tag:blogger.com,1999:blog-67713846313751756792026-05-07T23:42:09.461+01:00Detect botnets from malicious mail, and notify the responsible ISP.Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.comBlogger9328125tag:blogger.com,1999:blog-6771384631375175679.post-83508108250484273722026-05-07T11:51:00.001+01:002026-05-07T11:51:22.741+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-06 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21048<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19533<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1481</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1417</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1027</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1014</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>499</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>306</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8436</td></tr> <tr><td>2</td><td>China</td><td align=right>3595</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>876</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>800</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>569</td></tr> <tr><td>6</td><td>France</td><td align=right>567</td></tr> <tr><td>7</td><td>Germany</td><td align=right>564</td></tr> <tr><td>8</td><td>India</td><td align=right>442</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>388</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>367</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>413872</td></tr> <tr><td>2</td><td align=right>2222</td><td align=right>43769</td></tr> <tr><td>3</td><td align=right>2231</td><td align=right>43023</td></tr> <tr><td>4</td><td align=right>22</td><td align=right>42153</td></tr> <tr><td>5</td><td align=right>2209</td><td align=right>41936</td></tr> <tr><td>6</td><td align=right>1122</td><td align=right>40901</td></tr> <tr><td>7</td><td align=right>23</td><td align=right>36120</td></tr> <tr><td>8</td><td align=right>622</td><td align=right>31420</td></tr> <tr><td>9</td><td align=right>1919</td><td align=right>29777</td></tr> <tr><td>10</td><td align=right>30</td><td align=right>27165</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-45499668294582435332026-05-06T15:45:00.001+01:002026-05-06T15:45:47.450+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-05 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 22165<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20932<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1570</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1455</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1015</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1014</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>954</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>546</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>9</td><td>cloud</td><td align=right>321</td></tr> <tr><td>10</td><td>VOLCANO-ENGINE</td><td align=right>314</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9586</td></tr> <tr><td>2</td><td>China</td><td align=right>3688</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>873</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>867</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>616</td></tr> <tr><td>6</td><td>Germany</td><td align=right>587</td></tr> <tr><td>7</td><td>France</td><td align=right>583</td></tr> <tr><td>8</td><td>India</td><td align=right>411</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>388</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>358</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>459548</td></tr> <tr><td>2</td><td align=right>2209</td><td align=right>53517</td></tr> <tr><td>3</td><td align=right>3014</td><td align=right>38860</td></tr> <tr><td>4</td><td align=right>23</td><td align=right>37450</td></tr> <tr><td>5</td><td align=right>1122</td><td align=right>36217</td></tr> <tr><td>6</td><td align=right>22</td><td align=right>36165</td></tr> <tr><td>7</td><td align=right>2222</td><td align=right>34731</td></tr> <tr><td>8</td><td align=right>4709</td><td align=right>28937</td></tr> <tr><td>9</td><td align=right>7622</td><td align=right>27438</td></tr> <tr><td>10</td><td align=right>2622</td><td align=right>24403</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-18369570785421851412026-05-05T11:34:00.000+01:002026-05-05T11:34:01.052+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-04 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21411<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19960<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1579</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1454</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1023</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>954</td></tr> <tr><td>5</td><td>INFRAWATCH</td><td align=right>748</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>541</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>308</td></tr> <tr><td>10</td><td>cloud</td><td align=right>303</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9010</td></tr> <tr><td>2</td><td>China</td><td align=right>3761</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>880</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>854</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>585</td></tr> <tr><td>6</td><td>France</td><td align=right>564</td></tr> <tr><td>7</td><td>Brazil</td><td align=right>455</td></tr> <tr><td>8</td><td>India</td><td align=right>376</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>348</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>331</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>419293</td></tr> <tr><td>2</td><td align=right>2209</td><td align=right>54126</td></tr> <tr><td>3</td><td align=right>23</td><td align=right>43051</td></tr> <tr><td>4</td><td align=right>450</td><td align=right>38936</td></tr> <tr><td>5</td><td align=right>3014</td><td align=right>36566</td></tr> <tr><td>6</td><td align=right>2280</td><td align=right>35091</td></tr> <tr><td>7</td><td align=right>8821</td><td align=right>32022</td></tr> <tr><td>8</td><td align=right>2222</td><td align=right>29268</td></tr> <tr><td>9</td><td align=right>22</td><td align=right>28994</td></tr> <tr><td>10</td><td align=right>1122</td><td align=right>27074</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-65474504874830084262026-05-04T11:45:00.001+01:002026-05-04T11:45:08.658+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-03 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21773<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20593<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1545</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1463</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1041</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1001</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>952</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>545</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>9</td><td>cloud</td><td align=right>335</td></tr> <tr><td>10</td><td>VOLCANO-ENGINE</td><td align=right>310</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9713</td></tr> <tr><td>2</td><td>China</td><td align=right>3490</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>925</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>908</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>593</td></tr> <tr><td>6</td><td>France</td><td align=right>571</td></tr> <tr><td>7</td><td>Germany</td><td align=right>565</td></tr> <tr><td>8</td><td>Brazil</td><td align=right>484</td></tr> <tr><td>9</td><td>India</td><td align=right>357</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>330</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>474450</td></tr> <tr><td>2</td><td align=right>7777</td><td align=right>147065</td></tr> <tr><td>3</td><td align=right>58603</td><td align=right>135049</td></tr> <tr><td>4</td><td align=right>23</td><td align=right>87962</td></tr> <tr><td>5</td><td align=right>8821</td><td align=right>72995</td></tr> <tr><td>6</td><td align=right>3306</td><td align=right>72862</td></tr> <tr><td>7</td><td align=right>450</td><td align=right>63842</td></tr> <tr><td>8</td><td align=right>5357</td><td align=right>58961</td></tr> <tr><td>9</td><td align=right>2209</td><td align=right>54121</td></tr> <tr><td>10</td><td align=right>2252</td><td align=right>51267</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-388817822982434842026-05-03T14:21:00.003+01:002026-05-03T14:21:58.747+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-02 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 21303<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20049<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1490</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1451</td></tr> <tr><td>3</td><td>INFRAWATCH</td><td align=right>1035</td></tr> <tr><td>4</td><td>GOOGLE-CLOUD</td><td align=right>1033</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>954</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>523</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>9</td><td>cloud</td><td align=right>337</td></tr> <tr><td>10</td><td>VOLCANO-ENGINE</td><td align=right>321</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8832</td></tr> <tr><td>2</td><td>China</td><td align=right>3555</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>877</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>871</td></tr> <tr><td>5</td><td>Germany</td><td align=right>646</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>591</td></tr> <tr><td>7</td><td>France</td><td align=right>577</td></tr> <tr><td>8</td><td>Brazil</td><td align=right>510</td></tr> <tr><td>9</td><td>India</td><td align=right>459</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>334</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>487709</td></tr> <tr><td>2</td><td align=right>23</td><td align=right>142035</td></tr> <tr><td>3</td><td align=right>7777</td><td align=right>125922</td></tr> <tr><td>4</td><td align=right>58603</td><td align=right>80778</td></tr> <tr><td>5</td><td align=right>8088</td><td align=right>62554</td></tr> <tr><td>6</td><td align=right>2252</td><td align=right>51265</td></tr> <tr><td>7</td><td align=right>8082</td><td align=right>40174</td></tr> <tr><td>8</td><td align=right>51005</td><td align=right>37866</td></tr> <tr><td>9</td><td align=right>11361</td><td align=right>36255</td></tr> <tr><td>10</td><td align=right>2209</td><td align=right>35092</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-73941368625170270172026-05-02T11:38:00.002+01:002026-05-02T11:38:36.901+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/05/daily-zombie-lists-for-may-2026202605ip.html">Daily Zombie IP Lists for May 2026</a>.<br /> detection period: 2026-05-01 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 22256<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20879<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1519</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1453</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1042</td></tr> <tr><td>4</td><td>INFRAWATCH</td><td align=right>1004</td></tr> <tr><td>5</td><td>PAN-22</td><td align=right>952</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>516</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>382</td></tr> <tr><td>9</td><td>cloud</td><td align=right>316</td></tr> <tr><td>10</td><td>VOLCANO-ENGINE</td><td align=right>312</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9335</td></tr> <tr><td>2</td><td>China</td><td align=right>3328</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>914</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>876</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>644</td></tr> <tr><td>6</td><td>Germany</td><td align=right>630</td></tr> <tr><td>7</td><td>France</td><td align=right>620</td></tr> <tr><td>8</td><td>India</td><td align=right>535</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>500</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>365</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>457650</td></tr> <tr><td>2</td><td align=right>23</td><td align=right>314304</td></tr> <tr><td>3</td><td align=right>8088</td><td align=right>116313</td></tr> <tr><td>4</td><td align=right>8594</td><td align=right>71640</td></tr> <tr><td>5</td><td align=right>7777</td><td align=right>62648</td></tr> <tr><td>6</td><td align=right>2252</td><td align=right>51004</td></tr> <tr><td>7</td><td align=right>2278</td><td align=right>49064</td></tr> <tr><td>8</td><td align=right>22</td><td align=right>35287</td></tr> <tr><td>9</td><td align=right>2108</td><td align=right>29040</td></tr> <tr><td>10</td><td align=right>1122</td><td align=right>25791</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-85634758765216662102026-05-02T06:16:00.006+01:002026-05-07T11:49:14.525+01:00To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:<div>為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：</div><div><br /></div> <div>Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;</div><div>第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；</div> <div>Column 2: Zombie IP;</div><div>第2欄：該殭屍電腦的IP位址；</div> <div>Column 3: TCP destination port number scanned by the zombie.</div><div>第3欄：該殭屍電腦所掃描的TCP埠號。</div><div><br /></div> <div>Join the "<a href="https://t.me/szipl">Suspected Zombie IP List</a>" Telegram channel to get notified when the latest data are ready for download.</div><div>想在第一時間取得資料下載網址？請加入<a href="https://t.me/szipl">Suspected Zombie IP List</a>的Telegram頻道。</div><div><br /></div> <div>Here are the download links of the daily zombie IP lists for May 2026 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):</div><div>以下是2026年05月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：</div><div><br /></div> <div>05/01: <a href="https://www.mediafire.com/file/2dg5r51wa8cjge1/260501_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: b5c91d5b9d5abfaad8916d4dca40e513</div> <div>05/02: <a href="https://www.mediafire.com/file/8uzv4z4uvux4hv0/260502_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 3f90f43a49a1237f31d70928f550657b</div> <div>05/03: <a href="https://www.mediafire.com/file/t1tksctadpw4oqx/260503_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: be255f5cc7e639f4e2dfc47d9a316d0b</div> <div>05/04: <a href="https://www.mediafire.com/file/ewr2zrpbwwgaemu/260504_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: d74330fbc22a11ab01e404ced57517e4</div> <div>05/05: <a href="https://www.mediafire.com/file/glqnf0tmqs8ww48/260505_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: e180e5d4af90c746608c5de74a825747</div> <div>05/06: <a href="https://www.mediafire.com/file/9qi0s91gosjh23t/260506_zombie_ip.csv/file">download link 下載網址</a>; MD5sum: 50f2a61d0edf5ff9b17043817c09beb2</div> <div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-63532078018389709162026-05-01T15:25:00.002+01:002026-05-01T15:25:58.361+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-30 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 23468<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 22016<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1544</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1517</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1050</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>955</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>481</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>332</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>319</td></tr> <tr><td>10</td><td>cloud</td><td align=right>289</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>10258</td></tr> <tr><td>2</td><td>China</td><td align=right>3500</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1032</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>871</td></tr> <tr><td>5</td><td>Germany</td><td align=right>692</td></tr> <tr><td>6</td><td>India</td><td align=right>564</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>558</td></tr> <tr><td>8</td><td>France</td><td align=right>533</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>435</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>391</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>520702</td></tr> <tr><td>2</td><td align=right>23</td><td align=right>362870</td></tr> <tr><td>3</td><td align=right>110</td><td align=right>116158</td></tr> <tr><td>4</td><td align=right>9011</td><td align=right>63360</td></tr> <tr><td>5</td><td align=right>2252</td><td align=right>51291</td></tr> <tr><td>6</td><td align=right>8088</td><td align=right>38545</td></tr> <tr><td>7</td><td align=right>22</td><td align=right>31388</td></tr> <tr><td>8</td><td align=right>8082</td><td align=right>28084</td></tr> <tr><td>9</td><td align=right>8015</td><td align=right>27449</td></tr> <tr><td>10</td><td align=right>1122</td><td align=right>25417</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-60406585023603837522026-04-30T15:37:00.001+01:002026-04-30T15:37:05.886+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-29 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19977<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18792<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1560</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1465</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1051</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>523</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>332</td></tr> <tr><td>9</td><td>cloud</td><td align=right>330</td></tr> <tr><td>10</td><td>VOLCANO-ENGINE</td><td align=right>317</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8622</td></tr> <tr><td>2</td><td>China</td><td align=right>3445</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>916</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>743</td></tr> <tr><td>5</td><td>Germany</td><td align=right>575</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>489</td></tr> <tr><td>7</td><td>France</td><td align=right>484</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>390</td></tr> <tr><td>9</td><td>India</td><td align=right>375</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>336</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>539172</td></tr> <tr><td>2</td><td align=right>110</td><td align=right>233153</td></tr> <tr><td>3</td><td align=right>8088</td><td align=right>218874</td></tr> <tr><td>4</td><td align=right>8082</td><td align=right>103115</td></tr> <tr><td>5</td><td align=right>8787</td><td align=right>67816</td></tr> <tr><td>6</td><td align=right>2252</td><td align=right>44781</td></tr> <tr><td>7</td><td align=right>8015</td><td align=right>44585</td></tr> <tr><td>8</td><td align=right>5432</td><td align=right>36567</td></tr> <tr><td>9</td><td align=right>2208</td><td align=right>36335</td></tr> <tr><td>10</td><td align=right>2222</td><td align=right>33452</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-84147991176656293042026-04-29T15:51:00.000+01:002026-04-29T15:51:06.081+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-28 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20862<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19562<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1529</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1438</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1031</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>955</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>492</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>400</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>382</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>332</td></tr> <tr><td>9</td><td>INFRAWATCH</td><td align=right>331</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>266</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9090</td></tr> <tr><td>2</td><td>China</td><td align=right>3687</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1022</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>712</td></tr> <tr><td>5</td><td>Germany</td><td align=right>532</td></tr> <tr><td>6</td><td>France</td><td align=right>518</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>502</td></tr> <tr><td>8</td><td>Brazil</td><td align=right>412</td></tr> <tr><td>9</td><td>Hong Kong</td><td align=right>369</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>343</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>523212</td></tr> <tr><td>2</td><td align=right>221</td><td align=right>76914</td></tr> <tr><td>3</td><td align=right>2208</td><td align=right>41100</td></tr> <tr><td>4</td><td align=right>8088</td><td align=right>36821</td></tr> <tr><td>5</td><td align=right>22</td><td align=right>32698</td></tr> <tr><td>6</td><td align=right>1122</td><td align=right>25098</td></tr> <tr><td>7</td><td align=right>110</td><td align=right>23259</td></tr> <tr><td>8</td><td align=right>8082</td><td align=right>22095</td></tr> <tr><td>9</td><td align=right>3503</td><td align=right>19768</td></tr> <tr><td>10</td><td align=right>5700</td><td align=right>18120</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-81444251016705775202026-04-28T13:27:00.002+01:002026-04-28T13:27:36.544+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-27 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19945<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18873<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1558</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1470</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1046</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>516</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>408</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>341</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>328</td></tr> <tr><td>10</td><td>cloud</td><td align=right>328</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8461</td></tr> <tr><td>2</td><td>China</td><td align=right>3613</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1004</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>849</td></tr> <tr><td>5</td><td>France</td><td align=right>542</td></tr> <tr><td>6</td><td>Germany</td><td align=right>497</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>457</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>398</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>381</td></tr> <tr><td>10</td><td>Hong Kong</td><td align=right>378</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>427329</td></tr> <tr><td>2</td><td align=right>7473</td><td align=right>58093</td></tr> <tr><td>3</td><td align=right>5357</td><td align=right>47430</td></tr> <tr><td>4</td><td align=right>9164</td><td align=right>46909</td></tr> <tr><td>5</td><td align=right>2208</td><td align=right>41718</td></tr> <tr><td>6</td><td align=right>4922</td><td align=right>39986</td></tr> <tr><td>7</td><td align=right>8020</td><td align=right>38776</td></tr> <tr><td>8</td><td align=right>1890</td><td align=right>38355</td></tr> <tr><td>9</td><td align=right>9443</td><td align=right>33069</td></tr> <tr><td>10</td><td align=right>22</td><td align=right>30496</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-5713224863025050242026-04-28T03:17:00.001+01:002026-04-28T03:17:29.133+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-26 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20234<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19208<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1484</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1453</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1032</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>504</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>8</td><td>INFRAWATCH</td><td align=right>342</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>332</td></tr> <tr><td>10</td><td>cloud</td><td align=right>326</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9131</td></tr> <tr><td>2</td><td>China</td><td align=right>3547</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1019</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>729</td></tr> <tr><td>5</td><td>France</td><td align=right>579</td></tr> <tr><td>6</td><td>Germany</td><td align=right>552</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>497</td></tr> <tr><td>8</td><td>Hong Kong</td><td align=right>388</td></tr> <tr><td>9</td><td>Brazil</td><td align=right>376</td></tr> <tr><td>10</td><td>Indonesia</td><td align=right>308</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>7473</td><td align=right>1090355</td></tr> <tr><td>2</td><td align=right>9164</td><td align=right>883850</td></tr> <tr><td>3</td><td align=right>5900</td><td align=right>425771</td></tr> <tr><td>4</td><td align=right>8153</td><td align=right>368941</td></tr> <tr><td>5</td><td align=right>7787</td><td align=right>315747</td></tr> <tr><td>6</td><td align=right>4092</td><td align=right>250802</td></tr> <tr><td>7</td><td align=right>4030</td><td align=right>188501</td></tr> <tr><td>8</td><td align=right>9559</td><td align=right>185525</td></tr> <tr><td>9</td><td align=right>1871</td><td align=right>171476</td></tr> <tr><td>10</td><td align=right>5357</td><td align=right>151475</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-71235368781575041822026-04-26T11:07:00.002+01:002026-04-26T11:07:23.442+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-25 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19902<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18894<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1516</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1461</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1007</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>953</td></tr> <tr><td>5</td><td>CLOUDFLARENET</td><td align=right>727</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>528</td></tr> <tr><td>7</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>375</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>314</td></tr> <tr><td>10</td><td>cloud</td><td align=right>310</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8995</td></tr> <tr><td>2</td><td>China</td><td align=right>3557</td></tr> <tr><td>3</td><td>United Kingdom</td><td align=right>1013</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>837</td></tr> <tr><td>5</td><td>France</td><td align=right>569</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>448</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>371</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>347</td></tr> <tr><td>9</td><td>India</td><td align=right>296</td></tr> <tr><td>10</td><td>Brazil</td><td align=right>271</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>358994</td></tr> <tr><td>2</td><td align=right>7473</td><td align=right>283595</td></tr> <tr><td>3</td><td align=right>4092</td><td align=right>275193</td></tr> <tr><td>4</td><td align=right>9164</td><td align=right>210557</td></tr> <tr><td>5</td><td align=right>25900</td><td align=right>189419</td></tr> <tr><td>6</td><td align=right>8153</td><td align=right>188548</td></tr> <tr><td>7</td><td align=right>1871</td><td align=right>186305</td></tr> <tr><td>8</td><td align=right>6689</td><td align=right>186070</td></tr> <tr><td>9</td><td align=right>1890</td><td align=right>160476</td></tr> <tr><td>10</td><td align=right>5356</td><td align=right>144340</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-2026909274039046962026-04-25T11:52:00.001+01:002026-04-25T11:52:15.052+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-24 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18506<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17478<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1459</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1449</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1033</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>956</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>514</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>382</td></tr> <tr><td>8</td><td>cloud</td><td align=right>330</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>317</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>268</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8157</td></tr> <tr><td>2</td><td>China</td><td align=right>3372</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>856</td></tr> <tr><td>4</td><td>United Kingdom</td><td align=right>614</td></tr> <tr><td>5</td><td>France</td><td align=right>558</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>379</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>373</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>366</td></tr> <tr><td>9</td><td>India</td><td align=right>311</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>261</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>330385</td></tr> <tr><td>2</td><td align=right>2232</td><td align=right>70215</td></tr> <tr><td>3</td><td align=right>8015</td><td align=right>56029</td></tr> <tr><td>4</td><td align=right>5357</td><td align=right>55925</td></tr> <tr><td>5</td><td align=right>8088</td><td align=right>52429</td></tr> <tr><td>6</td><td align=right>5408</td><td align=right>45098</td></tr> <tr><td>7</td><td align=right>8000</td><td align=right>35728</td></tr> <tr><td>8</td><td align=right>6318</td><td align=right>34615</td></tr> <tr><td>9</td><td align=right>7277</td><td align=right>29787</td></tr> <tr><td>10</td><td align=right>2078</td><td align=right>29153</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-22800199009502458512026-04-24T14:31:00.002+01:002026-04-24T14:31:31.839+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-23 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18755<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17701<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1412</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1316</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1042</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>948</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>489</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>8</td><td>cloud</td><td align=right>323</td></tr> <tr><td>9</td><td>VOLCANO-ENGINE</td><td align=right>318</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>276</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8781</td></tr> <tr><td>2</td><td>China</td><td align=right>3330</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>841</td></tr> <tr><td>4</td><td>France</td><td align=right>580</td></tr> <tr><td>5</td><td>Indonesia</td><td align=right>393</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>379</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>375</td></tr> <tr><td>8</td><td>India</td><td align=right>302</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>281</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>266</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>345085</td></tr> <tr><td>2</td><td align=right>1599</td><td align=right>83037</td></tr> <tr><td>3</td><td align=right>8000</td><td align=right>76103</td></tr> <tr><td>4</td><td align=right>2232</td><td align=right>69911</td></tr> <tr><td>5</td><td align=right>3128</td><td align=right>65979</td></tr> <tr><td>6</td><td align=right>8082</td><td align=right>65939</td></tr> <tr><td>7</td><td align=right>7777</td><td align=right>62047</td></tr> <tr><td>8</td><td align=right>5408</td><td align=right>56980</td></tr> <tr><td>9</td><td align=right>5627</td><td align=right>51494</td></tr> <tr><td>10</td><td align=right>21293</td><td align=right>44442</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-15803074017943534962026-04-23T12:21:00.002+01:002026-04-23T12:21:52.761+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-22 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 18829<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17676<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1461</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1341</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1016</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>464</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>380</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>323</td></tr> <tr><td>9</td><td>cloud</td><td align=right>304</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>272</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8366</td></tr> <tr><td>2</td><td>China</td><td align=right>3459</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>779</td></tr> <tr><td>4</td><td>France</td><td align=right>596</td></tr> <tr><td>5</td><td>Indonesia</td><td align=right>427</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>398</td></tr> <tr><td>7</td><td>Netherlands</td><td align=right>381</td></tr> <tr><td>8</td><td>India</td><td align=right>329</td></tr> <tr><td>9</td><td>Germany</td><td align=right>321</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>298</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>280551</td></tr> <tr><td>2</td><td align=right>2232</td><td align=right>69873</td></tr> <tr><td>3</td><td align=right>9051</td><td align=right>65654</td></tr> <tr><td>4</td><td align=right>7777</td><td align=right>49464</td></tr> <tr><td>5</td><td align=right>8082</td><td align=right>48367</td></tr> <tr><td>6</td><td align=right>8000</td><td align=right>46453</td></tr> <tr><td>7</td><td align=right>8088</td><td align=right>28007</td></tr> <tr><td>8</td><td align=right>2109</td><td align=right>25745</td></tr> <tr><td>9</td><td align=right>8081</td><td align=right>25081</td></tr> <tr><td>10</td><td align=right>2511</td><td align=right>24240</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-68660605059176746092026-04-22T11:48:00.002+01:002026-04-22T11:48:47.159+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-21 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 20123<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18939<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1592</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1406</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1009</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>561</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>393</td></tr> <tr><td>8</td><td>CENSY</td><td align=right>366</td></tr> <tr><td>9</td><td>cloud</td><td align=right>331</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>273</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>9327</td></tr> <tr><td>2</td><td>China</td><td align=right>3396</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>859</td></tr> <tr><td>4</td><td>France</td><td align=right>613</td></tr> <tr><td>5</td><td>Indonesia</td><td align=right>483</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>451</td></tr> <tr><td>7</td><td>Hong Kong</td><td align=right>405</td></tr> <tr><td>8</td><td>India</td><td align=right>389</td></tr> <tr><td>9</td><td>Germany</td><td align=right>335</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>308</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>373637</td></tr> <tr><td>2</td><td align=right>2232</td><td align=right>75172</td></tr> <tr><td>3</td><td align=right>4157</td><td align=right>52271</td></tr> <tr><td>4</td><td align=right>2288</td><td align=right>50693</td></tr> <tr><td>5</td><td align=right>3098</td><td align=right>43832</td></tr> <tr><td>6</td><td align=right>9051</td><td align=right>37750</td></tr> <tr><td>7</td><td align=right>8000</td><td align=right>36095</td></tr> <tr><td>8</td><td align=right>7777</td><td align=right>33120</td></tr> <tr><td>9</td><td align=right>8082</td><td align=right>32861</td></tr> <tr><td>10</td><td align=right>2509</td><td align=right>30024</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-4580003486280041492026-04-21T13:56:00.001+01:002026-04-21T13:56:15.289+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-20 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17161<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15971<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1480</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1375</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1018</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>469</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>352</td></tr> <tr><td>9</td><td>UCLOUD-HK</td><td align=right>268</td></tr> <tr><td>10</td><td>FR-ONYPHE-20221109</td><td align=right>240</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8030</td></tr> <tr><td>2</td><td>China</td><td align=right>3028</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>747</td></tr> <tr><td>4</td><td>France</td><td align=right>559</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>410</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>362</td></tr> <tr><td>7</td><td>India</td><td align=right>299</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>290</td></tr> <tr><td>9</td><td>United Kingdom</td><td align=right>242</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>240</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>324826</td></tr> <tr><td>2</td><td align=right>8473</td><td align=right>105547</td></tr> <tr><td>3</td><td align=right>6085</td><td align=right>96090</td></tr> <tr><td>4</td><td align=right>5106</td><td align=right>79927</td></tr> <tr><td>5</td><td align=right>7697</td><td align=right>78305</td></tr> <tr><td>6</td><td align=right>2232</td><td align=right>75409</td></tr> <tr><td>7</td><td align=right>3098</td><td align=right>72963</td></tr> <tr><td>8</td><td align=right>25002</td><td align=right>69242</td></tr> <tr><td>9</td><td align=right>667</td><td align=right>65996</td></tr> <tr><td>10</td><td align=right>2288</td><td align=right>62137</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-74033335511157322292026-04-20T11:50:00.002+01:002026-04-20T11:50:51.987+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-19 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17119<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16137<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1463</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1376</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1002</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>489</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>381</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>345</td></tr> <tr><td>9</td><td>cloud</td><td align=right>310</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>256</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8533</td></tr> <tr><td>2</td><td>China</td><td align=right>2896</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>800</td></tr> <tr><td>4</td><td>France</td><td align=right>590</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>385</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>345</td></tr> <tr><td>7</td><td>Germany</td><td align=right>253</td></tr> <tr><td>8</td><td>United Kingdom</td><td align=right>250</td></tr> <tr><td>9</td><td>India</td><td align=right>233</td></tr> <tr><td>10</td><td>Russian Federation</td><td align=right>217</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>249425</td></tr> <tr><td>2</td><td align=right>25002</td><td align=right>103579</td></tr> <tr><td>3</td><td align=right>2232</td><td align=right>72918</td></tr> <tr><td>4</td><td align=right>2222</td><td align=right>71187</td></tr> <tr><td>5</td><td align=right>6022</td><td align=right>65771</td></tr> <tr><td>6</td><td align=right>2095</td><td align=right>65198</td></tr> <tr><td>7</td><td align=right>2020</td><td align=right>62177</td></tr> <tr><td>8</td><td align=right>9443</td><td align=right>61318</td></tr> <tr><td>9</td><td align=right>2083</td><td align=right>61264</td></tr> <tr><td>10</td><td align=right>2288</td><td align=right>60761</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-56994821736700097802026-04-19T14:33:00.002+01:002026-04-19T14:33:52.052+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-18 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 16828<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15826<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1509</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1403</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1017</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>490</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>447</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>344</td></tr> <tr><td>9</td><td>cloud</td><td align=right>320</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>251</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8149</td></tr> <tr><td>2</td><td>China</td><td align=right>3009</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>781</td></tr> <tr><td>4</td><td>France</td><td align=right>556</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>388</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>346</td></tr> <tr><td>7</td><td>Germany</td><td align=right>290</td></tr> <tr><td>8</td><td>India</td><td align=right>254</td></tr> <tr><td>9</td><td>Indonesia</td><td align=right>246</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>227</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>259718</td></tr> <tr><td>2</td><td align=right>2095</td><td align=right>172823</td></tr> <tr><td>3</td><td align=right>2222</td><td align=right>134768</td></tr> <tr><td>4</td><td align=right>25002</td><td align=right>104111</td></tr> <tr><td>5</td><td align=right>2232</td><td align=right>75862</td></tr> <tr><td>6</td><td align=right>6022</td><td align=right>67848</td></tr> <tr><td>7</td><td align=right>2020</td><td align=right>65393</td></tr> <tr><td>8</td><td align=right>2288</td><td align=right>62816</td></tr> <tr><td>9</td><td align=right>2083</td><td align=right>61961</td></tr> <tr><td>10</td><td align=right>9088</td><td align=right>55199</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-1326094399561683012026-04-18T15:46:00.000+01:002026-04-18T15:46:01.247+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-17 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17754<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16748<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>AL-3</td><td align=right>1514</td></tr> <tr><td>2</td><td>MSFT</td><td align=right>1391</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>998</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>ASEPL-SG</td><td align=right>485</td></tr> <tr><td>6</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>371</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>350</td></tr> <tr><td>9</td><td>cloud</td><td align=right>287</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>264</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8071</td></tr> <tr><td>2</td><td>China</td><td align=right>3888</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>783</td></tr> <tr><td>4</td><td>France</td><td align=right>545</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>380</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>363</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>272</td></tr> <tr><td>8</td><td>India</td><td align=right>270</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>256</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>235</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>323673</td></tr> <tr><td>2</td><td align=right>25002</td><td align=right>86046</td></tr> <tr><td>3</td><td align=right>2232</td><td align=right>81004</td></tr> <tr><td>4</td><td align=right>6022</td><td align=right>66146</td></tr> <tr><td>5</td><td align=right>10017</td><td align=right>65188</td></tr> <tr><td>6</td><td align=right>2288</td><td align=right>62914</td></tr> <tr><td>7</td><td align=right>2222</td><td align=right>62611</td></tr> <tr><td>8</td><td align=right>2185</td><td align=right>61707</td></tr> <tr><td>9</td><td align=right>2020</td><td align=right>60505</td></tr> <tr><td>10</td><td align=right>1470</td><td align=right>58828</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-58790188996071067222026-04-17T13:10:00.002+01:002026-04-17T13:10:26.595+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-16 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 19067<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18077<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1368</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1367</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1009</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>951</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>6</td><td>ASEPL-SG</td><td align=right>428</td></tr> <tr><td>7</td><td>CENSY</td><td align=right>367</td></tr> <tr><td>8</td><td>VOLCANO-ENGINE</td><td align=right>343</td></tr> <tr><td>9</td><td>cloud</td><td align=right>328</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>252</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8485</td></tr> <tr><td>2</td><td>China</td><td align=right>4678</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>763</td></tr> <tr><td>4</td><td>France</td><td align=right>603</td></tr> <tr><td>5</td><td>Netherlands</td><td align=right>360</td></tr> <tr><td>6</td><td>Hong Kong</td><td align=right>351</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>279</td></tr> <tr><td>8</td><td>India</td><td align=right>276</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>251</td></tr> <tr><td>10</td><td>Germany</td><td align=right>251</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>355592</td></tr> <tr><td>2</td><td align=right>2222</td><td align=right>115091</td></tr> <tr><td>3</td><td align=right>7777</td><td align=right>106000</td></tr> <tr><td>4</td><td align=right>8085</td><td align=right>94842</td></tr> <tr><td>5</td><td align=right>9110</td><td align=right>86223</td></tr> <tr><td>6</td><td align=right>2232</td><td align=right>81571</td></tr> <tr><td>7</td><td align=right>23401</td><td align=right>68250</td></tr> <tr><td>8</td><td align=right>2288</td><td align=right>63004</td></tr> <tr><td>9</td><td align=right>992</td><td align=right>57187</td></tr> <tr><td>10</td><td align=right>5431</td><td align=right>54939</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-6659330556061693082026-04-16T11:23:00.001+01:002026-04-16T11:23:35.843+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-15 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 16139<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 15135<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1386</td></tr> <tr><td>2</td><td>GOOGLE-CLOUD</td><td align=right>1003</td></tr> <tr><td>3</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>891</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>6</td><td>CENSY</td><td align=right>372</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>355</td></tr> <tr><td>8</td><td>cloud</td><td align=right>332</td></tr> <tr><td>9</td><td>ASEPL-SG</td><td align=right>267</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>250</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7677</td></tr> <tr><td>2</td><td>China</td><td align=right>3003</td></tr> <tr><td>3</td><td>France</td><td align=right>587</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>491</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>357</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>343</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>280</td></tr> <tr><td>8</td><td>India</td><td align=right>260</td></tr> <tr><td>9</td><td>Viet Nam</td><td align=right>238</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>235</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>7777</td><td align=right>411683</td></tr> <tr><td>2</td><td align=right>8015</td><td align=right>330945</td></tr> <tr><td>3</td><td align=right>5900</td><td align=right>298423</td></tr> <tr><td>4</td><td align=right>9443</td><td align=right>297709</td></tr> <tr><td>5</td><td align=right>2095</td><td align=right>246598</td></tr> <tr><td>6</td><td align=right>2222</td><td align=right>171490</td></tr> <tr><td>7</td><td align=right>5357</td><td align=right>115521</td></tr> <tr><td>8</td><td align=right>8000</td><td align=right>86595</td></tr> <tr><td>9</td><td align=right>8085</td><td align=right>83589</td></tr> <tr><td>10</td><td align=right>2232</td><td align=right>78208</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-40970871089769986472026-04-15T11:31:00.000+01:002026-04-15T11:31:07.617+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-14 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17455<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16757<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1379</td></tr> <tr><td>2</td><td>GOOGLE-CLOUD</td><td align=right>1002</td></tr> <tr><td>3</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>4</td><td>AL-3</td><td align=right>925</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>6</td><td>CENSY</td><td align=right>377</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>351</td></tr> <tr><td>8</td><td>ASEPL-SG</td><td align=right>292</td></tr> <tr><td>9</td><td>cloud</td><td align=right>290</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>256</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>8225</td></tr> <tr><td>2</td><td>China</td><td align=right>3397</td></tr> <tr><td>3</td><td>France</td><td align=right>552</td></tr> <tr><td>4</td><td>Singapore</td><td align=right>506</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>372</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>360</td></tr> <tr><td>7</td><td>Germany</td><td align=right>307</td></tr> <tr><td>8</td><td>Indonesia</td><td align=right>293</td></tr> <tr><td>9</td><td>United Kingdom</td><td align=right>268</td></tr> <tr><td>10</td><td>Viet Nam</td><td align=right>254</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>7777</td><td align=right>489497</td></tr> <tr><td>2</td><td align=right>5900</td><td align=right>305280</td></tr> <tr><td>3</td><td align=right>9443</td><td align=right>238549</td></tr> <tr><td>4</td><td align=right>8015</td><td align=right>238146</td></tr> <tr><td>5</td><td align=right>2095</td><td align=right>191655</td></tr> <tr><td>6</td><td align=right>2222</td><td align=right>116843</td></tr> <tr><td>7</td><td align=right>8082</td><td align=right>105349</td></tr> <tr><td>8</td><td align=right>25</td><td align=right>102724</td></tr> <tr><td>9</td><td align=right>8000</td><td align=right>79587</td></tr> <tr><td>10</td><td align=right>2232</td><td align=right>76403</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0tag:blogger.com,1999:blog-6771384631375175679.post-78205174460770896832026-04-14T16:31:00.001+01:002026-04-14T16:31:25.999+01:00(To download the latest zombie ip list, please visit the <a href="https://botnet-tracker.blogspot.com/2026/04/daily-zombie-lists-for-april.html">Daily Zombie IP Lists for April 2026</a>.<br /> detection period: 2026-04-13 00:00-23:59 UTC<br /> total number of suspected botnet IPs: 17557<br /> number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16838<br /> number of spam blocked: 0<br /> recipient count of spam blocked: 0<br /> <br /> The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"><div class="nobrtable"><br /> </div><table border="1"><tbody> <tr><th>Rank</th><th>Network</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>MSFT</td><td align=right>1391</td></tr> <tr><td>2</td><td>AL-3</td><td align=right>1148</td></tr> <tr><td>3</td><td>GOOGLE-CLOUD</td><td align=right>1004</td></tr> <tr><td>4</td><td>PAN-22</td><td align=right>950</td></tr> <tr><td>5</td><td>FR-ONYPHE-20191111</td><td align=right>448</td></tr> <tr><td>6</td><td>CENSY</td><td align=right>379</td></tr> <tr><td>7</td><td>VOLCANO-ENGINE</td><td align=right>360</td></tr> <tr><td>8</td><td>cloud</td><td align=right>340</td></tr> <tr><td>9</td><td>ASEPL-SG</td><td align=right>313</td></tr> <tr><td>10</td><td>UCLOUD-HK</td><td align=right>258</td></tr> </tbody></table><br /></div><br /> <div class="nobrtable">The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:</div><div class="nobrtable"><style type="text/css"> .nobrtable br { display: none } </style><br /><table border="1"><tbody> <tr><th>Rank</th><th>Country/Region</th><th># of suspected botnet IPs</th></tr> <tr><td>1</td><td>United States</td><td align=right>7884</td></tr> <tr><td>2</td><td>China</td><td align=right>3904</td></tr> <tr><td>3</td><td>Singapore</td><td align=right>640</td></tr> <tr><td>4</td><td>France</td><td align=right>550</td></tr> <tr><td>5</td><td>Hong Kong</td><td align=right>361</td></tr> <tr><td>6</td><td>Netherlands</td><td align=right>338</td></tr> <tr><td>7</td><td>Indonesia</td><td align=right>301</td></tr> <tr><td>8</td><td>India</td><td align=right>288</td></tr> <tr><td>9</td><td>Russian Federation</td><td align=right>258</td></tr> <tr><td>10</td><td>United Kingdom</td><td align=right>246</td></tr> </div> <br /> The top 10 TCP ports, ordered by the number of connection attempts received are:<style type="text/css"> .nobrtable br { display: none } </style><br /> <div class="nobrtable"> <br /> <table border="1"><tbody> <tr><th>Rank</th><th>TCP port number</th><th># of connection attempts received</th></tr> <tr><td>1</td><td align=right>5900</td><td align=right>346775</td></tr> <tr><td>2</td><td align=right>7777</td><td align=right>157905</td></tr> <tr><td>3</td><td align=right>2095</td><td align=right>142649</td></tr> <tr><td>4</td><td align=right>9443</td><td align=right>106940</td></tr> <tr><td>5</td><td align=right>5901</td><td align=right>68145</td></tr> <tr><td>6</td><td align=right>2288</td><td align=right>62980</td></tr> <tr><td>7</td><td align=right>2206</td><td align=right>62242</td></tr> <tr><td>8</td><td align=right>2222</td><td align=right>58353</td></tr> <tr><td>9</td><td align=right>4322</td><td align=right>56679</td></tr> <tr><td>10</td><td align=right>2232</td><td align=right>55898</td></tr> </div><div class="blogger-post-footer">Copyright © 2009-2010 Chih-Cherng Chin</div>Chih-Cherng Chinhttp://www.blogger.com/profile/06399972457729354819noreply@blogger.com0