Botnet Statistics [2026-07-20]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-20 00:00-23:59 UTC
total number of suspected botnet IPs: 18080
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17267
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	MSFT	1326
2	INFRAWATCH	1092
3	GOOGLE-CLOUD	1068
4	AL-3	973
5	PAN-22	961
6	FR-ONYPHE-20191111	448
7	CENSY	376
8	ASEPL-SG	366
9	cloud	281
10	FR-ONYPHE-20221109	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	7536
2	China	3986
3	United Kingdom	1136
4	Germany	591
5	Netherlands	570
6	Singapore	467
7	France	413
8	Hong Kong	276
9	Russian Federation	261
10	India	219

Monday, July 20, 2026

Botnet Statistics [2026-07-19]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-19 00:00-23:59 UTC
total number of suspected botnet IPs: 17930
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17189
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5422	109216
2	5900	82230
3	2422	71442
4	2758	54317
5	9617	49354
6	2266	47921
7	9022	36181
8	11483	34138
9	8001	30037
10	23	29934

Rank	Network	# of suspected botnet IPs
1	MSFT	1312
2	GOOGLE-CLOUD	1040
3	INFRAWATCH	1005
4	AL-3	969
5	PAN-22	959
6	FR-ONYPHE-20191111	448
7	CENSY	374
8	ASEPL-SG	323
9	cloud	243
10	FR-ONYPHE-20221109	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8134
2	China	3946
3	United Kingdom	961
4	Netherlands	541
5	Germany	497
6	Singapore	459
7	France	410
8	Hong Kong	271
9	South Korea	203
10	India	172

Sunday, July 19, 2026

Botnet Statistics [2026-07-18]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-18 00:00-23:59 UTC
total number of suspected botnet IPs: 18052
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17278
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	101487
2	5422	98821
3	3822	92258
4	2422	71712
5	6415	54885
6	5534	49527
7	2266	49270
8	9022	44657
9	7022	41108
10	15844	41105

Rank	Network	# of suspected botnet IPs
1	MSFT	1337
2	INFRAWATCH	1088
3	GOOGLE-CLOUD	1045
4	AL-3	1009
5	PAN-22	960
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	392
8	CENSY	384
9	cloud	288
10	FR-ONYPHE-20221109	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	7521
2	China	4138
3	United Kingdom	1111
4	Netherlands	548
5	Singapore	512
6	Germany	431
7	France	425
8	Hong Kong	248
9	India	241
10	South Korea	209

Saturday, July 18, 2026

Botnet Statistics [2026-07-17]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-17 00:00-23:59 UTC
total number of suspected botnet IPs: 18279
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17355
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	3822	117119
2	5900	79192
3	2422	61150
4	7022	59026
5	3708	54441
6	2266	51132
7	9022	45689
8	3950	41128
9	9131	36735
10	2022	35479

Rank	Network	# of suspected botnet IPs
1	MSFT	1350
2	AL-3	1131
3	INFRAWATCH	1098
4	GOOGLE-CLOUD	1046
5	PAN-22	961
6	FR-ONYPHE-20191111	448
7	CENSY	383
8	ASEPL-SG	358
9	FR-ONYPHE-20221109	240
10	CMNET	230

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	7846
2	China	4086
3	United Kingdom	1093
4	Netherlands	543
5	Germany	484
6	Singapore	464
7	France	403
8	India	250
9	Hong Kong	240
10	European Union	196

Friday, July 17, 2026

Botnet Statistics [2026-07-16]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-16 00:00-23:59 UTC
total number of suspected botnet IPs: 17502
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16726
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	7022	58820
2	5900	45905
3	3822	43316
4	2022	38833
5	9222	33098
6	1022	32257
7	4122	32132
8	222	30131
9	22	29071
10	6522	28967

Rank	Network	# of suspected botnet IPs
1	MSFT	1294
2	INFRAWATCH	1073
3	GOOGLE-CLOUD	1054
4	AL-3	985
5	PAN-22	960
6	FR-ONYPHE-20191111	448
7	CENSY	377
8	ASEPL-SG	356
9	cloud	272
10	FR-ONYPHE-20221109	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	7663
2	China	4041
3	United Kingdom	856
4	Netherlands	535
5	Singapore	442
6	Germany	433
7	France	422
8	India	296
9	Hong Kong	239
10	Russian Federation	209

Thursday, July 16, 2026

Botnet Statistics [2026-07-15]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-15 00:00-23:59 UTC
total number of suspected botnet IPs: 17993
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16942
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	7022	51620
2	5900	33910
3	1022	32974
4	2022	32814
5	4122	30687
6	9222	29285
7	5822	28712
8	222	28627
9	6522	28152
10	4722	27861

Rank	Network	# of suspected botnet IPs
1	MSFT	1327
2	GOOGLE-CLOUD	1044
3	AL-3	968
4	PAN-22	961
5	INFRAWATCH	892
6	FR-ONYPHE-20191111	448
7	CENSY	381
8	ASEPL-SG	341
9	cloud	247
10	FR-ONYPHE-20221109	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	7990
2	China	3649
3	United Kingdom	1057
4	Netherlands	536
5	France	429
6	Singapore	425
7	Hong Kong	279
8	India	250
9	Germany	235
10	South Korea	197

Wednesday, July 15, 2026

Botnet Statistics [2026-07-14]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-14 00:00-23:59 UTC
total number of suspected botnet IPs: 21085
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20188
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5822	91180
2	7022	54676
3	8559	43550
4	2122	34780
5	4122	33964
6	1022	33144
7	5900	31268
8	822	30525
9	4322	30464
10	622	29964

Rank	Network	# of suspected botnet IPs
1	MSFT	1401
2	AL-3	1387
3	INFRAWATCH	1118
4	GOOGLE-CLOUD	1040
5	PAN-22	960
6	ASEPL-SG	522
7	VOLCANO-ENGINE	469
8	FR-ONYPHE-20191111	448
9	CENSY	379
10	cloud	314

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8775
2	China	5005
3	United Kingdom	1042
4	Singapore	709
5	Netherlands	578
6	Germany	488
7	France	419
8	Hong Kong	323
9	Indonesia	306
10	South Korea	275

Tuesday, July 14, 2026

Botnet Statistics [2026-07-13]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-13 00:00-23:59 UTC
total number of suspected botnet IPs: 20643
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19737
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	14406	46907
2	7606	43777
3	4910	42055
4	9872	38823
5	1522	35668
6	2122	35211
7	4122	34054
8	5900	33456
9	5822	33020
10	9999	32036

Rank	Network	# of suspected botnet IPs
1	MSFT	1397
2	AL-3	1397
3	GOOGLE-CLOUD	1061
4	INFRAWATCH	1056
5	PAN-22	963
6	ASEPL-SG	523
7	VOLCANO-ENGINE	462
8	FR-ONYPHE-20191111	448
9	CENSY	375
10	cloud	322

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8529
2	China	4963
3	United Kingdom	803
4	Singapore	721
5	Netherlands	604
6	Germany	470
7	France	423
8	Indonesia	317
9	Hong Kong	317
10	South Korea	275

Monday, July 13, 2026

Botnet Statistics [2026-07-12]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-12 00:00-23:59 UTC
total number of suspected botnet IPs: 21541
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20634
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	9999	57595
2	9011	39039
3	22	38869
4	3333	35960
5	622	34221
6	14387	34094
7	4122	33130
8	4322	31568
9	2122	31202
10	5781	31002

Rank	Network	# of suspected botnet IPs
1	MSFT	1412
2	AL-3	1381
3	INFRAWATCH	1067
4	GOOGLE-CLOUD	1057
5	PAN-22	961
6	ASEPL-SG	567
7	VOLCANO-ENGINE	471
8	FR-ONYPHE-20191111	448
9	CENSY	383
10	cloud	332

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8928
2	China	4948
3	United Kingdom	1179
4	Singapore	798
5	Netherlands	621
6	Germany	522
7	France	440
8	Hong Kong	322
9	South Korea	286
10	Indonesia	279

Sunday, July 12, 2026

Botnet Statistics [2026-07-11]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-11 00:00-23:59 UTC
total number of suspected botnet IPs: 22091
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21089
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	622	38284
2	4122	38027
3	4322	37648
4	2023	37052
5	9999	35501
6	222	34435
7	9022	34046
8	4722	31777
9	2022	31450
10	5322	31444

Rank	Network	# of suspected botnet IPs
1	AL-3	1489
2	MSFT	1362
3	INFRAWATCH	1087
4	GOOGLE-CLOUD	1048
5	PAN-22	961
6	ASEPL-SG	517
7	VOLCANO-ENGINE	468
8	FR-ONYPHE-20191111	448
9	CENSY	381
10	CMNET	286

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8222
2	China	6122
3	United Kingdom	1078
4	Singapore	715
5	Netherlands	629
6	Germany	535
7	France	447
8	Hong Kong	326
9	Indonesia	307
10	South Korea	290

Saturday, July 11, 2026

Botnet Statistics [2026-07-10]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-10 00:00-23:59 UTC
total number of suspected botnet IPs: 24661
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 23688
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	2023	104123
2	5900	99660
3	3322	44636
4	4122	41076
5	4322	38750
6	622	36927
7	222	35057
8	2022	34584
9	5222	33775
10	5322	33682

Rank	Network	# of suspected botnet IPs
1	MSFT	1379
2	AL-3	1378
3	INFRAWATCH	1089
4	GOOGLE-CLOUD	1057
5	PAN-22	962
6	ASEPL-SG	512
7	VOLCANO-ENGINE	470
8	FR-ONYPHE-20191111	448
9	UNICOM	427
10	CENSY	381

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	China	8597
2	United States	8287
3	United Kingdom	1031
4	Singapore	707
5	Netherlands	609
6	Germany	566
7	France	469
8	Hong Kong	328
9	Indonesia	323
10	India	315

Friday, July 10, 2026

Botnet Statistics [2026-07-09]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-09 00:00-23:59 UTC
total number of suspected botnet IPs: 20781
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19624
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	128099
2	2023	56007
3	3322	50226
4	4122	37820
5	622	36140
6	9022	35345
7	222	35076
8	4322	35005
9	5222	33800
10	2022	33403

Rank	Network	# of suspected botnet IPs
1	AL-3	1429
2	MSFT	1393
3	INFRAWATCH	1090
4	GOOGLE-CLOUD	1044
5	PAN-22	962
6	ASEPL-SG	548
7	VOLCANO-ENGINE	473
8	FR-ONYPHE-20191111	448
9	CENSY	373
10	FR-ONYPHE-20221109	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8479
2	China	3986
3	United Kingdom	1037
4	Singapore	797
5	Germany	684
6	Netherlands	645
7	France	493
8	Hong Kong	340
9	Indonesia	337
10	India	300

Thursday, July 9, 2026

Botnet Statistics [2026-07-08]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-08 00:00-23:59 UTC
total number of suspected botnet IPs: 21151
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20135
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	125900
2	622	38450
3	9022	38096
4	222	37833
5	2022	36951
6	8522	36497
7	9222	35974
8	822	34867
9	1522	34705
10	7022	34533

Rank	Network	# of suspected botnet IPs
1	MSFT	1426
2	AL-3	1408
3	GOOGLE-CLOUD	1081
4	INFRAWATCH	1049
5	PAN-22	959
6	ASEPL-SG	563
7	VOLCANO-ENGINE	511
8	FR-ONYPHE-20191111	448
9	CENSY	375
10	cloud	285

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8639
2	China	3819
3	United Kingdom	1081
4	Germany	918
5	Singapore	823
6	Netherlands	605
7	France	465
8	India	365
9	Indonesia	356
10	South Korea	303

Wednesday, July 8, 2026

Botnet Statistics [2026-07-07]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-07 00:00-23:59 UTC
total number of suspected botnet IPs: 20182
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19066
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	125382
2	8522	40731
3	9022	39822
4	1022	38945
5	422	37915
6	622	37821
7	6522	36408
8	1522	35988
9	922	35769
10	822	35611

Rank	Network	# of suspected botnet IPs
1	AL-3	1522
2	MSFT	1364
3	GOOGLE-CLOUD	1064
4	PAN-22	961
5	INFRAWATCH	858
6	ASEPL-SG	548
7	VOLCANO-ENGINE	463
8	FR-ONYPHE-20191111	448
9	CENSY	381
10	DE-ALPHA	372

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8803
2	China	3625
3	United Kingdom	1107
4	Singapore	777
5	Germany	761
6	Netherlands	563
7	France	492
8	Hong Kong	295
9	Indonesia	265
10	India	254

Tuesday, July 7, 2026

Botnet Statistics [2026-07-06]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-06 00:00-23:59 UTC
total number of suspected botnet IPs: 19961
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19126
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	139753
2	2222	39736
3	22	32992
4	422	31711
5	922	30515
6	6522	29887
7	8522	28399
8	1922	27800
9	1022	26968
10	1122	26542

Rank	Network	# of suspected botnet IPs
1	AL-3	1494
2	MSFT	1418
3	INFRAWATCH	1112
4	GOOGLE-CLOUD	1074
5	PAN-22	965
6	ASEPL-SG	537
7	VOLCANO-ENGINE	459
8	FR-ONYPHE-20191111	448
9	CENSY	371
10	DE-ALPHA	363

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8547
2	China	3790
3	United Kingdom	1142
4	Germany	990
5	Singapore	788
6	Netherlands	544
7	France	468
8	Hong Kong	285
9	Indonesia	278
10	India	237

Monday, July 6, 2026

Botnet Statistics [2026-07-05]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-05 00:00-23:59 UTC
total number of suspected botnet IPs: 20664
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19810
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	59051
2	22	38301
3	1433	31366
4	2122	27636
5	33222	19656
6	6001	16676
7	23	14625
8	5902	13386
9	10000	13150
10	30011	11361

Rank	Network	# of suspected botnet IPs
1	AL-3	1446
2	MSFT	1394
3	GOOGLE-CLOUD	1047
4	PAN-22	962
5	INFRAWATCH	806
6	ASEPL-SG	559
7	VOLCANO-ENGINE	464
8	FR-ONYPHE-20191111	448
9	cloud	323
10	DE-ALPHA	322

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9080
2	China	4103
3	Germany	889
4	Singapore	807
5	United Kingdom	711
6	Netherlands	535
7	France	470
8	South Korea	316
9	India	305
10	Hong Kong	304

Sunday, July 5, 2026

Botnet Statistics [2026-07-04]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-04 00:00-23:59 UTC
total number of suspected botnet IPs: 20500
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19650
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	66244
2	8015	53588
3	22	53003
4	888	37213
5	2078	37029
6	2222	34335
7	1433	33030
8	2122	32299
9	9011	29873
10	8082	29182

Rank	Network	# of suspected botnet IPs
1	AL-3	1408
2	MSFT	1367
3	INFRAWATCH	1133
4	GOOGLE-CLOUD	1055
5	PAN-22	963
6	ASEPL-SG	571
7	VOLCANO-ENGINE	473
8	FR-ONYPHE-20191111	448
9	cloud	325
10	DE-ALPHA	322

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8241
2	China	4042
3	United Kingdom	1097
4	Germany	948
5	Singapore	830
6	Netherlands	557
7	France	478
8	India	352
9	South Korea	316
10	Hong Kong	308

Saturday, July 4, 2026

Botnet Statistics [2026-07-03]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-03 00:00-23:59 UTC
total number of suspected botnet IPs: 21313
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20398
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	6371	117601
2	5900	71036
3	5640	62819
4	6911	61271
5	7348	59257
6	9294	55041
7	2684	54438
8	8015	54177
9	14177	51657
10	11382	48021

Rank	Network	# of suspected botnet IPs
1	AL-3	1540
2	MSFT	1417
3	INFRAWATCH	1116
4	GOOGLE-CLOUD	1079
5	PAN-22	965
6	ASEPL-SG	510
7	VOLCANO-ENGINE	466
8	FR-ONYPHE-20191111	448
9	CENSY	373
10	cloud	293

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9255
2	China	3924
3	United Kingdom	1113
4	Germany	815
5	Singapore	770
6	Netherlands	568
7	France	476
8	Hong Kong	341
9	South Korea	312
10	India	300

Friday, July 3, 2026

Botnet Statistics [2026-07-02]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-02 00:00-23:59 UTC
total number of suspected botnet IPs: 24479
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 23604
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	6879	133373
2	9665	96327
3	4771	69795
4	4683	69551
5	5900	65386
6	888	65376
7	8015	57532
8	12007	50323
9	2078	48866
10	13490	42977

Rank	Network	# of suspected botnet IPs
1	AL-3	1435
2	MSFT	1379
3	INFRAWATCH	1075
4	GOOGLE-CLOUD	1064
5	PAN-22	964
6	ASEPL-SG	551
7	VOLCANO-ENGINE	470
8	FR-ONYPHE-20191111	448
9	CENSY	379
10	UNICOM	359

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9045
2	China	7734
3	United Kingdom	849
4	Singapore	808
5	Germany	786
6	Netherlands	572
7	France	492
8	South Korea	331
9	Hong Kong	328
10	India	312

Thursday, July 2, 2026

Botnet Statistics [2026-07-01]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for July 2026.
detection period: 2026-07-01 00:00-23:59 UTC
total number of suspected botnet IPs: 20929
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19851
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	2282	84318
2	888	74481
3	5900	60973
4	8015	60432
5	2078	53679
6	9901	49198
7	2122	47310
8	2222	44780
9	8088	40596
10	7777	33791

Rank	Network	# of suspected botnet IPs
1	AL-3	1438
2	MSFT	1423
3	INFRAWATCH	1075
4	GOOGLE-CLOUD	1044
5	PAN-22	961
6	ASEPL-SG	575
7	VOLCANO-ENGINE	475
8	FR-ONYPHE-20191111	448
9	CENSY	382
10	DE-ALPHA	278

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8460
2	China	3980
3	United Kingdom	994
4	Germany	867
5	Singapore	803
6	France	561
7	Netherlands	554
8	India	358
9	South Korea	349
10	Hong Kong	337

Daily Zombie Lists for July 2026（2026年07月，每日殭屍電腦IP清單）

To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:

為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：

Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;

第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；

Column 2: Zombie IP;

第2欄：該殭屍電腦的IP位址；

Column 3: TCP destination port number scanned by the zombie.

第3欄：該殭屍電腦所掃描的TCP埠號。

Join the "Suspected Zombie IP List" Telegram channel to get notified when the latest data are ready for download.

想在第一時間取得資料下載網址？請加入Suspected Zombie IP List的Telegram頻道。

Here are the download links of the daily zombie IP lists for July 2026 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):

以下是2026年07月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：

07/01: download link 下載網址; MD5sum: b3e4c8ad8df9432cac685a646a872449

07/02: download link 下載網址; MD5sum: e3bb8592a0312dd8432ad656b2f4b5ed

07/03: download link 下載網址; MD5sum: b189b6fcb8806442a7c8cbd7d28aa071

07/04: download link 下載網址; MD5sum: ab4d1f3035f7cbcc47f546844e416058

07/05: download link 下載網址; MD5sum: 8481e0d41e122c844b8d5bb4b3edae30

07/06: download link 下載網址; MD5sum: 1921299c39822aca61f0ad11f06a6f2a

07/07: download link 下載網址; MD5sum: 5abab387b2d0bc4d65f010a1c54d6fbf

07/08: download link 下載網址; MD5sum: 3c56031ec051f885013db9ee34807ead

07/09: download link 下載網址; MD5sum: 3a67ab48f2427b326385dc61da3e604a

07/10: download link 下載網址; MD5sum: 230b99e78f2fc743341abdbe95fcc893

07/11: download link 下載網址; MD5sum: d96ddbcdb50660b8b2343cbfde9135df

07/12: download link 下載網址; MD5sum: 4369c4bef5e8d492cef2a8f93defd9df

07/13: download link 下載網址; MD5sum: 2f070b3f0b1847493c9e745795da4e94

07/14: download link 下載網址; MD5sum: 7dc07fabc360366ca4974d480ebfeec0

07/15: download link 下載網址; MD5sum: 9e89dd23cafe428050ce89e2a04ac287

07/16: download link 下載網址; MD5sum: ad0b08fcc67232160c98179aa9a2459c

07/17: download link 下載網址; MD5sum: 504d8e28b054c79e010faadec340f99a

07/18: download link 下載網址; MD5sum: abeb6aee3c82c268d9b6911c8cd8f3b7

07/19: download link 下載網址; MD5sum: 1f0e1d3275728dc5424a9852596387ff

07/20: download link 下載網址; MD5sum: 989f47ba0cc72f93adb29a5c8b8df7b9

Wednesday, July 1, 2026

Botnet Statistics [2026-06-30]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for June 2026.
detection period: 2026-06-30 00:00-23:59 UTC
total number of suspected botnet IPs: 21522
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20549
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	2282	84415
2	888	74806
3	9443	60425
4	2122	51959
5	5900	50633
6	8015	50594
7	2078	49555
8	8088	45554
9	2222	44750
10	25	34357

Rank	Network	# of suspected botnet IPs
1	AL-3	1436
2	MSFT	1399
3	INFRAWATCH	1137
4	GOOGLE-CLOUD	1045
5	PAN-22	960
6	ASEPL-SG	574
7	VOLCANO-ENGINE	479
8	FR-ONYPHE-20191111	448
9	CENSY	378
10	DE-ALPHA	323

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8933
2	China	3915
3	United Kingdom	1075
4	Germany	965
5	Singapore	813
6	Netherlands	581
7	France	563
8	South Korea	365
9	India	362
10	Hong Kong	336

Subscribe to: Posts (Atom)

Subscribe for Free

Daily Top 10 Botnet Info!

Pages

• Home
• Human Readable Sitemap

Featured Posts

• ZBTrap: a Virtual Appliance for Botnet Detection
• Botnet Statistics for February 2018
• Botnet Statistics for the year of 2017
• Building a botnet detector with Exim and SQLite, a step-by-step procedure wannabe
• How could China cut spam so effectively?
• DISAN: a proposed framework for botnet mitigation
• DDoS attacks make Wikileaks a great botnet detection system

About Botnet Tracker

Chih-Cherng Chin

Taiwan

I submitted a paper titled "Follow the spam: a botnet detection and notification mechanism" (in Chinese) to this year's TANET conference (TANET 2010), and it has been accepted. In that paper, I pointed out the problem with botnet mitigation measures which focus on taking C&C servers offline, described the detection strategy of "follow the spam," and made a general sketch of how I detect and report botnets. So far I have only implemented half of the "follow the spam" strategy. Hope someone else will implement the other half.

My previous work was an open relay detection and notification system (presented at TANET 2006 conference), which was able to uncover more than 1200 open relays (confirmed by ORDB) each month at the time.

View my complete profile

Labels

• bot list (3009)
• botnet chart (6092)
• botnet detection (8)
• botnet mitigation (6)
• cyber security (2)
• daily zombie IP list (68)
• google adsense (1)
• greylisting (3)
• haproxy (2)
• monthly statistics (125)
• open proxy (1)
• port scan (2)
• suspected bots ip (96)
• yearly statistics (8)
• ZBTrap (1)

Blog Archive

• ▼  2026 (204)
  • July (22)
  • June (29)
  • May (32)
  • April (31)
  • March (31)
  • February (29)
  • January (30)

• ►  2025 (371)
  • December (31)
  • November (31)
  • October (32)
  • September (31)
  • August (30)
  • July (31)
  • June (30)
  • May (32)
  • April (30)
  • March (32)
  • February (29)
  • January (32)

• ►  2024 (378)
  • December (32)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (30)
  • January (32)

• ►  2023 (376)
  • December (32)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (29)
  • January (31)

• ►  2022 (376)
  • December (32)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (28)
  • January (32)

• ►  2021 (373)
  • December (28)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (29)
  • January (32)

• ►  2020 (701)
  • December (33)
  • November (60)
  • October (62)
  • September (60)
  • August (62)
  • July (62)
  • June (60)
  • May (60)
  • April (60)
  • March (62)
  • February (58)
  • January (62)

• ►  2019 (738)
  • December (62)
  • November (59)
  • October (65)
  • September (60)
  • August (62)
  • July (62)
  • June (60)
  • May (64)
  • April (58)
  • March (66)
  • February (56)
  • January (64)

• ►  2018 (752)
  • December (62)
  • November (65)
  • October (63)
  • September (62)
  • August (65)
  • July (64)
  • June (61)
  • May (64)
  • April (61)
  • March (64)
  • February (59)
  • January (62)

• ►  2017 (729)
  • December (64)
  • November (62)
  • October (58)
  • September (58)
  • August (64)
  • July (62)
  • June (62)
  • May (58)
  • April (54)
  • March (64)
  • February (58)
  • January (65)

• ►  2016 (757)
  • December (64)
  • November (62)
  • October (64)
  • September (62)
  • August (64)
  • July (64)
  • June (61)
  • May (64)
  • April (62)
  • March (64)
  • February (61)
  • January (65)

• ►  2015 (737)
  • December (64)
  • November (62)
  • October (62)
  • September (61)
  • August (64)
  • July (62)
  • June (60)
  • May (64)
  • April (54)
  • March (64)
  • February (56)
  • January (64)

• ►  2014 (745)
  • December (64)
  • November (60)
  • October (64)
  • September (58)
  • August (60)
  • July (64)
  • June (62)
  • May (64)
  • April (62)
  • March (64)
  • February (58)
  • January (65)

• ►  2013 (750)
  • December (64)
  • November (62)
  • October (64)
  • September (62)
  • August (64)
  • July (64)
  • June (64)
  • May (63)
  • April (61)
  • March (61)
  • February (57)
  • January (64)

• ►  2012 (528)
  • December (63)
  • November (61)
  • October (63)
  • September (61)
  • August (59)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (30)
  • January (33)

• ►  2011 (382)
  • December (32)
  • November (31)
  • October (33)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (33)
  • April (31)
  • March (33)
  • February (29)
  • January (34)

• ►  2010 (387)
  • December (33)
  • November (32)
  • October (32)
  • September (33)
  • August (30)
  • July (32)
  • June (31)
  • May (32)
  • April (40)
  • March (32)
  • February (29)
  • January (31)

• ►  2009 (119)
  • December (31)
  • November (31)
  • October (33)
  • September (24)

Rank	TCP port number	# of connection attempts received
1	2282	65544
2	888	63247
3	9443	51779
4	3306	48689
5	5900	48407
6	2122	43054
7	8015	42059
8	8088	41619
9	2078	31909
10	2222	31282