td align=right>50113</td></tr> <tr><td>4</td><td align=right>5701</td><td align=right>46741</td></tr> <tr><td>5</td><td align=right>9011</td><td align=right>45007</td></tr> <tr><td>6</td><td align=right>2020</td><td align=right>33357</td></tr> <tr><td>7</td><td align=right>3265</td><td align=right>32028</td></tr> <tr><td>8</td><td align=right>23</td><td align=right>31552</td></tr> <tr><td>9</td><td align=right>5999</td><td align=right>31397</td></tr> <tr><td>10</td><td align=right>5902</td><td align=right>24720</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-26705578194349458522026-05-12T13:04:00.001+01:002026-05-12T13:04:08.184+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-11 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20229<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19020<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1517</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1390</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1037</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>955</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>933</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>499</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>374</td></tr> <tr><td>9</td><td>cloud</td><td align=right>340</td></tr> <tr><td>10</td><td>VOLCANO-ENGINE</td><td align=right>309</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8669</td></tr> <tr><td>2</td><td>China</td><td align=right>3051</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>855</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>841</td></tr> <tr><td>5</td><td>Germany</td><td align=right>564</td></tr> <tr><td>6</td><td>France</td><td align=right>562</td></tr> <tr><td>7</td><td>India</td><td align=right>480</td></tr> <tr><td>8</td><td>Netherlands</td><td align=right>445</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>355</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>350</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>294550</td></tr> <tr><td>2</td><td align=right>5701</td><td align=right>156615</td></tr> <tr><td>3</td><td align=right>2210</td><td align=right>127484</td></tr> <tr><td>4</td><td align=right>1840</td><td align=right>119173</td></tr> <tr><td>5</td><td align=right>3265</td><td align=right>81673</td></tr> <tr><td>6</td><td align=right>2109</td><td align=right>64372</td></tr> <tr><td>7</td><td align=right>9011</td><td align=right>59661</td></tr> <tr><td>8</td><td align=right>2020</td><td align=right>39640</td></tr> <tr><td>9</td><td align=right>9997</td><td align=right>31539</td></tr> <tr><td>10</td><td align=right>23</td><td align=right>29056</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-18312774782378288042026-05-11T12:03:00.002+01:002026-05-11T12:03:47.828+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-10 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19819<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18734<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1416</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1412</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1161</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1029</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>954</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>478</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>9</td><td>cloud</td><td align=right>329</td></tr> <tr><td>10</td><td>VOLCANO-ENGINE</td><td align=right>313</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9131</td></tr> <tr><td>2</td><td>China</td><td align=right>2647</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>871</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>811</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>619</td></tr> <tr><td>6</td><td>Germany</td><td align=right>569</td></tr> <tr><td>7</td><td>France</td><td align=right>568</td></tr> <tr><td>8</td><td>India</td><td align=right>392</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>372</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>300</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>1840</td><td align=right>782834</td></tr> <tr><td>2</td><td align=right>3265</td><td align=right>652089</td></tr> <tr><td>3</td><td align=right>5318</td><td align=right>434503</td></tr> <tr><td>4</td><td align=right>2109</td><td align=right>310269</td></tr> <tr><td>5</td><td align=right>5900</td><td align=right>304807</td></tr> <tr><td>6</td><td align=right>5701</td><td align=right>249208</td></tr> <tr><td>7</td><td align=right>4486</td><td align=right>233674</td></tr> <tr><td>8</td><td align=right>5473</td><td align=right>227915</td></tr> <tr><td>9</td><td align=right>5676</td><td align=right>209606</td></tr> <tr><td>10</td><td align=right>3379</td><td align=right>156981</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-81672381095944572522026-05-10T15:15:00.000+01:002026-05-10T15:15:13.715+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-09 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19696<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18555<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1434</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1415</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1157</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1020</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>952</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>493</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>371</td></tr> <tr><td>9</td><td>cloud</td><td align=right>311</td></tr> <tr><td>10</td><td>VOLCANO-ENGINE</td><td align=right>306</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8462</td></tr> <tr><td>2</td><td>China</td><td align=right>2897</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>855</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>820</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>668</td></tr> <tr><td>6</td><td>France</td><td align=right>555</td></tr> <tr><td>7</td><td>Germany</td><td align=right>533</td></tr> <tr><td>8</td><td>India</td><td align=right>413</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>370</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>320</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5701</td><td align=right>1179542</td></tr> <tr><td>2</td><td align=right>1840</td><td align=right>872510</td></tr> <tr><td>3</td><td align=right>2109</td><td align=right>385681</td></tr> <tr><td>4</td><td align=right>3265</td><td align=right>363832</td></tr> <tr><td>5</td><td align=right>5900</td><td align=right>318286</td></tr> <tr><td>6</td><td align=right>5581</td><td align=right>271833</td></tr> <tr><td>7</td><td align=right>9997</td><td align=right>161975</td></tr> <tr><td>8</td><td align=right>2210</td><td align=right>138648</td></tr> <tr><td>9</td><td align=right>3379</td><td align=right>124422</td></tr> <tr><td>10</td><td align=right>554</td><td align=right>82045</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-60492403828048858222026-05-09T14:49:00.000+01:002026-05-09T14:49:02.697+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-08 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20398<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19192<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1430</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1408</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1102</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1032</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>952</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>465</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>367</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>308</td></tr> <tr><td>10</td><td>cloud</td><td align=right>288</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8456</td></tr> <tr><td>2</td><td>China</td><td align=right>3452</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>798</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>795</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>623</td></tr> <tr><td>6</td><td>France</td><td align=right>552</td></tr> <tr><td>7</td><td>Germany</td><td align=right>518</td></tr> <tr><td>8</td><td>India</td><td align=right>398</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>388</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>339</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>222724</td></tr> <tr><td>2</td><td align=right>2078</td><td align=right>139145</td></tr> <tr><td>3</td><td align=right>554</td><td align=right>128030</td></tr> <tr><td>4</td><td align=right>2210</td><td align=right>103691</td></tr> <tr><td>5</td><td align=right>7777</td><td align=right>85439</td></tr> <tr><td>6</td><td align=right>8000</td><td align=right>82870</td></tr> <tr><td>7</td><td align=right>6001</td><td align=right>77432</td></tr> <tr><td>8</td><td align=right>5432</td><td align=right>73221</td></tr> <tr><td>9</td><td align=right>3306</td><td align=right>57697</td></tr> <tr><td>10</td><td align=right>2231</td><td align=right>51788</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-10987715103111389712026-05-08T12:10:00.000+01:002026-05-08T12:10:02.373+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-07 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21618<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20413<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1450</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1431</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1046</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1009</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>954</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>509</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>9</td><td>cloud</td><td align=right>312</td></tr> <tr><td>10</td><td>VOLCANO-ENGINE</td><td align=right>309</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9294</td></tr> <tr><td>2</td><td>China</td><td align=right>3798</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>936</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>773</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>569</td></tr> <tr><td>6</td><td>France</td><td align=right>564</td></tr> <tr><td>7</td><td>Germany</td><td align=right>562</td></tr> <tr><td>8</td><td>India</td><td align=right>394</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>392</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>361</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>241545</td></tr> <tr><td>2</td><td align=right>2210</td><td align=right>55508</td></tr> <tr><td>3</td><td align=right>2231</td><td align=right>51767</td></tr> <tr><td>4</td><td align=right>2020</td><td align=right>47132</td></tr> <tr><td>5</td><td align=right>23</td><td align=right>45715</td></tr> <tr><td>6</td><td align=right>1122</td><td align=right>45093</td></tr> <tr><td>7</td><td align=right>6001</td><td align=right>36644</td></tr> <tr><td>8</td><td align=right>22</td><td align=right>34650</td></tr> <tr><td>9</td><td align=right>2222</td><td align=right>33256</td></tr> <tr><td>10</td><td align=right>7922</td><td align=right>29587</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-83508108250484273722026-05-07T11:51:00.001+01:002026-05-07T11:51:22.741+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-06 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21048<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19533<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1481</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1417</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1027</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1014</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>499</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>306</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8436</td></tr> <tr><td>2</td><td>China</td><td align=right>3595</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>876</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>800</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>569</td></tr> <tr><td>6</td><td>France</td><td align=right>567</td></tr> <tr><td>7</td><td>Germany</td><td align=right>564</td></tr> <tr><td>8</td><td>India</td><td align=right>442</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>388</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>367</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>413872</td></tr> <tr><td>2</td><td align=right>2222</td><td align=right>43769</td></tr> <tr><td>3</td><td align=right>2231</td><td align=right>43023</td></tr> <tr><td>4</td><td align=right>22</td><td align=right>42153</td></tr> <tr><td>5</td><td align=right>2209</td><td align=right>41936</td></tr> <tr><td>6</td><td align=right>1122</td><td align=right>40901</td></tr> <tr><td>7</td><td align=right>23</td><td align=right>36120</td></tr> <tr><td>8</td><td align=right>622</td><td align=right>31420</td></tr> <tr><td>9</td><td align=right>1919</td><td align=right>29777</td></tr> <tr><td>10</td><td align=right>30</td><td align=right>27165</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-45499668294582435332026-05-06T15:45:00.001+01:002026-05-06T15:45:47.450+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-05 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 22165<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20932<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1570</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1455</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1015</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1014</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>954</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>546</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>9</td><td>cloud</td><td align=right>321</td></tr> <tr><td>10</td><td>VOLCANO-ENGINE</td><td align=right>314</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9586</td></tr> <tr><td>2</td><td>China</td><td align=right>3688</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>873</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>867</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>616</td></tr> <tr><td>6</td><td>Germany</td><td align=right>587</td></tr> <tr><td>7</td><td>France</td><td align=right>583</td></tr> <tr><td>8</td><td>India</td><td align=right>411</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>388</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>358</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>459548</td></tr> <tr><td>2</td><td align=right>2209</td><td align=right>53517</td></tr> <tr><td>3</td><td align=right>3014</td><td align=right>38860</td></tr> <tr><td>4</td><td align=right>23</td><td align=right>37450</td></tr> <tr><td>5</td><td align=right>1122</td><td align=right>36217</td></tr> <tr><td>6</td><td align=right>22</td><td align=right>36165</td></tr> <tr><td>7</td><td align=right>2222</td><td align=right>34731</td></tr> <tr><td>8</td><td align=right>4709</td><td align=right>28937</td></tr> <tr><td>9</td><td align=right>7622</td><td align=right>27438</td></tr> <tr><td>10</td><td align=right>2622</td><td align=right>24403</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-18369570785421851412026-05-05T11:34:00.000+01:002026-05-05T11:34:01.052+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-04 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21411<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19960<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1579</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1454</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1023</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>954</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>748</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>541</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>308</td></tr> <tr><td>10</td><td>cloud</td><td align=right>303</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9010</td></tr> <tr><td>2</td><td>China</td><td align=right>3761</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>880</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>854</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>585</td></tr> <tr><td>6</td><td>France</td><td align=right>564</td></tr> <tr><td>7</td><td>Brazil</td><td align=right>455</td></tr> <tr><td>8</td><td>India</td><td align=right>376</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>348</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>331</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>419293</td></tr> <tr><td>2</td><td align=right>2209</td><td align=right>54126</td></tr> <tr><td>3</td><td align=right>23</td><td align=right>43051</td></tr> <tr><td>4</td><td align=right>450</td><td align=right>38936</td></tr> <tr><td>5</td><td align=right>3014</td><td align=right>36566</td></tr> <tr><td>6</td><td align=right>2280</td><td align=right>35091</td></tr> <tr><td>7</td><td align=right>8821</td><td align=right>32022</td></tr> <tr><td>8</td><td align=right>2222</td><td align=right>29268</td></tr> <tr><td>9</td><td align=right>22</td><td align=right>28994</td></tr> <tr><td>10</td><td align=right>1122</td><td align=right>27074</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0