Botnet Statistics [2026-02-25]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-25 00:00-23:59 UTC
total number of suspected botnet IPs: 20582
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19363
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	AL-3	1307
2	MSFT	1193
3	GOOGLE-CLOUD	1003
4	PAN-22	948
5	VOLCANO-ENGINE	484
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	383
8	CENSY	381
9	CMNET	380
10	ALISOFT	334

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8425
2	China	4355
3	Singapore	736
4	France	568
5	Hong Kong	471
6	India	447
7	United Kingdom	447
8	South Korea	415
9	Netherlands	398
10	Indonesia	335

Wednesday, February 25, 2026

Botnet Statistics [2026-02-24]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-24 00:00-23:59 UTC
total number of suspected botnet IPs: 20802
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19658
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	119479
2	9075	100212
3	6852	99892
4	22	95516
5	6402	91147
6	5072	88638
7	7081	81461
8	2008	81160
9	7072	78006
10	35075	76902

Rank	Network	# of suspected botnet IPs
1	AL-3	1303
2	MSFT	1167
3	GOOGLE-CLOUD	1006
4	PAN-22	947
5	VOLCANO-ENGINE	485
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	409
8	CENSY	378
9	ALISOFT	330
10	UCLOUD-HK	284

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9310
2	China	4149
3	Singapore	764
4	France	549
5	Hong Kong	445
6	Netherlands	403
7	South Korea	395
8	India	369
9	United Kingdom	367
10	Indonesia	324

Tuesday, February 24, 2026

Botnet Statistics [2026-02-23]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-23 00:00-23:59 UTC
total number of suspected botnet IPs: 20250
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19013
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	111754
2	7434	99447
3	27053	98354
4	22	92296
5	3061	90272
6	5010	81789
7	39051	68693
8	4062	65680
9	34053	57140
10	5061	56570

Rank	Network	# of suspected botnet IPs
1	MSFT	1148
2	AL-3	1079
3	GOOGLE-CLOUD	990
4	PAN-22	947
5	VOLCANO-ENGINE	483
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	397
8	CENSY	379
9	ALISOFT	335
10	UCLOUD-HK	272

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8486
2	China	4094
3	Singapore	770
4	France	559
5	Hong Kong	454
6	India	437
7	Netherlands	412
8	South Korea	379
9	Indonesia	335
10	Russian Federation	309

Monday, February 23, 2026

Botnet Statistics [2026-02-22]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-22 00:00-23:59 UTC
total number of suspected botnet IPs: 20227
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19259
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	22	162868
2	5900	117605
3	13047	99940
4	17051	62217
5	38041	57813
6	14053	57733
7	2221	57107
8	15047	55517
9	8054	54421
10	7051	51117

Rank	Network	# of suspected botnet IPs
1	MSFT	1135
2	GOOGLE-CLOUD	1002
3	PAN-22	950
4	AL-3	947
5	VOLCANO-ENGINE	485
6	FR-ONYPHE-20191111	447
7	ASEPL-SG	388
8	CENSY	378
9	ALISOFT	327
10	LINODE-US	279

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9019
2	China	3929
3	Singapore	710
4	France	554
5	Hong Kong	432
6	Netherlands	431
7	India	402
8	South Korea	336
9	Russian Federation	301
10	Indonesia	290

Sunday, February 22, 2026

Botnet Statistics [2026-02-21]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-21 00:00-23:59 UTC
total number of suspected botnet IPs: 18631
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17665
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	134802
2	22	103575
3	2221	57053
4	4622	47348
5	2245	40982
6	5902	40012
7	50122	39583
8	10008	38567
9	10002	38378
10	2222	37506

Rank	Network	# of suspected botnet IPs
1	MSFT	1083
2	GOOGLE-CLOUD	1003
3	PAN-22	950
4	AL-3	938
5	VOLCANO-ENGINE	492
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	382
8	CENSY	379
9	ALISOFT	330
10	UCLOUD-HK	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	7596
2	China	4009
3	Singapore	671
4	France	571
5	Hong Kong	430
6	India	414
7	Netherlands	351
8	Indonesia	332
9	South Korea	321
10	Russian Federation	309

Saturday, February 21, 2026

Botnet Statistics [2026-02-20]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-20 00:00-23:59 UTC
total number of suspected botnet IPs: 21338
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20135
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	113464
2	2221	54286
3	22	41785
4	5902	36886
5	7000	35499
6	2245	33363
7	10008	31900
8	2222	31691
9	6222	31653
10	50122	30978

Rank	Network	# of suspected botnet IPs
1	AL-3	1322
2	MSFT	1210
3	GOOGLE-CLOUD	1010
4	PAN-22	950
5	VOLCANO-ENGINE	496
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	398
8	CENSY	381
9	ALISOFT	338
10	CMNET	305

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8925
2	China	4478
3	Singapore	755
4	France	569
5	India	511
6	Hong Kong	453
7	Netherlands	424
8	Indonesia	376
9	Russian Federation	368
10	South Korea	324

Friday, February 20, 2026

Botnet Statistics [2026-02-19]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-19 00:00-23:59 UTC
total number of suspected botnet IPs: 21883
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20713
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	121986
2	22	78737
3	2221	56913
4	1022	55901
5	11021	46952
6	7422	46369
7	4400	44772
8	6822	42543
9	8322	41706
10	19021	37843

Rank	Network	# of suspected botnet IPs
1	AL-3	1322
2	MSFT	1187
3	GOOGLE-CLOUD	1010
4	PAN-22	950
5	VOLCANO-ENGINE	502
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	414
8	CENSY	381
9	ALISOFT	345
10	CMNET	302

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9429
2	China	4463
3	Singapore	754
4	France	578
5	India	495
6	Hong Kong	447
7	Netherlands	430
8	Indonesia	395
9	Russian Federation	380
10	Germany	334

Thursday, February 19, 2026

Botnet Statistics [2026-02-18]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-18 00:00-23:59 UTC
total number of suspected botnet IPs: 21157
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19980
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	128943
2	6000	81286
3	7021	66680
4	2221	58986
5	22	58664
6	1022	43938
7	38014	41127
8	4021	40041
9	7500	39989
10	2243	35205

Rank	Network	# of suspected botnet IPs
1	AL-3	1255
2	MSFT	1253
3	GOOGLE-CLOUD	1007
4	PAN-22	948
5	VOLCANO-ENGINE	514
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	406
8	CENSY	383
9	ALISOFT	343
10	CMNET	280

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8704
2	China	4310
3	Singapore	708
4	France	587
5	India	522
6	Hong Kong	461
7	Indonesia	439
8	Netherlands	401
9	Russian Federation	391
10	South Korea	355

Wednesday, February 18, 2026

Botnet Statistics [2026-02-17]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-17 00:00-23:59 UTC
total number of suspected botnet IPs: 20726
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19596
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	216022
2	2243	95430
3	2083	73482
4	6000	72035
5	5321	63015
6	38003	51725
7	2221	51420
8	2922	49881
9	7025	48164
10	22	47809

Rank	Network	# of suspected botnet IPs
1	MSFT	1390
2	AL-3	1097
3	GOOGLE-CLOUD	1006
4	PAN-22	949
5	VOLCANO-ENGINE	461
6	FR-ONYPHE-20191111	448
7	CENSY	380
8	ASEPL-SG	374
9	ALISOFT	338
10	cloud	300

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9285
2	China	4071
3	Singapore	638
4	France	564
5	India	480
6	Netherlands	412
7	Hong Kong	399
8	Germany	317
9	Russian Federation	309
10	South Korea	305

Tuesday, February 17, 2026

Botnet Statistics [2026-02-16]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-16 00:00-23:59 UTC
total number of suspected botnet IPs: 19886
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18815
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	291765
2	2243	95495
3	2221	49645
4	2083	44520
5	22	42028
6	5804	35731
7	5321	34136
8	5986	32982
9	2922	28255
10	5902	27755

Rank	Network	# of suspected botnet IPs
1	MSFT	1463
2	AL-3	1307
3	GOOGLE-CLOUD	999
4	PAN-22	946
5	VOLCANO-ENGINE	467
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	388
8	CENSY	375
9	ALISOFT	328
10	cloud	309

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8858
2	China	4379
3	Singapore	690
4	France	548
5	Netherlands	443
6	Hong Kong	403
7	India	342
8	Germany	274
9	Indonesia	261
10	South Korea	251

Monday, February 16, 2026

Botnet Statistics [2026-02-15]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-15 00:00-23:59 UTC
total number of suspected botnet IPs: 20205
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18808
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	358953
2	2243	92775
3	3345	61071
4	22	57896
5	5804	57416
6	5008	52467
7	2221	47133
8	2922	46013
9	5986	32525
10	2100	30773

Rank	Network	# of suspected botnet IPs
1	MSFT	1460
2	AL-3	1334
3	GOOGLE-CLOUD	1003
4	PAN-22	949
5	VOLCANO-ENGINE	466
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	393
8	CENSY	379
9	ALISOFT	341
10	CMNET	295

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9401
2	China	3572
3	Singapore	723
4	France	564
5	Netherlands	508
6	India	405
7	Hong Kong	404
8	South Korea	330
9	United Kingdom	281
10	Russian Federation	257

Sunday, February 15, 2026

Botnet Statistics [2026-02-14]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-14 00:00-23:59 UTC
total number of suspected botnet IPs: 19136
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18195
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	349572
2	2243	95603
3	22	66240
4	3345	62911
5	2100	59950
6	9022	53694
7	1973	49875
8	2221	47320
9	5804	47070
10	14000	37234

Rank	Network	# of suspected botnet IPs
1	MSFT	1441
2	AL-3	1306
3	GOOGLE-CLOUD	1002
4	PAN-22	950
5	VOLCANO-ENGINE	473
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	402
8	CENSY	380
9	ALISOFT	346
10	cloud	326

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8875
2	China	3758
3	Singapore	720
4	France	557
5	Hong Kong	405
6	India	403
7	Netherlands	396
8	South Korea	290
9	Germany	281
10	United Kingdom	279

Saturday, February 14, 2026

Botnet Statistics [2026-02-13]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-13 00:00-23:59 UTC
total number of suspected botnet IPs: 19596
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18591
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	355235
2	2243	95517
3	3345	49857
4	12343	47652
5	2221	47531
6	22	44180
7	9022	35095
8	6697	32473
9	9125	30086
10	5001	29457

Rank	Network	# of suspected botnet IPs
1	MSFT	1420
2	AL-3	1214
3	GOOGLE-CLOUD	1009
4	PAN-22	950
5	VOLCANO-ENGINE	473
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	410
8	CENSY	383
9	cloud	323
10	ALISOFT	322

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8906
2	China	3988
3	Singapore	732
4	France	556
5	Netherlands	425
6	India	417
7	Hong Kong	393
8	South Korea	310
9	Indonesia	302
10	Russian Federation	280

Friday, February 13, 2026

Botnet Statistics [2026-02-12]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-12 00:00-23:59 UTC
total number of suspected botnet IPs: 20986
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19908
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	362216
2	2243	93897
3	22	55549
4	5259	37475
5	9003	36625
6	2221	30114
7	3301	26099
8	1122	25656
9	4646	25289
10	5901	24100

Rank	Network	# of suspected botnet IPs
1	MSFT	1431
2	AL-3	1333
3	GOOGLE-CLOUD	1012
4	PAN-22	950
5	VOLCANO-ENGINE	468
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	410
8	CENSY	378
9	ALISOFT	351
10	cloud	327

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9678
2	China	4119
3	Singapore	738
4	France	548
5	India	466
6	Netherlands	457
7	Hong Kong	409
8	South Korea	322
9	United Kingdom	322
10	Russian Federation	299

Thursday, February 12, 2026

Botnet Statistics [2026-02-11]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-11 00:00-23:59 UTC
total number of suspected botnet IPs: 21406
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20279
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	298236
2	2243	86179
3	2762	81493
4	6673	69262
5	22	53580
6	7802	53435
7	6154	50799
8	3174	47654
9	3301	44356
10	4646	42780

Rank	Network	# of suspected botnet IPs
1	MSFT	1449
2	AL-3	1312
3	GOOGLE-CLOUD	996
4	PAN-22	946
5	VOLCANO-ENGINE	474
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	400
8	CENSY	372
9	ALISOFT	337
10	cloud	318

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9302
2	China	4914
3	Singapore	757
4	France	550
5	Netherlands	445
6	India	441
7	Hong Kong	416
8	Russian Federation	352
9	United Kingdom	328
10	South Korea	323

Wednesday, February 11, 2026

Botnet Statistics [2026-02-10]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-10 00:00-23:59 UTC
total number of suspected botnet IPs: 22206
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21105
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	345718
2	2243	95529
3	22	94850
4	2220	87804
5	12140	54685
6	8015	53111
7	3178	45829
8	3069	39976
9	2222	39922
10	888	39061

Rank	Network	# of suspected botnet IPs
1	MSFT	1428
2	AL-3	1328
3	GOOGLE-CLOUD	1004
4	PAN-22	949
5	VOLCANO-ENGINE	469
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	415
8	CENSY	377
9	ALISOFT	323
10	cloud	306

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9587
2	China	5187
3	Singapore	799
4	Netherlands	575
5	France	553
6	India	446
7	Hong Kong	426
8	South Korea	336
9	Russian Federation	322
10	Indonesia	291

Tuesday, February 10, 2026

Botnet Statistics [2026-02-09]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-09 00:00-23:59 UTC
total number of suspected botnet IPs: 19768
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18651
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	212173
2	2220	87018
3	2243	74710
4	22	63348
5	8000	52144
6	14000	49007
7	12005	45580
8	2222	34265
9	2224	30189
10	888	30136

Rank	Network	# of suspected botnet IPs
1	MSFT	1374
2	AL-3	1076
3	GOOGLE-CLOUD	998
4	PAN-22	948
5	VOLCANO-ENGINE	462
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	421
8	CENSY	377
9	ALISOFT	329
10	cloud	288

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8720
2	China	3832
3	Singapore	816
4	France	549
5	Netherlands	489
6	India	447
7	Hong Kong	402
8	Russian Federation	319
9	South Korea	295
10	Indonesia	287

Monday, February 9, 2026

Botnet Statistics [2026-02-08]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-08 00:00-23:59 UTC
total number of suspected botnet IPs: 19917
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18878
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	353667
2	7722	112252
3	2220	87723
4	22	75840
5	6710	43962
6	2221	40571
7	7160	35364
8	2201	31564
9	2224	25646
10	2223	25437

Rank	Network	# of suspected botnet IPs
1	MSFT	1387
2	AL-3	1007
3	GOOGLE-CLOUD	1006
4	PAN-22	950
5	VOLCANO-ENGINE	460
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	403
8	CENSY	376
9	DO-13	324
10	ALISOFT	323

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9268
2	China	3873
3	Singapore	773
4	France	533
5	Netherlands	418
6	South Korea	383
7	Hong Kong	370
8	India	369
9	Russian Federation	286
10	Indonesia	246

Sunday, February 8, 2026

Botnet Statistics [2026-02-07]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-07 00:00-23:59 UTC
total number of suspected botnet IPs: 20230
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18595
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	464534
2	22	105229
3	2220	94081
4	2201	42233
5	8000	34714
6	888	34295
7	54321	32149
8	2078	30480
9	8082	28812
10	2222	28478

Rank	Network	# of suspected botnet IPs
1	MSFT	1385
2	AL-3	1354
3	GOOGLE-CLOUD	1008
4	PAN-22	949
5	VOLCANO-ENGINE	466
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	418
8	CENSY	373
9	ALISOFT	317
10	CMNET	301

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8601
2	China	4115
3	Singapore	759
4	France	531
5	South Korea	450
6	India	439
7	Hong Kong	416
8	Netherlands	326
9	Russian Federation	287
10	Germany	260

Saturday, February 7, 2026

Botnet Statistics [2026-02-06]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-06 00:00-23:59 UTC
total number of suspected botnet IPs: 20188
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18654
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	467384
2	2220	87167
3	22	68197
4	2242	59541
5	2201	45891
6	5902	32852
7	54321	30025
8	2222	27410
9	9119	25477
10	2223	24977

Rank	Network	# of suspected botnet IPs
1	MSFT	1353
2	AL-3	1348
3	GOOGLE-CLOUD	1012
4	PAN-22	950
5	VOLCANO-ENGINE	474
6	FR-ONYPHE-20191111	448
7	ASEPL-SG	422
8	CENSY	371
9	ALISOFT	331
10	CMNET	294

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8523
2	China	3976
3	Singapore	746
4	France	540
5	South Korea	456
6	India	451
7	Hong Kong	402
8	Netherlands	332
9	Russian Federation	329
10	Indonesia	295

Friday, February 6, 2026

Botnet Statistics [2026-02-05]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-05 00:00-23:59 UTC
total number of suspected botnet IPs: 20291
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18608
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	394014
2	2220	84493
3	22	66329
4	2242	66157
5	2201	49511
6	6688	40487
7	54321	31929
8	5902	28780
9	8122	24493
10	8055	24462

Rank	Network	# of suspected botnet IPs
1	MSFT	1343
2	AL-3	1272
3	GOOGLE-CLOUD	1017
4	PAN-22	950
5	VOLCANO-ENGINE	512
6	FR-ONYPHE-20191111	416
7	ASEPL-SG	399
8	CENSY	373
9	ALISOFT	341
10	CMNET	276

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8907
2	China	3866
3	Singapore	709
4	France	519
5	India	435
6	Netherlands	421
7	Hong Kong	420
8	Russian Federation	339
9	South Korea	335
10	Indonesia	312

Thursday, February 5, 2026

Botnet Statistics [2026-02-04]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-04 00:00-23:59 UTC
total number of suspected botnet IPs: 20257
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18629
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	436033
2	4321	81266
3	2242	59566
4	22	58974
5	5630	54430
6	8520	53024
7	2201	50183
8	5555	39484
9	2225	33147
10	9999	32817

Rank	Network	# of suspected botnet IPs
1	MSFT	1368
2	AL-3	1223
3	GOOGLE-CLOUD	1007
4	PAN-22	946
5	VOLCANO-ENGINE	509
6	FR-ONYPHE-20191111	416
7	ASEPL-SG	410
8	ALISOFT	395
9	CENSY	378
10	CMNET	278

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8594
2	China	3986
3	Singapore	718
4	France	512
5	India	473
6	Hong Kong	411
7	Netherlands	385
8	South Korea	362
9	Russian Federation	334
10	Indonesia	314

Wednesday, February 4, 2026

Botnet Statistics [2026-02-03]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-03 00:00-23:59 UTC
total number of suspected botnet IPs: 20461
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18797
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	523518
2	4321	132757
3	5555	101992
4	5630	98833
5	2242	73282
6	4160	73045
7	7654	72788
8	22	69435
9	2255	64631
10	8024	59068

Rank	Network	# of suspected botnet IPs
1	MSFT	1417
2	AL-3	1262
3	GOOGLE-CLOUD	1006
4	PAN-22	950
5	VOLCANO-ENGINE	512
6	FR-ONYPHE-20191111	416
7	ASEPL-SG	416
8	CENSY	371
9	ALISOFT	337
10	CMNET	278

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8863
2	China	3868
3	Singapore	728
4	India	500
5	France	500
6	Hong Kong	419
7	Netherlands	378
8	Russian Federation	363
9	Indonesia	348
10	South Korea	331

Tuesday, February 3, 2026

Botnet Statistics [2026-02-02]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-02 00:00-23:59 UTC
total number of suspected botnet IPs: 19984
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18231
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	467798
2	4160	104056
3	5555	88359
4	2242	81005
5	7654	80991
6	2255	70652
7	2201	63428
8	2219	59252
9	9999	52248
10	22	45236

Rank	Network	# of suspected botnet IPs
1	MSFT	1385
2	GOOGLE-CLOUD	1008
3	AL-3	999
4	PAN-22	948
5	VOLCANO-ENGINE	548
6	ASEPL-SG	434
7	FR-ONYPHE-20191111	416
8	ALISOFT	377
9	CENSY	374
10	CMNET	291

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	7835
2	China	4145
3	Singapore	745
4	France	530
5	India	473
6	Hong Kong	419
7	South Korea	356
8	Netherlands	347
9	Russian Federation	345
10	Indonesia	338

Monday, February 2, 2026

Botnet Statistics [2026-02-01]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for February 2026.
detection period: 2026-02-01 00:00-23:59 UTC
total number of suspected botnet IPs: 20367
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18711
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	400198
2	4160	91420
3	7654	69023
4	9999	60808
5	2242	60027
6	2219	58486
7	22	55565
8	2255	45358
9	8141	44515
10	2201	40446

Rank	Network	# of suspected botnet IPs
1	MSFT	1421
2	GOOGLE-CLOUD	1007
3	PAN-22	950
4	AL-3	948
5	VOLCANO-ENGINE	470
6	ASEPL-SG	423
7	FR-ONYPHE-20191111	416
8	ALISOFT	380
9	CENSY	377
10	CMNET	316

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8438
2	China	4315
3	Singapore	813
4	France	492
5	India	440
6	Hong Kong	407
7	South Korea	383
8	Russian Federation	338
9	Netherlands	319
10	Indonesia	244

Daily Zombie Lists for February 2026（2026年02月，每日殭屍電腦IP清單）

To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:

為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：

Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;

第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；

Column 2: Zombie IP;

第2欄：該殭屍電腦的IP位址；

Column 3: TCP destination port number scanned by the zombie.

第3欄：該殭屍電腦所掃描的TCP埠號。

Join the "Suspected Zombie IP List" Telegram channel to get notified when the latest data are ready for download.

想在第一時間取得資料下載網址？請加入Suspected Zombie IP List的Telegram頻道。

Here are the download links of the daily zombie IP lists for February 2026 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):

以下是2026年02月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：

02/01: download link 下載網址; MD5sum: 9f749a9f2d0576255a8320dd97ecc47c

02/02: download link 下載網址; MD5sum: 0adab9f64b7464624697328031f73a55

02/03: download link 下載網址; MD5sum: 54b2e51236711b6ce6be45c61a1cb298

02/04: download link 下載網址; MD5sum: 160939ad1604aeb953c6bd07d10aabab

02/05: download link 下載網址; MD5sum: 560b67dfd3006f08e8b81a4fb5a21ab4

02/06: download link 下載網址; MD5sum: a8e1313baa1c5a009f9c86d2d40f4fd6

02/07: download link 下載網址; MD5sum: 181634a5645a5d8e0b723d49c6abb7a4

02/08: download link 下載網址; MD5sum: 4f44a99c158ceeb50e28822ab579fbe9

02/09: download link 下載網址; MD5sum: e58d0028bdd8968252364b7a87011629

02/10: download link 下載網址; MD5sum: e35f60d727509be2823ea0cb8e5e83ab

02/11: download link 下載網址; MD5sum: 5b6a7ee85fef408ad33c0789de214a7b

02/12: download link 下載網址; MD5sum: a36ca7f483f723e6a5ce46c38dc4306c

02/13: download link 下載網址; MD5sum: a222ba04f44a90e882e8ab05d77a3ab2

02/14: download link 下載網址; MD5sum: 780ce74a75393106092eeffcec7edf22

02/15: download link 下載網址; MD5sum: 47032daa1bb10004140440a15b1aab88

02/16: download link 下載網址; MD5sum: 1e02ab80928a2bd83747d7016ff81e9c

02/17: download link 下載網址; MD5sum: 719c35c189c2d9a7f7b220c2dea38bc9

02/18: download link 下載網址; MD5sum: 439c02443acb1e334a11af3cb4e0c112

02/19: download link 下載網址; MD5sum: 1ade8c92cbc9812790915b015825992c

02/20: download link 下載網址; MD5sum: bd75ea4603ac423bdd54254286f81235

02/21: download link 下載網址; MD5sum: 823055563b07b29bd19e6d0e61105467

02/22: download link 下載網址; MD5sum: 8aed38e51398d579b9158703ce172570

02/23: download link 下載網址; MD5sum: 0cea7449cbd69c800a69a8f585a10153

02/24: download link 下載網址; MD5sum: 6178db962a7dcc82da8a714b46fc2eb7

02/25: download link 下載網址; MD5sum: 8844cdc3dabfbe845c34e99252e1c949

Sunday, February 1, 2026

Botnet Statistics [2026-01-31]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for January 2026.
detection period: 2026-01-31 00:00-23:59 UTC
total number of suspected botnet IPs: 20087
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18362
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	463685
2	22	68871
3	2242	68145
4	6666	67381
5	9999	50722
6	6000	38353
7	2026	30386
8	6001	29335
9	2222	28310
10	5902	26415

Rank	Network	# of suspected botnet IPs
1	MSFT	1453
2	GOOGLE-CLOUD	1008
3	PAN-22	950
4	AL-3	906
5	BYTEPLUS-SG	811
6	VOLCANO-ENGINE	472
7	ASEPL-SG	429
8	ALISOFT	387
9	CENSY	378
10	FR-ONYPHE-20191111	368

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	7786
2	China	4015
3	Singapore	1428
4	India	481
5	France	415
6	Hong Kong	407
7	South Korea	379
8	Russian Federation	351
9	Netherlands	295
10	Brazil	265

Subscribe to: Comments (Atom)

Subscribe for Free

Daily Top 10 Botnet Info!

Pages

• Home
• Human Readable Sitemap

Featured Posts

• ZBTrap: a Virtual Appliance for Botnet Detection
• Botnet Statistics for February 2018
• Botnet Statistics for the year of 2017
• Building a botnet detector with Exim and SQLite, a step-by-step procedure wannabe
• How could China cut spam so effectively?
• DISAN: a proposed framework for botnet mitigation
• DDoS attacks make Wikileaks a great botnet detection system

About Botnet Tracker

Chih-Cherng Chin

Taiwan

I submitted a paper titled "Follow the spam: a botnet detection and notification mechanism" (in Chinese) to this year's TANET conference (TANET 2010), and it has been accepted. In that paper, I pointed out the problem with botnet mitigation measures which focus on taking C&C servers offline, described the detection strategy of "follow the spam," and made a general sketch of how I detect and report botnets. So far I have only implemented half of the "follow the spam" strategy. Hope someone else will implement the other half.

My previous work was an open relay detection and notification system (presented at TANET 2006 conference), which was able to uncover more than 1200 open relays (confirmed by ORDB) each month at the time.

View my complete profile

Labels

• bot list (3009)
• botnet chart (5950)
• botnet detection (8)
• botnet mitigation (6)
• cyber security (2)
• daily zombie IP list (63)
• google adsense (1)
• greylisting (3)
• haproxy (2)
• monthly statistics (125)
• open proxy (1)
• port scan (2)
• suspected bots ip (96)
• yearly statistics (8)
• ZBTrap (1)

Blog Archive

• ▼  2026 (57)
  • February (27)
  • January (30)

• ►  2025 (371)
  • December (31)
  • November (31)
  • October (32)
  • September (31)
  • August (30)
  • July (31)
  • June (30)
  • May (32)
  • April (30)
  • March (32)
  • February (29)
  • January (32)

• ►  2024 (378)
  • December (32)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (30)
  • January (32)

• ►  2023 (376)
  • December (32)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (29)
  • January (31)

• ►  2022 (376)
  • December (32)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (28)
  • January (32)

• ►  2021 (373)
  • December (28)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (29)
  • January (32)

• ►  2020 (701)
  • December (33)
  • November (60)
  • October (62)
  • September (60)
  • August (62)
  • July (62)
  • June (60)
  • May (60)
  • April (60)
  • March (62)
  • February (58)
  • January (62)

• ►  2019 (738)
  • December (62)
  • November (59)
  • October (65)
  • September (60)
  • August (62)
  • July (62)
  • June (60)
  • May (64)
  • April (58)
  • March (66)
  • February (56)
  • January (64)

• ►  2018 (752)
  • December (62)
  • November (65)
  • October (63)
  • September (62)
  • August (65)
  • July (64)
  • June (61)
  • May (64)
  • April (61)
  • March (64)
  • February (59)
  • January (62)

• ►  2017 (729)
  • December (64)
  • November (62)
  • October (58)
  • September (58)
  • August (64)
  • July (62)
  • June (62)
  • May (58)
  • April (54)
  • March (64)
  • February (58)
  • January (65)

• ►  2016 (757)
  • December (64)
  • November (62)
  • October (64)
  • September (62)
  • August (64)
  • July (64)
  • June (61)
  • May (64)
  • April (62)
  • March (64)
  • February (61)
  • January (65)

• ►  2015 (737)
  • December (64)
  • November (62)
  • October (62)
  • September (61)
  • August (64)
  • July (62)
  • June (60)
  • May (64)
  • April (54)
  • March (64)
  • February (56)
  • January (64)

• ►  2014 (745)
  • December (64)
  • November (60)
  • October (64)
  • September (58)
  • August (60)
  • July (64)
  • June (62)
  • May (64)
  • April (62)
  • March (64)
  • February (58)
  • January (65)

• ►  2013 (750)
  • December (64)
  • November (62)
  • October (64)
  • September (62)
  • August (64)
  • July (64)
  • June (64)
  • May (63)
  • April (61)
  • March (61)
  • February (57)
  • January (64)

• ►  2012 (528)
  • December (63)
  • November (61)
  • October (63)
  • September (61)
  • August (59)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (30)
  • January (33)

• ►  2011 (382)
  • December (32)
  • November (31)
  • October (33)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (33)
  • April (31)
  • March (33)
  • February (29)
  • January (34)

• ►  2010 (387)
  • December (33)
  • November (32)
  • October (32)
  • September (33)
  • August (30)
  • July (32)
  • June (31)
  • May (32)
  • April (40)
  • March (32)
  • February (29)
  • January (31)

• ►  2009 (119)
  • December (31)
  • November (31)
  • October (33)
  • September (24)

Rank	TCP port number	# of connection attempts received
1	5900	394726
2	6666	86334
3	8811	67494
4	3332	62051
5	1234	55386
6	6000	49485
7	22	48413
8	9999	46757
9	22001	36715
10	2022	33951