(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-30 00:00-23:59 UTC
total number of suspected botnet IPs: 21885
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20415
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1571 |
| 2 | AL-3 | 1163 |
| 3 | GOOGLE-CLOUD | 1012 |
| 4 | PAN-22 | 950 |
| 5 | ASEPL-SG | 749 |
| 6 | CMNET | 598 |
| 7 | VOLCANO-ENGINE | 546 |
| 8 | UCLOUD-HK | 435 |
| 9 | ALISOFT | 419 |
| 10 | CENSY | 379 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8207 |
| 2 | China | 5071 |
| 3 | Singapore | 997 |
| 4 | Hong Kong | 618 |
| 5 | United Kingdom | 469 |
| 6 | Indonesia | 428 |
| 7 | India | 396 |
| 8 | Germany | 364 |
| 9 | Russian Federation | 323 |
| 10 | European Union | 306 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 369787 |
| 2 | 1999 | 104037 |
| 3 | 6622 | 72008 |
| 4 | 9999 | 71771 |
| 5 | 56874 | 68195 |
| 6 | 410 | 64457 |
| 7 | 2227 | 36807 |
| 8 | 2025 | 30252 |
| 9 | 22 | 30108 |
| 10 | 3228 | 29398 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-29 00:00-23:59 UTC
total number of suspected botnet IPs: 20967
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19641
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1548 |
| 2 | AL-3 | 1171 |
| 3 | GOOGLE-CLOUD | 1006 |
| 4 | PAN-22 | 949 |
| 5 | ASEPL-SG | 751 |
| 6 | CMNET | 624 |
| 7 | VOLCANO-ENGINE | 545 |
| 8 | UCLOUD-HK | 436 |
| 9 | ALISOFT | 406 |
| 10 | CENSY | 382 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7629 |
| 2 | China | 4966 |
| 3 | Singapore | 948 |
| 4 | Hong Kong | 622 |
| 5 | Indonesia | 463 |
| 6 | United Kingdom | 391 |
| 7 | India | 380 |
| 8 | Russian Federation | 319 |
| 9 | South Korea | 305 |
| 10 | European Union | 303 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 438020 |
| 2 | 9999 | 74413 |
| 3 | 56874 | 65590 |
| 4 | 2025 | 48930 |
| 5 | 22 | 30744 |
| 6 | 6277 | 30702 |
| 7 | 3228 | 29524 |
| 8 | 3389 | 24274 |
| 9 | 223 | 20198 |
| 10 | 23 | 17367 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-28 00:00-23:59 UTC
total number of suspected botnet IPs: 22686
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21363
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1547 |
| 2 | AL-3 | 1166 |
| 3 | GOOGLE-CLOUD | 1007 |
| 4 | PAN-22 | 949 |
| 5 | ASEPL-SG | 758 |
| 6 | CMNET | 626 |
| 7 | VOLCANO-ENGINE | 569 |
| 8 | ALISOFT | 428 |
| 9 | UCLOUD-HK | 398 |
| 10 | CENSY | 379 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8639 |
| 2 | China | 5172 |
| 3 | Singapore | 978 |
| 4 | Hong Kong | 605 |
| 5 | Indonesia | 516 |
| 6 | United Kingdom | 415 |
| 7 | Germany | 392 |
| 8 | India | 379 |
| 9 | Russian Federation | 328 |
| 10 | France | 315 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 358128 |
| 2 | 9999 | 71641 |
| 3 | 56874 | 58197 |
| 4 | 2025 | 50189 |
| 5 | 9000 | 33978 |
| 6 | 22 | 31177 |
| 7 | 221 | 19861 |
| 8 | 3121 | 17732 |
| 9 | 5901 | 16547 |
| 10 | 5432 | 15919 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-27 00:00-23:59 UTC
total number of suspected botnet IPs: 21880
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20537
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1576 |
| 2 | AL-3 | 1212 |
| 3 | GOOGLE-CLOUD | 993 |
| 4 | PAN-22 | 944 |
| 5 | ASEPL-SG | 789 |
| 6 | CMNET | 636 |
| 7 | VOLCANO-ENGINE | 602 |
| 8 | ALISOFT | 436 |
| 9 | CENSY | 382 |
| 10 | UCLOUD-HK | 361 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7796 |
| 2 | China | 5446 |
| 3 | Singapore | 992 |
| 4 | Hong Kong | 553 |
| 5 | Indonesia | 501 |
| 6 | United Kingdom | 362 |
| 7 | Germany | 349 |
| 8 | India | 344 |
| 9 | Russian Federation | 343 |
| 10 | South Korea | 326 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 451829 |
| 2 | 9999 | 72627 |
| 3 | 56874 | 58950 |
| 4 | 9851 | 55780 |
| 5 | 5902 | 42805 |
| 6 | 22 | 34457 |
| 7 | 2025 | 25805 |
| 8 | 5901 | 22878 |
| 9 | 20241 | 22079 |
| 10 | 6628 | 21245 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-26 00:00-23:59 UTC
total number of suspected botnet IPs: 20642
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19479
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1549 |
| 2 | AL-3 | 1159 |
| 3 | GOOGLE-CLOUD | 1003 |
| 4 | PAN-22 | 950 |
| 5 | ASEPL-SG | 712 |
| 6 | CMNET | 605 |
| 7 | VOLCANO-ENGINE | 551 |
| 8 | ALISOFT | 423 |
| 9 | CENSY | 381 |
| 10 | UCLOUD-HK | 377 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8187 |
| 2 | China | 5179 |
| 3 | Singapore | 908 |
| 4 | Hong Kong | 544 |
| 5 | United Kingdom | 359 |
| 6 | France | 333 |
| 7 | Indonesia | 307 |
| 8 | South Korea | 305 |
| 9 | Russian Federation | 281 |
| 10 | Germany | 277 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 404072 |
| 2 | 9999 | 72642 |
| 3 | 56874 | 63448 |
| 4 | 5902 | 43696 |
| 5 | 22 | 30369 |
| 6 | 2454 | 24322 |
| 7 | 5901 | 23169 |
| 8 | 7013 | 21501 |
| 9 | 1030 | 13915 |
| 10 | 23 | 13874 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-25 00:00-23:59 UTC
total number of suspected botnet IPs: 19383
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18234
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1484 |
| 2 | AL-3 | 1145 |
| 3 | GOOGLE-CLOUD | 1005 |
| 4 | PAN-22 | 951 |
| 5 | ASEPL-SG | 722 |
| 6 | CMNET | 670 |
| 7 | VOLCANO-ENGINE | 536 |
| 8 | ALISOFT | 409 |
| 9 | CENSY | 384 |
| 10 | UCLOUD-HK | 378 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7305 |
| 2 | China | 5015 |
| 3 | Singapore | 902 |
| 4 | Hong Kong | 537 |
| 5 | United Kingdom | 390 |
| 6 | Indonesia | 335 |
| 7 | France | 324 |
| 8 | South Korea | 296 |
| 9 | Germany | 284 |
| 10 | India | 266 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 387448 |
| 2 | 9999 | 64025 |
| 3 | 56874 | 58847 |
| 4 | 2756 | 49580 |
| 5 | 5902 | 43495 |
| 6 | 22 | 29286 |
| 7 | 4070 | 24014 |
| 8 | 5901 | 23295 |
| 9 | 23 | 22158 |
| 10 | 5122 | 21999 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-24 00:00-23:59 UTC
total number of suspected botnet IPs: 19790
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18645
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1507 |
| 2 | AL-3 | 1158 |
| 3 | GOOGLE-CLOUD | 1007 |
| 4 | PAN-22 | 951 |
| 5 | ASEPL-SG | 750 |
| 6 | CMNET | 634 |
| 7 | VOLCANO-ENGINE | 534 |
| 8 | UCLOUD-HK | 434 |
| 9 | ALISOFT | 416 |
| 10 | CENSY | 382 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7199 |
| 2 | China | 5019 |
| 3 | Singapore | 955 |
| 4 | Hong Kong | 605 |
| 5 | United Kingdom | 538 |
| 6 | Germany | 351 |
| 7 | Indonesia | 339 |
| 8 | France | 327 |
| 9 | South Korea | 296 |
| 10 | Russian Federation | 293 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 313578 |
| 2 | 9999 | 63313 |
| 3 | 56874 | 58165 |
| 4 | 5902 | 43557 |
| 5 | 2197 | 36915 |
| 6 | 5022 | 35079 |
| 7 | 56316 | 34584 |
| 8 | 5901 | 24934 |
| 9 | 23 | 22487 |
| 10 | 9006 | 19563 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-23 00:00-23:59 UTC
total number of suspected botnet IPs: 20754
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19592
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1510 |
| 2 | AL-3 | 1185 |
| 3 | GOOGLE-CLOUD | 1009 |
| 4 | PAN-22 | 951 |
| 5 | ASEPL-SG | 753 |
| 6 | CMNET | 680 |
| 7 | VOLCANO-ENGINE | 533 |
| 8 | UCLOUD-HK | 440 |
| 9 | ALISOFT | 419 |
| 10 | CENSY | 377 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8163 |
| 2 | China | 4956 |
| 3 | Singapore | 974 |
| 4 | Hong Kong | 618 |
| 5 | United Kingdom | 445 |
| 6 | Indonesia | 400 |
| 7 | India | 379 |
| 8 | France | 324 |
| 9 | Germany | 303 |
| 10 | South Korea | 294 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 232194 |
| 2 | 9999 | 63791 |
| 3 | 3352 | 59777 |
| 4 | 56874 | 57439 |
| 5 | 5902 | 43144 |
| 6 | 5022 | 41691 |
| 7 | 5901 | 25911 |
| 8 | 2197 | 23246 |
| 9 | 22 | 23018 |
| 10 | 2067 | 21681 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-22 00:00-23:59 UTC
total number of suspected botnet IPs: 21259
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20011
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1534 |
| 2 | AL-3 | 1175 |
| 3 | GOOGLE-CLOUD | 1001 |
| 4 | PAN-22 | 951 |
| 5 | ASEPL-SG | 766 |
| 6 | CMNET | 669 |
| 7 | VOLCANO-ENGINE | 541 |
| 8 | UCLOUD-HK | 464 |
| 9 | ALISOFT | 428 |
| 10 | CENSY | 383 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7821 |
| 2 | China | 5218 |
| 3 | Singapore | 979 |
| 4 | Hong Kong | 638 |
| 5 | Indonesia | 462 |
| 6 | United Kingdom | 462 |
| 7 | India | 395 |
| 8 | France | 338 |
| 9 | Germany | 317 |
| 10 | South Korea | 291 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 165577 |
| 2 | 9999 | 68342 |
| 3 | 56874 | 59900 |
| 4 | 5902 | 43796 |
| 5 | 5022 | 39799 |
| 6 | 2067 | 36359 |
| 7 | 22 | 25723 |
| 8 | 5901 | 25244 |
| 9 | 3001 | 23074 |
| 10 | 22600 | 22652 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-21 00:00-23:59 UTC
total number of suspected botnet IPs: 21681
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20460
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1534 |
| 2 | AL-3 | 1182 |
| 3 | GOOGLE-CLOUD | 1006 |
| 4 | PAN-22 | 953 |
| 5 | ASEPL-SG | 771 |
| 6 | CMNET | 686 |
| 7 | VOLCANO-ENGINE | 532 |
| 8 | UCLOUD-HK | 459 |
| 9 | ALISOFT | 429 |
| 10 | CENSY | 382 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8293 |
| 2 | China | 4999 |
| 3 | Singapore | 1000 |
| 4 | Hong Kong | 623 |
| 5 | United Kingdom | 607 |
| 6 | Indonesia | 438 |
| 7 | Germany | 355 |
| 8 | India | 345 |
| 9 | France | 335 |
| 10 | South Korea | 331 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 149647 |
| 2 | 56874 | 58764 |
| 3 | 2904 | 52934 |
| 4 | 1499 | 48613 |
| 5 | 5902 | 43217 |
| 6 | 5022 | 42766 |
| 7 | 9999 | 27112 |
| 8 | 5901 | 23542 |
| 9 | 5903 | 21338 |
| 10 | 22 | 19775 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-20 00:00-23:59 UTC
total number of suspected botnet IPs: 19399
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18282
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1488 |
| 2 | AL-3 | 1173 |
| 3 | GOOGLE-CLOUD | 1000 |
| 4 | PAN-22 | 955 |
| 5 | ASEPL-SG | 783 |
| 6 | CMNET | 598 |
| 7 | VOLCANO-ENGINE | 559 |
| 8 | ALISOFT | 432 |
| 9 | UCLOUD-HK | 417 |
| 10 | CENSY | 379 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7286 |
| 2 | China | 4766 |
| 3 | Singapore | 956 |
| 4 | Hong Kong | 583 |
| 5 | Indonesia | 396 |
| 6 | India | 361 |
| 7 | United Kingdom | 352 |
| 8 | Germany | 328 |
| 9 | South Korea | 291 |
| 10 | Viet Nam | 272 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 179848 |
| 2 | 56874 | 63786 |
| 3 | 5022 | 43853 |
| 4 | 5902 | 43763 |
| 5 | 55491 | 39341 |
| 6 | 5901 | 25861 |
| 7 | 5903 | 21505 |
| 8 | 22 | 20317 |
| 9 | 8009 | 20076 |
| 10 | 5432 | 17159 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-19 00:00-23:59 UTC
total number of suspected botnet IPs: 18983
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17873
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1485 |
| 2 | AL-3 | 1171 |
| 3 | GOOGLE-CLOUD | 1014 |
| 4 | PAN-22 | 948 |
| 5 | ASEPL-SG | 779 |
| 6 | CMNET | 561 |
| 7 | VOLCANO-ENGINE | 556 |
| 8 | ALISOFT | 442 |
| 9 | UCLOUD-HK | 404 |
| 10 | CENSY | 378 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7690 |
| 2 | China | 4298 |
| 3 | Singapore | 952 |
| 4 | Hong Kong | 572 |
| 5 | United Kingdom | 360 |
| 6 | Indonesia | 352 |
| 7 | Germany | 326 |
| 8 | South Korea | 284 |
| 9 | European Union | 273 |
| 10 | Viet Nam | 269 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 181700 |
| 2 | 56874 | 67345 |
| 3 | 1146 | 55494 |
| 4 | 3220 | 51796 |
| 5 | 5902 | 43860 |
| 6 | 22 | 26213 |
| 7 | 5901 | 25656 |
| 8 | 5903 | 21450 |
| 9 | 23 | 12173 |
| 10 | 5432 | 11645 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-18 00:00-23:59 UTC
total number of suspected botnet IPs: 18439
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17373
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1501 |
| 2 | AL-3 | 1197 |
| 3 | GOOGLE-CLOUD | 1010 |
| 4 | ASEPL-SG | 975 |
| 5 | PAN-22 | 950 |
| 6 | VOLCANO-ENGINE | 548 |
| 7 | CMNET | 522 |
| 8 | ALISOFT | 451 |
| 9 | UCLOUD-HK | 394 |
| 10 | CENSY | 382 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 6811 |
| 2 | China | 4403 |
| 3 | Singapore | 1117 |
| 4 | Hong Kong | 575 |
| 5 | Indonesia | 360 |
| 6 | United Kingdom | 342 |
| 7 | South Korea | 289 |
| 8 | European Union | 278 |
| 9 | Germany | 278 |
| 10 | Viet Nam | 265 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 154207 |
| 2 | 56874 | 68722 |
| 3 | 5902 | 43650 |
| 4 | 8008 | 39337 |
| 5 | 5901 | 24382 |
| 6 | 5903 | 21218 |
| 7 | 12880 | 19727 |
| 8 | 22 | 18783 |
| 9 | 3568 | 18709 |
| 10 | 1890 | 14941 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-17 00:00-23:59 UTC
total number of suspected botnet IPs: 18713
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17593
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1479 |
| 2 | AL-3 | 1214 |
| 3 | GOOGLE-CLOUD | 1012 |
| 4 | PAN-22 | 951 |
| 5 | ASEPL-SG | 908 |
| 6 | CMNET | 560 |
| 7 | VOLCANO-ENGINE | 537 |
| 8 | ALISOFT | 435 |
| 9 | UCLOUD-HK | 411 |
| 10 | CENSY | 379 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 6901 |
| 2 | China | 4316 |
| 3 | Singapore | 1081 |
| 4 | Hong Kong | 597 |
| 5 | Indonesia | 393 |
| 6 | Viet Nam | 321 |
| 7 | South Korea | 319 |
| 8 | United Kingdom | 311 |
| 9 | Germany | 302 |
| 10 | Russian Federation | 294 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 191252 |
| 2 | 56874 | 68143 |
| 3 | 5580 | 46550 |
| 4 | 5902 | 44224 |
| 5 | 5014 | 36712 |
| 6 | 5901 | 24873 |
| 7 | 259 | 24752 |
| 8 | 7722 | 22411 |
| 9 | 5903 | 21253 |
| 10 | 22 | 19559 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-16 00:00-23:59 UTC
total number of suspected botnet IPs: 20069
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18889
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1492 |
| 2 | AL-3 | 1213 |
| 3 | GOOGLE-CLOUD | 1013 |
| 4 | PAN-22 | 951 |
| 5 | ASEPL-SG | 793 |
| 6 | CMNET | 666 |
| 7 | VOLCANO-ENGINE | 558 |
| 8 | ALISOFT | 454 |
| 9 | UCLOUD-HK | 365 |
| 10 | CENSY | 363 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7762 |
| 2 | China | 4649 |
| 3 | Singapore | 997 |
| 4 | Hong Kong | 546 |
| 5 | Indonesia | 441 |
| 6 | United Kingdom | 368 |
| 7 | India | 350 |
| 8 | South Korea | 310 |
| 9 | Russian Federation | 294 |
| 10 | Viet Nam | 280 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 186891 |
| 2 | 56874 | 64488 |
| 3 | 5902 | 44252 |
| 4 | 1414 | 37614 |
| 5 | 8007 | 27958 |
| 6 | 5901 | 23577 |
| 7 | 5431 | 21515 |
| 8 | 5903 | 21336 |
| 9 | 5433 | 21116 |
| 10 | 22 | 20242 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-15 00:00-23:59 UTC
total number of suspected botnet IPs: 19642
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18452
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1495 |
| 2 | AL-3 | 1215 |
| 3 | GOOGLE-CLOUD | 1000 |
| 4 | PAN-22 | 949 |
| 5 | ASEPL-SG | 822 |
| 6 | VOLCANO-ENGINE | 570 |
| 7 | CMNET | 536 |
| 8 | ALISOFT | 448 |
| 9 | CENSY | 397 |
| 10 | UCLOUD-HK | 366 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7383 |
| 2 | China | 4552 |
| 3 | Singapore | 995 |
| 4 | Hong Kong | 534 |
| 5 | Indonesia | 472 |
| 6 | United Kingdom | 388 |
| 7 | South Korea | 316 |
| 8 | Russian Federation | 311 |
| 9 | European Union | 282 |
| 10 | Germany | 281 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 178005 |
| 2 | 1414 | 120788 |
| 3 | 2023 | 80943 |
| 4 | 56874 | 59611 |
| 5 | 2899 | 47270 |
| 6 | 5902 | 42969 |
| 7 | 5431 | 39494 |
| 8 | 5433 | 38136 |
| 9 | 6022 | 33971 |
| 10 | 5901 | 29379 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-14 00:00-23:59 UTC
total number of suspected botnet IPs: 20396
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19110
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1503 |
| 2 | AL-3 | 1204 |
| 3 | GOOGLE-CLOUD | 1006 |
| 4 | PAN-22 | 951 |
| 5 | ASEPL-SG | 810 |
| 6 | VOLCANO-ENGINE | 561 |
| 7 | CMNET | 512 |
| 8 | ALISOFT | 460 |
| 9 | CENSY | 397 |
| 10 | UCLOUD-HK | 373 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7976 |
| 2 | China | 4519 |
| 3 | Singapore | 1075 |
| 4 | Hong Kong | 546 |
| 5 | Indonesia | 517 |
| 6 | United Kingdom | 388 |
| 7 | Russian Federation | 341 |
| 8 | India | 339 |
| 9 | South Korea | 320 |
| 10 | Germany | 277 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 190469 |
| 2 | 2023 | 114736 |
| 3 | 725 | 63938 |
| 4 | 56874 | 58611 |
| 5 | 3978 | 55993 |
| 6 | 74 | 55838 |
| 7 | 1761 | 51132 |
| 8 | 5902 | 42658 |
| 9 | 5431 | 38287 |
| 10 | 5433 | 37931 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-13 00:00-23:59 UTC
total number of suspected botnet IPs: 20059
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18699
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1494 |
| 2 | AL-3 | 1203 |
| 3 | GOOGLE-CLOUD | 996 |
| 4 | PAN-22 | 948 |
| 5 | ASEPL-SG | 820 |
| 6 | VOLCANO-ENGINE | 593 |
| 7 | CMNET | 512 |
| 8 | ALISOFT | 498 |
| 9 | CENSY | 398 |
| 10 | UCLOUD-HK | 373 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7326 |
| 2 | China | 4631 |
| 3 | Singapore | 1031 |
| 4 | Hong Kong | 543 |
| 5 | Indonesia | 484 |
| 6 | India | 394 |
| 7 | United Kingdom | 351 |
| 8 | Russian Federation | 349 |
| 9 | South Korea | 326 |
| 10 | Viet Nam | 312 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 133315 |
| 2 | 1313 | 112710 |
| 3 | 2023 | 92841 |
| 4 | 56874 | 56571 |
| 5 | 1000 | 55576 |
| 6 | 5902 | 42336 |
| 7 | 5431 | 35986 |
| 8 | 5433 | 35846 |
| 9 | 55651 | 35733 |
| 10 | 6022 | 32196 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-12 00:00-23:59 UTC
total number of suspected botnet IPs: 20615
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19268
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1552 |
| 2 | AL-3 | 1193 |
| 3 | GOOGLE-CLOUD | 1013 |
| 4 | PAN-22 | 951 |
| 5 | ASEPL-SG | 818 |
| 6 | CMNET | 633 |
| 7 | VOLCANO-ENGINE | 568 |
| 8 | ALISOFT | 481 |
| 9 | UCLOUD-HK | 406 |
| 10 | CENSY | 394 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8033 |
| 2 | China | 4909 |
| 3 | Singapore | 1126 |
| 4 | Hong Kong | 578 |
| 5 | United Kingdom | 390 |
| 6 | South Korea | 347 |
| 7 | Indonesia | 330 |
| 8 | Viet Nam | 294 |
| 9 | India | 289 |
| 10 | Russian Federation | 287 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 2023 | 145976 |
| 2 | 5900 | 116499 |
| 3 | 8005 | 100112 |
| 4 | 1000 | 74305 |
| 5 | 8888 | 69228 |
| 6 | 6022 | 48813 |
| 7 | 1313 | 46344 |
| 8 | 5431 | 45853 |
| 9 | 5433 | 45777 |
| 10 | 56874 | 45399 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-11 00:00-23:59 UTC
total number of suspected botnet IPs: 19661
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18302
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1561 |
| 2 | AL-3 | 1191 |
| 3 | GOOGLE-CLOUD | 1013 |
| 4 | PAN-22 | 951 |
| 5 | ASEPL-SG | 797 |
| 6 | CMNET | 686 |
| 7 | VOLCANO-ENGINE | 575 |
| 8 | ALISOFT | 472 |
| 9 | UCLOUD-HK | 399 |
| 10 | CENSY | 396 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7076 |
| 2 | China | 4911 |
| 3 | Singapore | 1016 |
| 4 | Hong Kong | 585 |
| 5 | Indonesia | 382 |
| 6 | United Kingdom | 356 |
| 7 | South Korea | 334 |
| 8 | India | 309 |
| 9 | Germany | 294 |
| 10 | Russian Federation | 292 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 128303 |
| 2 | 2023 | 111509 |
| 3 | 8005 | 92131 |
| 4 | 8888 | 81767 |
| 5 | 7777 | 76574 |
| 6 | 5431 | 47410 |
| 7 | 5648 | 47080 |
| 8 | 5433 | 45892 |
| 9 | 5902 | 42405 |
| 10 | 6022 | 41771 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-10 00:00-23:59 UTC
total number of suspected botnet IPs: 20008
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18644
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1535 |
| 2 | AL-3 | 1204 |
| 3 | GOOGLE-CLOUD | 1007 |
| 4 | PAN-22 | 951 |
| 5 | ASEPL-SG | 801 |
| 6 | CMNET | 658 |
| 7 | VOLCANO-ENGINE | 582 |
| 8 | ALISOFT | 500 |
| 9 | UCLOUD-HK | 404 |
| 10 | CENSY | 398 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7235 |
| 2 | China | 4764 |
| 3 | Singapore | 1108 |
| 4 | Hong Kong | 592 |
| 5 | Indonesia | 459 |
| 6 | South Korea | 354 |
| 7 | Russian Federation | 341 |
| 8 | India | 339 |
| 9 | United Kingdom | 338 |
| 10 | Viet Nam | 318 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 125358 |
| 2 | 7777 | 88122 |
| 3 | 1010 | 81918 |
| 4 | 8888 | 81698 |
| 5 | 6689 | 58631 |
| 6 | 6022 | 53001 |
| 7 | 5431 | 47679 |
| 8 | 5433 | 45549 |
| 9 | 5902 | 43136 |
| 10 | 1433 | 41136 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for October 2025.
detection period: 2025-10-09 00:00-23:59 UTC
total number of suspected botnet IPs: 21186
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19738
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
