(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-29 00:00-23:59 UTC
total number of suspected botnet IPs: 21364
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20014
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1425 |
| 2 | GOOGLE-CLOUD | 995 |
| 3 | PAN-22 | 943 |
| 4 | AL-3 | 926 |
| 5 | BYTEPLUS-SG | 882 |
| 6 | ASEPL-SG | 569 |
| 7 | VOLCANO-ENGINE | 560 |
| 8 | ALISOFT | 425 |
| 9 | CENSY | 376 |
| 10 | FR-ONYPHE-20191111 | 368 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8108 |
| 2 | China | 4547 |
| 3 | Singapore | 1655 |
| 4 | Hong Kong | 499 |
| 5 | France | 489 |
| 6 | Indonesia | 409 |
| 7 | United Kingdom | 380 |
| 8 | India | 376 |
| 9 | Germany | 365 |
| 10 | Russian Federation | 331 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 401399 |
| 2 | 822 | 98247 |
| 3 | 7022 | 69465 |
| 4 | 22 | 60095 |
| 5 | 1234 | 57843 |
| 6 | 2112 | 31605 |
| 7 | 23 | 31402 |
| 8 | 2244 | 30684 |
| 9 | 1322 | 26630 |
| 10 | 5901 | 22749 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-28 00:00-23:59 UTC
total number of suspected botnet IPs: 20377
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19218
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1399 |
| 2 | GOOGLE-CLOUD | 1006 |
| 3 | PAN-22 | 949 |
| 4 | AL-3 | 932 |
| 5 | BYTEPLUS-SG | 880 |
| 6 | ASEPL-SG | 571 |
| 7 | VOLCANO-ENGINE | 518 |
| 8 | ALISOFT | 425 |
| 9 | CENSY | 374 |
| 10 | FR-ONYPHE-20191111 | 368 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8276 |
| 2 | China | 4528 |
| 3 | Singapore | 1648 |
| 4 | United Kingdom | 499 |
| 5 | Hong Kong | 473 |
| 6 | France | 453 |
| 7 | Russian Federation | 276 |
| 8 | India | 276 |
| 9 | Germany | 271 |
| 10 | Netherlands | 243 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 403466 |
| 2 | 822 | 103315 |
| 3 | 220 | 81704 |
| 4 | 7777 | 75597 |
| 5 | 7022 | 73620 |
| 6 | 2112 | 54526 |
| 7 | 22 | 52096 |
| 8 | 4040 | 51017 |
| 9 | 2244 | 49205 |
| 10 | 1234 | 36911 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-27 00:00-23:59 UTC
total number of suspected botnet IPs: 19536
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18352
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1380 |
| 2 | GOOGLE-CLOUD | 1006 |
| 3 | PAN-22 | 949 |
| 4 | AL-3 | 947 |
| 5 | BYTEPLUS-SG | 880 |
| 6 | ASEPL-SG | 578 |
| 7 | VOLCANO-ENGINE | 516 |
| 8 | ALISOFT | 425 |
| 9 | CENSY | 378 |
| 10 | FR-ONYPHE-20191111 | 368 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7408 |
| 2 | China | 4495 |
| 3 | Singapore | 1667 |
| 4 | France | 519 |
| 5 | Hong Kong | 497 |
| 6 | United Kingdom | 316 |
| 7 | Germany | 280 |
| 8 | Netherlands | 279 |
| 9 | India | 279 |
| 10 | European Union | 262 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 492238 |
| 2 | 7022 | 74389 |
| 3 | 2244 | 72606 |
| 4 | 7777 | 70714 |
| 5 | 2285 | 64971 |
| 6 | 2112 | 53878 |
| 7 | 4040 | 49858 |
| 8 | 22 | 40982 |
| 9 | 9922 | 35081 |
| 10 | 9191 | 30378 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-26 00:00-23:59 UTC
total number of suspected botnet IPs: 19656
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18531
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1379 |
| 2 | GOOGLE-CLOUD | 1002 |
| 3 | AL-3 | 952 |
| 4 | PAN-22 | 950 |
| 5 | BYTEPLUS-SG | 880 |
| 6 | ASEPL-SG | 578 |
| 7 | VOLCANO-ENGINE | 519 |
| 8 | ALISOFT | 425 |
| 9 | FR-ONYPHE-20191111 | 397 |
| 10 | CENSY | 379 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7518 |
| 2 | China | 4465 |
| 3 | Singapore | 1597 |
| 4 | France | 518 |
| 5 | Hong Kong | 513 |
| 6 | United Kingdom | 336 |
| 7 | India | 304 |
| 8 | European Union | 268 |
| 9 | Russian Federation | 261 |
| 10 | Netherlands | 259 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 556043 |
| 2 | 2244 | 94785 |
| 3 | 1212 | 67798 |
| 4 | 7777 | 66695 |
| 5 | 22 | 53965 |
| 6 | 2112 | 50453 |
| 7 | 4040 | 49183 |
| 8 | 888 | 40661 |
| 9 | 9191 | 28401 |
| 10 | 9901 | 24375 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-25 00:00-23:59 UTC
total number of suspected botnet IPs: 20605
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19423
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1410 |
| 2 | GOOGLE-CLOUD | 1003 |
| 3 | PAN-22 | 949 |
| 4 | AL-3 | 946 |
| 5 | BYTEPLUS-SG | 881 |
| 6 | ASEPL-SG | 590 |
| 7 | VOLCANO-ENGINE | 502 |
| 8 | ALISOFT | 407 |
| 9 | FR-ONYPHE-20191111 | 395 |
| 10 | CENSY | 381 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8127 |
| 2 | China | 4378 |
| 3 | Singapore | 1708 |
| 4 | United Kingdom | 537 |
| 5 | France | 509 |
| 6 | Hong Kong | 487 |
| 7 | India | 342 |
| 8 | South Korea | 290 |
| 9 | Russian Federation | 270 |
| 10 | European Union | 270 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 577357 |
| 2 | 2244 | 82569 |
| 3 | 2181 | 68594 |
| 4 | 1212 | 68013 |
| 5 | 285 | 67892 |
| 6 | 22 | 61375 |
| 7 | 7050 | 58493 |
| 8 | 9901 | 47432 |
| 9 | 9876 | 42025 |
| 10 | 4040 | 41604 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-24 00:00-23:59 UTC
total number of suspected botnet IPs: 17501
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16457
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1344 |
| 2 | GOOGLE-CLOUD | 996 |
| 3 | AL-3 | 964 |
| 4 | PAN-22 | 942 |
| 5 | BYTEPLUS-SG | 880 |
| 6 | ASEPL-SG | 579 |
| 7 | VOLCANO-ENGINE | 503 |
| 8 | ALISOFT | 423 |
| 9 | CENSY | 369 |
| 10 | CMNET | 323 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 6729 |
| 2 | China | 3688 |
| 3 | Singapore | 1628 |
| 4 | Hong Kong | 425 |
| 5 | United Kingdom | 324 |
| 6 | India | 292 |
| 7 | Indonesia | 288 |
| 8 | Netherlands | 274 |
| 9 | European Union | 271 |
| 10 | Russian Federation | 239 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 570957 |
| 2 | 2244 | 80824 |
| 3 | 1212 | 67796 |
| 4 | 22 | 57477 |
| 5 | 1984 | 52746 |
| 6 | 1023 | 32946 |
| 7 | 522 | 29652 |
| 8 | 5022 | 28451 |
| 9 | 53333 | 23610 |
| 10 | 2201 | 22521 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-23 00:00-23:59 UTC
total number of suspected botnet IPs: 20880
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19683
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1359 |
| 2 | GOOGLE-CLOUD | 1014 |
| 3 | AL-3 | 992 |
| 4 | PAN-22 | 949 |
| 5 | BYTEPLUS-SG | 880 |
| 6 | ASEPL-SG | 590 |
| 7 | VOLCANO-ENGINE | 527 |
| 8 | CMNET | 510 |
| 9 | ALISOFT | 416 |
| 10 | CENSY | 379 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7944 |
| 2 | China | 4452 |
| 3 | Singapore | 1757 |
| 4 | Hong Kong | 466 |
| 5 | India | 416 |
| 6 | United Kingdom | 384 |
| 7 | Russian Federation | 382 |
| 8 | Germany | 365 |
| 9 | South Korea | 358 |
| 10 | Indonesia | 335 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 490012 |
| 2 | 522 | 87552 |
| 3 | 2244 | 69986 |
| 4 | 6422 | 62278 |
| 5 | 3303 | 61633 |
| 6 | 1984 | 52691 |
| 7 | 22 | 45553 |
| 8 | 2201 | 43433 |
| 9 | 5022 | 31731 |
| 10 | 1023 | 27946 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-22 00:00-23:59 UTC
total number of suspected botnet IPs: 21059
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19764
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1380 |
| 2 | GOOGLE-CLOUD | 1013 |
| 3 | AL-3 | 1007 |
| 4 | PAN-22 | 944 |
| 5 | BYTEPLUS-SG | 882 |
| 6 | ASEPL-SG | 637 |
| 7 | VOLCANO-ENGINE | 529 |
| 8 | CMNET | 507 |
| 9 | ALISOFT | 425 |
| 10 | CENSY | 374 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7597 |
| 2 | China | 4800 |
| 3 | Singapore | 1784 |
| 4 | Hong Kong | 481 |
| 5 | India | 397 |
| 6 | United Kingdom | 383 |
| 7 | South Korea | 350 |
| 8 | Indonesia | 328 |
| 9 | Russian Federation | 327 |
| 10 | Netherlands | 314 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 476422 |
| 2 | 2227 | 108900 |
| 3 | 6422 | 103385 |
| 4 | 522 | 86983 |
| 5 | 2244 | 49998 |
| 6 | 22 | 49758 |
| 7 | 2201 | 41707 |
| 8 | 4422 | 40811 |
| 9 | 5022 | 33696 |
| 10 | 1984 | 26783 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-21 00:00-23:59 UTC
total number of suspected botnet IPs: 21210
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19991
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1392 |
| 2 | AL-3 | 1014 |
| 3 | GOOGLE-CLOUD | 1013 |
| 4 | PAN-22 | 949 |
| 5 | BYTEPLUS-SG | 881 |
| 6 | ASEPL-SG | 606 |
| 7 | VOLCANO-ENGINE | 526 |
| 8 | CMNET | 519 |
| 9 | ALISOFT | 439 |
| 10 | CENSY | 375 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8090 |
| 2 | China | 4909 |
| 3 | Singapore | 1683 |
| 4 | Hong Kong | 459 |
| 5 | United Kingdom | 360 |
| 6 | South Korea | 349 |
| 7 | India | 335 |
| 8 | Germany | 319 |
| 9 | Netherlands | 318 |
| 10 | Russian Federation | 306 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 373323 |
| 2 | 2227 | 99703 |
| 3 | 4422 | 72520 |
| 4 | 22 | 59139 |
| 5 | 3302 | 58424 |
| 6 | 522 | 56193 |
| 7 | 3232 | 54233 |
| 8 | 1080 | 53935 |
| 9 | 2212 | 51562 |
| 10 | 2201 | 43564 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-20 00:00-23:59 UTC
total number of suspected botnet IPs: 20622
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19343
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1352 |
| 2 | GOOGLE-CLOUD | 1017 |
| 3 | AL-3 | 1017 |
| 4 | PAN-22 | 949 |
| 5 | BYTEPLUS-SG | 881 |
| 6 | ASEPL-SG | 604 |
| 7 | CMNET | 539 |
| 8 | VOLCANO-ENGINE | 529 |
| 9 | ALISOFT | 438 |
| 10 | CENSY | 373 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7126 |
| 2 | China | 5115 |
| 3 | Singapore | 1640 |
| 4 | Hong Kong | 455 |
| 5 | India | 374 |
| 6 | United Kingdom | 372 |
| 7 | South Korea | 359 |
| 8 | Russian Federation | 329 |
| 9 | Indonesia | 324 |
| 10 | European Union | 286 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 366759 |
| 2 | 2299 | 73550 |
| 3 | 4422 | 73366 |
| 4 | 3232 | 63891 |
| 5 | 1122 | 60427 |
| 6 | 2212 | 50816 |
| 7 | 1985 | 45612 |
| 8 | 22 | 44515 |
| 9 | 555 | 43680 |
| 10 | 60000 | 31297 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-19 00:00-23:59 UTC
total number of suspected botnet IPs: 21515
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20171
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1377 |
| 2 | AL-3 | 1040 |
| 3 | GOOGLE-CLOUD | 1013 |
| 4 | PAN-22 | 949 |
| 5 | BYTEPLUS-SG | 880 |
| 6 | ASEPL-SG | 620 |
| 7 | CMNET | 540 |
| 8 | VOLCANO-ENGINE | 526 |
| 9 | ALISOFT | 445 |
| 10 | CENSY | 379 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7235 |
| 2 | China | 5242 |
| 3 | Singapore | 1696 |
| 4 | Hong Kong | 470 |
| 5 | India | 444 |
| 6 | Russian Federation | 396 |
| 7 | South Korea | 378 |
| 8 | United Kingdom | 345 |
| 9 | European Union | 324 |
| 10 | Indonesia | 318 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 400548 |
| 2 | 2229 | 115039 |
| 3 | 2299 | 77475 |
| 4 | 1985 | 73194 |
| 5 | 3232 | 63863 |
| 6 | 1122 | 58980 |
| 7 | 9898 | 56740 |
| 8 | 2212 | 52122 |
| 9 | 22 | 37591 |
| 10 | 60000 | 35368 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-18 00:00-23:59 UTC
total number of suspected botnet IPs: 22502
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21173
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1432 |
| 2 | AL-3 | 1038 |
| 3 | GOOGLE-CLOUD | 1017 |
| 4 | PAN-22 | 949 |
| 5 | BYTEPLUS-SG | 880 |
| 6 | ASEPL-SG | 621 |
| 7 | CMNET | 529 |
| 8 | VOLCANO-ENGINE | 524 |
| 9 | ALISOFT | 444 |
| 10 | CENSY | 380 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8118 |
| 2 | China | 5296 |
| 3 | Singapore | 1748 |
| 4 | Hong Kong | 482 |
| 5 | India | 415 |
| 6 | South Korea | 403 |
| 7 | Russian Federation | 383 |
| 8 | Indonesia | 356 |
| 9 | United Kingdom | 352 |
| 10 | Brazil | 310 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 264101 |
| 2 | 2229 | 115402 |
| 3 | 6969 | 90117 |
| 4 | 2299 | 75468 |
| 5 | 1122 | 64673 |
| 6 | 22 | 53332 |
| 7 | 3232 | 49338 |
| 8 | 7000 | 46384 |
| 9 | 1985 | 32312 |
| 10 | 2211 | 29050 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-17 00:00-23:59 UTC
total number of suspected botnet IPs: 22401
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21000
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1416 |
| 2 | AL-3 | 1043 |
| 3 | GOOGLE-CLOUD | 1009 |
| 4 | PAN-22 | 949 |
| 5 | BYTEPLUS-SG | 882 |
| 6 | ASEPL-SG | 614 |
| 7 | CMNET | 564 |
| 8 | VOLCANO-ENGINE | 542 |
| 9 | ALISOFT | 448 |
| 10 | CENSY | 364 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7731 |
| 2 | China | 5463 |
| 3 | Singapore | 1776 |
| 4 | India | 467 |
| 5 | Hong Kong | 465 |
| 6 | South Korea | 413 |
| 7 | Indonesia | 400 |
| 8 | Russian Federation | 356 |
| 9 | United Kingdom | 353 |
| 10 | European Union | 313 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 239748 |
| 2 | 5555 | 85773 |
| 3 | 9999 | 76754 |
| 4 | 6969 | 74845 |
| 5 | 2299 | 70942 |
| 6 | 1122 | 64934 |
| 7 | 22 | 61004 |
| 8 | 8989 | 41628 |
| 9 | 2229 | 31436 |
| 10 | 2211 | 29422 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-16 00:00-23:59 UTC
total number of suspected botnet IPs: 22533
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21132
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1409 |
| 2 | AL-3 | 1045 |
| 3 | GOOGLE-CLOUD | 1014 |
| 4 | PAN-22 | 948 |
| 5 | BYTEPLUS-SG | 883 |
| 6 | ASEPL-SG | 617 |
| 7 | VOLCANO-ENGINE | 542 |
| 8 | CMNET | 536 |
| 9 | ALISOFT | 452 |
| 10 | CENSY | 379 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8072 |
| 2 | China | 5277 |
| 3 | Singapore | 1769 |
| 4 | India | 455 |
| 5 | Hong Kong | 451 |
| 6 | South Korea | 397 |
| 7 | United Kingdom | 369 |
| 8 | Indonesia | 355 |
| 9 | Russian Federation | 349 |
| 10 | European Union | 338 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5555 | 107283 |
| 2 | 5900 | 104842 |
| 3 | 9999 | 76544 |
| 4 | 1122 | 64377 |
| 5 | 1986 | 59743 |
| 6 | 7022 | 48249 |
| 7 | 4242 | 42681 |
| 8 | 22 | 31624 |
| 9 | 8989 | 28719 |
| 10 | 2211 | 28580 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-15 00:00-23:59 UTC
total number of suspected botnet IPs: 22091
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20764
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1429 |
| 2 | AL-3 | 1066 |
| 3 | GOOGLE-CLOUD | 1004 |
| 4 | PAN-22 | 940 |
| 5 | BYTEPLUS-SG | 880 |
| 6 | ASEPL-SG | 682 |
| 7 | CMNET | 565 |
| 8 | VOLCANO-ENGINE | 539 |
| 9 | ALISOFT | 460 |
| 10 | CENSY | 372 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7631 |
| 2 | China | 5634 |
| 3 | Singapore | 1843 |
| 4 | Hong Kong | 434 |
| 5 | Indonesia | 394 |
| 6 | India | 371 |
| 7 | South Korea | 364 |
| 8 | Russian Federation | 339 |
| 9 | United Kingdom | 333 |
| 10 | Brazil | 305 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 4242 | 115493 |
| 2 | 5900 | 80900 |
| 3 | 9999 | 73287 |
| 4 | 1986 | 72247 |
| 5 | 7022 | 69117 |
| 6 | 7722 | 66598 |
| 7 | 4422 | 66185 |
| 8 | 5555 | 64794 |
| 9 | 22 | 57442 |
| 10 | 1122 | 55176 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-14 00:00-23:59 UTC
total number of suspected botnet IPs: 20693
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19516
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1413 |
| 2 | AL-3 | 1051 |
| 3 | GOOGLE-CLOUD | 1009 |
| 4 | PAN-22 | 949 |
| 5 | BYTEPLUS-SG | 883 |
| 6 | ASEPL-SG | 628 |
| 7 | VOLCANO-ENGINE | 545 |
| 8 | CMNET | 471 |
| 9 | ALISOFT | 467 |
| 10 | CENSY | 369 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7849 |
| 2 | China | 5102 |
| 3 | Singapore | 1690 |
| 4 | Hong Kong | 412 |
| 5 | United Kingdom | 330 |
| 6 | South Korea | 319 |
| 7 | Netherlands | 312 |
| 8 | Indonesia | 307 |
| 9 | Brazil | 278 |
| 10 | India | 276 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 4242 | 110033 |
| 2 | 7722 | 93741 |
| 3 | 5900 | 79411 |
| 4 | 9999 | 75333 |
| 5 | 22 | 58651 |
| 6 | 8181 | 49883 |
| 7 | 4422 | 44599 |
| 8 | 7022 | 39698 |
| 9 | 3232 | 39306 |
| 10 | 2277 | 38539 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-13 00:00-23:59 UTC
total number of suspected botnet IPs: 22179
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20842
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1424 |
| 2 | AL-3 | 1067 |
| 3 | GOOGLE-CLOUD | 1010 |
| 4 | PAN-22 | 949 |
| 5 | BYTEPLUS-SG | 880 |
| 6 | ASEPL-SG | 640 |
| 7 | VOLCANO-ENGINE | 547 |
| 8 | CMNET | 532 |
| 9 | ALISOFT | 481 |
| 10 | CENSY | 380 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7917 |
| 2 | China | 5550 |
| 3 | Singapore | 1788 |
| 4 | Hong Kong | 427 |
| 5 | India | 362 |
| 6 | Indonesia | 356 |
| 7 | South Korea | 352 |
| 8 | United Kingdom | 341 |
| 9 | Germany | 340 |
| 10 | Brazil | 322 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 4242 | 129448 |
| 2 | 5900 | 98264 |
| 3 | 7722 | 65470 |
| 4 | 22 | 53542 |
| 5 | 228 | 43185 |
| 6 | 1987 | 32845 |
| 7 | 2525 | 30787 |
| 8 | 8181 | 29219 |
| 9 | 3232 | 24130 |
| 10 | 6622 | 22590 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-12 00:00-23:59 UTC
total number of suspected botnet IPs: 22583
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21241
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1419 |
| 2 | AL-3 | 1073 |
| 3 | GOOGLE-CLOUD | 1013 |
| 4 | PAN-22 | 949 |
| 5 | BYTEPLUS-SG | 881 |
| 6 | ASEPL-SG | 651 |
| 7 | VOLCANO-ENGINE | 557 |
| 8 | CMNET | 512 |
| 9 | ALISOFT | 452 |
| 10 | CENSY | 382 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7872 |
| 2 | China | 5660 |
| 3 | Singapore | 1758 |
| 4 | Hong Kong | 466 |
| 5 | Indonesia | 415 |
| 6 | India | 403 |
| 7 | Brazil | 376 |
| 8 | South Korea | 360 |
| 9 | Germany | 346 |
| 10 | United Kingdom | 334 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 4242 | 129057 |
| 2 | 5900 | 105329 |
| 3 | 1987 | 98569 |
| 4 | 22 | 62168 |
| 5 | 1534 | 24587 |
| 6 | 2255 | 22572 |
| 7 | 5901 | 20727 |
| 8 | 5902 | 19726 |
| 9 | 1536 | 19637 |
| 10 | 1542 | 19461 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-11 00:00-23:59 UTC
total number of suspected botnet IPs: 23484
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 22094
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1410 |
| 2 | AL-3 | 1072 |
| 3 | GOOGLE-CLOUD | 1013 |
| 4 | PAN-22 | 949 |
| 5 | BYTEPLUS-SG | 881 |
| 6 | ASEPL-SG | 665 |
| 7 | CMNET | 572 |
| 8 | VOLCANO-ENGINE | 564 |
| 9 | ALISOFT | 500 |
| 10 | CENSY | 378 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8353 |
| 2 | China | 5808 |
| 3 | Singapore | 1788 |
| 4 | Indonesia | 449 |
| 5 | Hong Kong | 440 |
| 6 | South Korea | 423 |
| 7 | India | 420 |
| 8 | United Kingdom | 395 |
| 9 | Germany | 370 |
| 10 | Brazil | 345 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 4242 | 123629 |
| 2 | 5900 | 107544 |
| 3 | 22 | 65522 |
| 4 | 1987 | 30989 |
| 5 | 3333 | 25457 |
| 6 | 8088 | 24428 |
| 7 | 5901 | 19744 |
| 8 | 5902 | 19571 |
| 9 | 3456 | 16793 |
| 10 | 2220 | 14620 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-10 00:00-23:59 UTC
total number of suspected botnet IPs: 22811
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21384
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1429 |
| 2 | AL-3 | 1092 |
| 3 | GOOGLE-CLOUD | 1007 |
| 4 | PAN-22 | 946 |
| 5 | BYTEPLUS-SG | 881 |
| 6 | ASEPL-SG | 678 |
| 7 | CMNET | 583 |
| 8 | VOLCANO-ENGINE | 556 |
| 9 | ALISOFT | 501 |
| 10 | CENSY | 373 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7499 |
| 2 | China | 5827 |
| 3 | Singapore | 1728 |
| 4 | India | 460 |
| 5 | Hong Kong | 456 |
| 6 | Indonesia | 440 |
| 7 | Germany | 389 |
| 8 | South Korea | 386 |
| 9 | United Kingdom | 350 |
| 10 | Brazil | 341 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 4242 | 123921 |
| 2 | 5900 | 108494 |
| 3 | 22 | 44740 |
| 4 | 2255 | 33027 |
| 5 | 5566 | 27241 |
| 6 | 8088 | 22648 |
| 7 | 3333 | 21715 |
| 8 | 5901 | 20468 |
| 9 | 5902 | 19473 |
| 10 | 5265 | 16248 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-09 00:00-23:59 UTC
total number of suspected botnet IPs: 25095
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 23595
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1481 |
| 2 | AL-3 | 1136 |
| 3 | GOOGLE-CLOUD | 1013 |
| 4 | PAN-22 | 949 |
| 5 | BYTEPLUS-SG | 881 |
| 6 | ASEPL-SG | 713 |
| 7 | CMNET | 592 |
| 8 | VOLCANO-ENGINE | 571 |
| 9 | ALISOFT | 526 |
| 10 | CENSY | 378 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8809 |
| 2 | China | 6191 |
| 3 | Singapore | 1834 |
| 4 | India | 547 |
| 5 | Indonesia | 478 |
| 6 | Hong Kong | 457 |
| 7 | South Korea | 399 |
| 8 | Brazil | 369 |
| 9 | Russian Federation | 355 |
| 10 | United Kingdom | 343 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 100481 |
| 2 | 5566 | 94805 |
| 3 | 4242 | 78260 |
| 4 | 22 | 58933 |
| 5 | 1988 | 58718 |
| 6 | 2323 | 44602 |
| 7 | 2255 | 34106 |
| 8 | 3333 | 31594 |
| 9 | 5901 | 25297 |
| 10 | 8122 | 21906 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for December 2025.
detection period: 2025-12-08 00:00-23:59 UTC
total number of suspected botnet IPs: 24093
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 22570
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
