Botnet Statistics [2025-01-01]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for January 2025. To get an idea of what IP is scanning the Internet currently, please watch: Daily Botnet Detection Live Streaming.)
detection period: 2025-01-01 00:00-23:59 UTC
total number of suspected botnet IPs: 25810
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 24225
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1609
2	GOOGLE-CLOUD	1013
3	PAN-22	961
4	BSNLNET	930
5	MSFT	871
6	UK-MICROSOFT-20000324	564
7	KORNET-KR	497
8	CMNET	459
9	AL-3	454
10	CHINANET-JS	371

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	7843
2	China	4622
3	Taiwan	1832
4	India	1708
5	United Kingdom	1142
6	South Korea	852
7	Russian Federation	604
8	Hong Kong	531
9	Brazil	478
10	Singapore	441

Rank	TCP port number	# of connection attempts received
1	4444	363777
2	1122	206316
3	3322	174277
4	8899	121205
5	4433	95772
6	6000	78747
7	22	72649
8	23	57016
9	3389	50272
10	24	47941

20250102 Botnet Detection Live Streaming 30+ zombies detected)

Daily Zombie Lists for January 2025（2025年01月，每日殭屍電腦IP清單）

To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:

為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：

Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;

第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；

Column 2: Zombie IP;

第2欄：該殭屍電腦的IP位址；

Column 3: TCP destination port number scanned by the zombie.

第3欄：該殭屍電腦所掃描的TCP埠號。

Join the "Suspected Zombie IP List" Telegram channel to get notified when the latest data are ready for download.

想在第一時間取得資料下載網址？請加入Suspected Zombie IP List的Telegram頻道。

Here are the download links of the daily zombie IP lists for January 2025 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):

以下是2025年01月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：

01/01: download link 下載網址; MD5sum: 6d170756ea431033c5be8a00851a435b

01/02: download link 下載網址; MD5sum: abe2d123f44fb1eecbf6cd1f88347e9a

01/03: download link 下載網址; MD5sum: 9cc92e9f54c88084d69e4acd31fbca0b

01/04: download link 下載網址; MD5sum: 2b88876b11d6d3329c75c90cdeace2f4

01/05: download link 下載網址; MD5sum: fc57c0b35a9edd043e3e8de30fc0f875

01/06: download link 下載網址; MD5sum: 870b0062c6578acbb2a484abd45a6430

01/07: download link 下載網址; MD5sum: 503db5b6dc23863f3eafd134c5e7e130

01/08: download link 下載網址; MD5sum: b30bf59561fe72d34b4e644fd7ed3be3

01/09: download link 下載網址; MD5sum: 7e60d18ccf83269c658e8fcfee028ec6

01/10: download link 下載網址; MD5sum: 6f848569f4b7b821dbc13e72bf4647bd

01/11: download link 下載網址; MD5sum: dbaa5dbb0930f3bc013f0da5da842283

01/12: download link 下載網址; MD5sum: cfca90a20e7d9e546da331fcdbceac6e

01/13: download link 下載網址; MD5sum: b238fe29b2d3fa4b12dc51d8ebe4c4bb

01/14: download link 下載網址; MD5sum: d78ddbde461f5b0406bf6bd5b968dae4

01/15: download link 下載網址; MD5sum: 2d1d36ddc9593cf0c197330bce3abb38

01/16: download link 下載網址; MD5sum: f6657e24879c8fe4eb6dfb140ca76978

01/17: download link 下載網址; MD5sum: 6c8c972f0aeff67eb3f564d13c62bd2c

01/18: download link 下載網址; MD5sum: 93bb9e7f177637d31d94e9bb19b37847

01/19: download link 下載網址; MD5sum: 18986286f8eec2f318437cfa4e0738ff

01/20: download link 下載網址; MD5sum: 657ae3daa973e8dec6a37dc62b35d1e0

01/21: download link 下載網址; MD5sum: ddcd6a7b221a97d17c748fa98467f59b

01/22: download link 下載網址; MD5sum: 61e1660ce540a24455eda813cbf4746f

01/23: download link 下載網址; MD5sum: 9b2698054290dfbafe38c5e28f283a7f

01/24: download link 下載網址; MD5sum: ba2cbc636e843ef0c908b0a23d719142

01/25: download link 下載網址; MD5sum: 4ca0ae91a104d98ce2d6c277b8d852dd

01/26: download link 下載網址; MD5sum: de5e82df6a34af0d13a43d296c0ae8af

01/27: download link 下載網址; MD5sum: 1867d2558b7fa3886a432032ee58589c

01/28: download link 下載網址; MD5sum: bd16279d017ab94eab4e6af2dfe4070a

01/29: download link 下載網址; MD5sum: 007829eee14b2f16e9a8cd4a9e49e35c

01/30: download link 下載網址; MD5sum: a3c59acc03986b660ffd68860440fc3f

01/31: download link 下載網址; MD5sum: 19e6a7d62573ae544b4bad495c742d1d

Botnet Statistics [2024-12-31]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for December 2024. To get an idea of what IP is scanning the Internet currently, please watch: Daily Botnet Detection Live Streaming.)
detection period: 2024-12-31 00:00-23:59 UTC
total number of suspected botnet IPs: 26204
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 24684
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	HINET-NET	1606
2	GOOGLE-CLOUD	990
3	PAN-22	955
4	MSFT	872
5	BSNLNET	851
6	UK-MICROSOFT-20000324	561
7	CMNET	486
8	AL-3	480
9	KORNET-KR	474
10	CENSY	376

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8187
2	China	4621
3	Taiwan	1848
4	India	1669
5	United Kingdom	1104
6	South Korea	826
7	Russian Federation	543
8	Hong Kong	540
9	Brazil	508
10	Singapore	475

Rank	TCP port number	# of connection attempts received
1	3322	246067
2	1122	209333
3	4444	158246
4	8899	122185
5	21	105113
6	4433	102846
7	6000	66583
8	24	65055
9	23	56054
10	22	54080

20250101 Botnet Detection Live Streaming 30+ zombies detected)