Botnet Statistics [2026-05-21]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-21 00:00-23:59 UTC
total number of suspected botnet IPs: 22032
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20728
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	AL-3	1709
2	MSFT	1430
3	GOOGLE-CLOUD	1054
4	INFRAWATCH	1030
5	PAN-22	960
6	ASEPL-SG	594
7	VOLCANO-ENGINE	460
8	FR-ONYPHE-20191111	448
9	CENSY	381
10	cloud	325

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9798
2	China	3577
3	Singapore	1008
4	United Kingdom	757
5	Netherlands	625
6	Germany	557
7	France	519
8	Brazil	414
9	Indonesia	396
10	Hong Kong	379

Thursday, May 21, 2026

Botnet Statistics [2026-05-20]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-20 00:00-23:59 UTC
total number of suspected botnet IPs: 20047
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18879
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	258342
2	2021	61526
3	1722	46487
4	23	41389
5	1122	40310
6	4714	29708
7	7822	27701
8	5902	26355
9	5005	26343
10	4717	25845

Rank	Network	# of suspected botnet IPs
1	AL-3	1595
2	MSFT	1443
3	GOOGLE-CLOUD	1056
4	PAN-22	962
5	INFRAWATCH	859
6	ACEVILLEPTELTD-SG	728
7	ASEPL-SG	569
8	FR-ONYPHE-20191111	448
9	VOLCANO-ENGINE	424
10	CENSY	372

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8764
2	China	3720
3	Singapore	1380
4	United Kingdom	842
5	Netherlands	606
6	France	458
7	Hong Kong	358
8	Indonesia	284
9	Germany	282
10	South Korea	273

Wednesday, May 20, 2026

Botnet Statistics [2026-05-19]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-19 00:00-23:59 UTC
total number of suspected botnet IPs: 22775
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21784
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	296862
2	2261	66170
3	1722	47385
4	22020	34436
5	2332	33821
6	1122	30719
7	4714	30085
8	822	27570
9	4717	26741
10	5902	25766

Rank	Network	# of suspected botnet IPs
1	AL-3	1709
2	MSFT	1435
3	INFRAWATCH	1076
4	GOOGLE-CLOUD	1051
5	PAN-22	961
6	ACEVILLEPTELTD-SG	822
7	ASEPL-SG	583
8	FR-ONYPHE-20191111	448
9	VOLCANO-ENGINE	426
10	CENSY	375

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9887
2	China	4735
3	Singapore	1473
4	United Kingdom	973
5	Germany	591
6	Netherlands	567
7	France	485
8	Hong Kong	356
9	Indonesia	283
10	India	264

Tuesday, May 19, 2026

Botnet Statistics [2026-05-18]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-18 00:00-23:59 UTC
total number of suspected botnet IPs: 20607
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19638
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	182235
2	2261	85221
3	2332	80879
4	1722	47916
5	22020	33974
6	23	30682
7	4714	30468
8	1122	27464
9	4717	26648
10	5902	25273

Rank	Network	# of suspected botnet IPs
1	AL-3	1707
2	MSFT	1442
3	INFRAWATCH	1108
4	GOOGLE-CLOUD	1054
5	PAN-22	962
6	ACEVILLEPTELTD-SG	845
7	ASEPL-SG	617
8	FR-ONYPHE-20191111	448
9	VOLCANO-ENGINE	436
10	CENSY	374

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9004
2	China	3287
3	Singapore	1633
4	United Kingdom	957
5	Netherlands	612
6	Germany	586
7	France	475
8	Hong Kong	358
9	Indonesia	322
10	India	261

Monday, May 18, 2026

Botnet Statistics [2026-05-17]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-17 00:00-23:59 UTC
total number of suspected botnet IPs: 21099
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20081
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	167334
2	2332	44290
3	1722	43348
4	9011	38957
5	23	32605
6	2048	32262
7	2020	31597
8	5005	29410
9	4714	27040
10	7922	26013

Rank	Network	# of suspected botnet IPs
1	AL-3	1669
2	MSFT	1425
3	GOOGLE-CLOUD	1024
4	PAN-22	952
5	ACEVILLEPTELTD-SG	843
6	INFRAWATCH	784
7	ASEPL-SG	581
8	FR-ONYPHE-20191111	448
9	VOLCANO-ENGINE	425
10	CENSY	374

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9394
2	China	3490
3	Singapore	1543
4	United Kingdom	729
5	Netherlands	560
6	Germany	528
7	France	480
8	Hong Kong	359
9	Indonesia	329
10	India	290

Sunday, May 17, 2026

Botnet Statistics [2026-05-16]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-16 00:00-23:59 UTC
total number of suspected botnet IPs: 20671
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19482
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	228987
2	1722	39765
3	23	38639
4	2020	30385
5	5005	29226
6	7922	28865
7	2048	27599
8	5902	26847
9	5322	25204
10	2122	24765

Rank	Network	# of suspected botnet IPs
1	AL-3	1677
2	MSFT	1445
3	GOOGLE-CLOUD	1028
4	PAN-22	956
5	INFRAWATCH	890
6	ACEVILLEPTELTD-SG	843
7	ASEPL-SG	515
8	FR-ONYPHE-20191111	448
9	VOLCANO-ENGINE	429
10	CENSY	380

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8788
2	China	3377
3	Singapore	1431
4	United Kingdom	743
5	Netherlands	614
6	Germany	532
7	France	489
8	India	401
9	Hong Kong	364
10	Indonesia	357

Saturday, May 16, 2026

Botnet Statistics [2026-05-15]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-15 00:00-23:59 UTC
total number of suspected botnet IPs: 21860
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20720
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	197954
2	2210	55384
3	1722	38868
4	2020	38796
5	5432	38210
6	23	30396
7	7922	28222
8	5005	26986
9	5902	25321
10	5322	24958

Rank	Network	# of suspected botnet IPs
1	AL-3	1706
2	MSFT	1470
3	INFRAWATCH	1090
4	GOOGLE-CLOUD	1038
5	PAN-22	962
6	ASEPL-SG	607
7	FR-ONYPHE-20191111	448
8	VOLCANO-ENGINE	435
9	CENSY	377
10	AT-88-Z	355

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9600
2	China	3669
3	Singapore	985
4	United Kingdom	902
5	Germany	656
6	Netherlands	649
7	France	575
8	Indonesia	380
9	India	370
10	Hong Kong	367

Friday, May 15, 2026

Botnet Statistics [2026-05-14]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-14 00:00-23:59 UTC
total number of suspected botnet IPs: 22100
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20791
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	226993
2	2210	103122
3	4822	90055
4	2239	85952
5	2020	43779
6	1722	37690
7	23	34903
8	7922	27941
9	5005	26718
10	5902	24968

Rank	Network	# of suspected botnet IPs
1	AL-3	1516
2	MSFT	1435
3	INFRAWATCH	1073
4	GOOGLE-CLOUD	1046
5	PAN-22	964
6	ASEPL-SG	500
7	FR-ONYPHE-20191111	448
8	VOLCANO-ENGINE	440
9	CENSY	381
10	AT-88-Z	378

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9476
2	China	3457
3	United Kingdom	927
4	Singapore	908
5	Germany	682
6	Netherlands	674
7	France	593
8	Brazil	400
9	Indonesia	381
10	Hong Kong	380

Thursday, May 14, 2026

Botnet Statistics [2026-05-13]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-13 00:00-23:59 UTC
total number of suspected botnet IPs: 21221
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19980
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	266409
2	2210	144612
3	2239	100721
4	8015	58245
5	4822	37892
6	1722	37692
7	2020	36912
8	8000	31726
9	5322	27662
10	5005	25618

Rank	Network	# of suspected botnet IPs
1	AL-3	1568
2	MSFT	1469
3	INFRAWATCH	1114
4	GOOGLE-CLOUD	1031
5	PAN-22	953
6	ASEPL-SG	491
7	VOLCANO-ENGINE	449
8	FR-ONYPHE-20191111	447
9	CENSY	374
10	cloud	331

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8669
2	China	3444
3	Singapore	890
4	United Kingdom	852
5	Netherlands	674
6	France	603
7	Germany	589
8	Indonesia	475
9	Hong Kong	387
10	Brazil	386

Wednesday, May 13, 2026

Botnet Statistics [2026-05-12]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-12 00:00-23:59 UTC
total number of suspected botnet IPs: 23495
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21859
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	235972
2	8000	175907
3	2210	150165
4	9443	91789
5	2239	85828
6	2000	79546
7	8015	78504
8	2222	77927
9	7777	64548
10	5357	57893

Rank	Network	# of suspected botnet IPs
1	AL-3	1752
2	MSFT	1434
3	GOOGLE-CLOUD	1029
4	PAN-22	953
5	INFRAWATCH	889
6	ASEPL-SG	637
7	FR-ONYPHE-20191111	448
8	VOLCANO-ENGINE	439
9	CENSY	373
10	cloud	291

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9405
2	China	3575
3	Singapore	1086
4	United Kingdom	887
5	Netherlands	745
6	France	596
7	India	509
8	Indonesia	493
9	Brazil	486
10	Germany	440

Tuesday, May 12, 2026

Botnet Statistics [2026-05-11]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-11 00:00-23:59 UTC
total number of suspected botnet IPs: 20229
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19020
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	275627
2	2210	149987
3	1840	50113
4	5701	46741
5	9011	45007
6	2020	33357
7	3265	32028
8	23	31552
9	5999	31397
10	5902	24720

Rank	Network	# of suspected botnet IPs
1	AL-3	1517
2	MSFT	1390
3	GOOGLE-CLOUD	1037
4	PAN-22	955
5	INFRAWATCH	933
6	ASEPL-SG	499
7	FR-ONYPHE-20191111	448
8	CENSY	374
9	cloud	340
10	VOLCANO-ENGINE	309

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8669
2	China	3051
3	Singapore	855
4	United Kingdom	841
5	Germany	564
6	France	562
7	India	480
8	Netherlands	445
9	Brazil	355
10	Hong Kong	350

Monday, May 11, 2026

Botnet Statistics [2026-05-10]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-10 00:00-23:59 UTC
total number of suspected botnet IPs: 19819
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18734
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	294550
2	5701	156615
3	2210	127484
4	1840	119173
5	3265	81673
6	2109	64372
7	9011	59661
8	2020	39640
9	9997	31539
10	23	29056

Rank	Network	# of suspected botnet IPs
1	MSFT	1416
2	AL-3	1412
3	INFRAWATCH	1161
4	GOOGLE-CLOUD	1029
5	PAN-22	954
6	ASEPL-SG	478
7	FR-ONYPHE-20191111	448
8	CENSY	375
9	cloud	329
10	VOLCANO-ENGINE	313

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9131
2	China	2647
3	United Kingdom	871
4	Singapore	811
5	Netherlands	619
6	Germany	569
7	France	568
8	India	392
9	Hong Kong	372
10	Brazil	300

Sunday, May 10, 2026

Botnet Statistics [2026-05-09]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-09 00:00-23:59 UTC
total number of suspected botnet IPs: 19696
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18555
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	1840	782834
2	3265	652089
3	5318	434503
4	2109	310269
5	5900	304807
6	5701	249208
7	4486	233674
8	5473	227915
9	5676	209606
10	3379	156981

Rank	Network	# of suspected botnet IPs
1	AL-3	1434
2	MSFT	1415
3	INFRAWATCH	1157
4	GOOGLE-CLOUD	1020
5	PAN-22	952
6	ASEPL-SG	493
7	FR-ONYPHE-20191111	448
8	CENSY	371
9	cloud	311
10	VOLCANO-ENGINE	306

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8462
2	China	2897
3	United Kingdom	855
4	Singapore	820
5	Netherlands	668
6	France	555
7	Germany	533
8	India	413
9	Hong Kong	370
10	Brazil	320

Saturday, May 9, 2026

Botnet Statistics [2026-05-08]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-08 00:00-23:59 UTC
total number of suspected botnet IPs: 20398
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19192
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5701	1179542
2	1840	872510
3	2109	385681
4	3265	363832
5	5900	318286
6	5581	271833
7	9997	161975
8	2210	138648
9	3379	124422
10	554	82045

Rank	Network	# of suspected botnet IPs
1	AL-3	1430
2	MSFT	1408
3	INFRAWATCH	1102
4	GOOGLE-CLOUD	1032
5	PAN-22	952
6	ASEPL-SG	465
7	FR-ONYPHE-20191111	448
8	CENSY	367
9	VOLCANO-ENGINE	308
10	cloud	288

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8456
2	China	3452
3	United Kingdom	798
4	Singapore	795
5	Netherlands	623
6	France	552
7	Germany	518
8	India	398
9	Hong Kong	388
10	Brazil	339

Friday, May 8, 2026

Botnet Statistics [2026-05-07]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-07 00:00-23:59 UTC
total number of suspected botnet IPs: 21618
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20413
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	222724
2	2078	139145
3	554	128030
4	2210	103691
5	7777	85439
6	8000	82870
7	6001	77432
8	5432	73221
9	3306	57697
10	2231	51788

Rank	Network	# of suspected botnet IPs
1	AL-3	1450
2	MSFT	1431
3	GOOGLE-CLOUD	1046
4	INFRAWATCH	1009
5	PAN-22	954
6	ASEPL-SG	509
7	FR-ONYPHE-20191111	448
8	CENSY	377
9	cloud	312
10	VOLCANO-ENGINE	309

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9294
2	China	3798
3	United Kingdom	936
4	Singapore	773
5	Netherlands	569
6	France	564
7	Germany	562
8	India	394
9	Hong Kong	392
10	Indonesia	361

Thursday, May 7, 2026

Botnet Statistics [2026-05-06]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-06 00:00-23:59 UTC
total number of suspected botnet IPs: 21048
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19533
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	241545
2	2210	55508
3	2231	51767
4	2020	47132
5	23	45715
6	1122	45093
7	6001	36644
8	22	34650
9	2222	33256
10	7922	29587

Rank	Network	# of suspected botnet IPs
1	AL-3	1481
2	MSFT	1417
3	GOOGLE-CLOUD	1027
4	INFRAWATCH	1014
5	PAN-22	953
6	ASEPL-SG	499
7	FR-ONYPHE-20191111	448
8	CENSY	375
9	VOLCANO-ENGINE	306
10	FR-ONYPHE-20221109	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8436
2	China	3595
3	United Kingdom	876
4	Singapore	800
5	Netherlands	569
6	France	567
7	Germany	564
8	India	442
9	Brazil	388
10	Hong Kong	367

Wednesday, May 6, 2026

Botnet Statistics [2026-05-05]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-05 00:00-23:59 UTC
total number of suspected botnet IPs: 22165
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20932
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	413872
2	2222	43769
3	2231	43023
4	22	42153
5	2209	41936
6	1122	40901
7	23	36120
8	622	31420
9	1919	29777
10	30	27165

Rank	Network	# of suspected botnet IPs
1	AL-3	1570
2	MSFT	1455
3	INFRAWATCH	1015
4	GOOGLE-CLOUD	1014
5	PAN-22	954
6	ASEPL-SG	546
7	FR-ONYPHE-20191111	448
8	CENSY	377
9	cloud	321
10	VOLCANO-ENGINE	314

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9586
2	China	3688
3	Singapore	873
4	United Kingdom	867
5	Netherlands	616
6	Germany	587
7	France	583
8	India	411
9	Brazil	388
10	Hong Kong	358

Tuesday, May 5, 2026

Botnet Statistics [2026-05-04]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-04 00:00-23:59 UTC
total number of suspected botnet IPs: 21411
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19960
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	459548
2	2209	53517
3	3014	38860
4	23	37450
5	1122	36217
6	22	36165
7	2222	34731
8	4709	28937
9	7622	27438
10	2622	24403

Rank	Network	# of suspected botnet IPs
1	AL-3	1579
2	MSFT	1454
3	GOOGLE-CLOUD	1023
4	PAN-22	954
5	INFRAWATCH	748
6	ASEPL-SG	541
7	FR-ONYPHE-20191111	448
8	CENSY	381
9	VOLCANO-ENGINE	308
10	cloud	303

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9010
2	China	3761
3	Singapore	880
4	United Kingdom	854
5	Netherlands	585
6	France	564
7	Brazil	455
8	India	376
9	Indonesia	348
10	Hong Kong	331

Monday, May 4, 2026

Botnet Statistics [2026-05-03]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-03 00:00-23:59 UTC
total number of suspected botnet IPs: 21773
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20593
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	419293
2	2209	54126
3	23	43051
4	450	38936
5	3014	36566
6	2280	35091
7	8821	32022
8	2222	29268
9	22	28994
10	1122	27074

Rank	Network	# of suspected botnet IPs
1	AL-3	1545
2	MSFT	1463
3	GOOGLE-CLOUD	1041
4	INFRAWATCH	1001
5	PAN-22	952
6	ASEPL-SG	545
7	FR-ONYPHE-20191111	448
8	CENSY	375
9	cloud	335
10	VOLCANO-ENGINE	310

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9713
2	China	3490
3	Singapore	925
4	United Kingdom	908
5	Netherlands	593
6	France	571
7	Germany	565
8	Brazil	484
9	India	357
10	Hong Kong	330

Sunday, May 3, 2026

Botnet Statistics [2026-05-02]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-02 00:00-23:59 UTC
total number of suspected botnet IPs: 21303
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20049
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	474450
2	7777	147065
3	58603	135049
4	23	87962
5	8821	72995
6	3306	72862
7	450	63842
8	5357	58961
9	2209	54121
10	2252	51267

Rank	Network	# of suspected botnet IPs
1	MSFT	1490
2	AL-3	1451
3	INFRAWATCH	1035
4	GOOGLE-CLOUD	1033
5	PAN-22	954
6	ASEPL-SG	523
7	FR-ONYPHE-20191111	448
8	CENSY	379
9	cloud	337
10	VOLCANO-ENGINE	321

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8832
2	China	3555
3	Singapore	877
4	United Kingdom	871
5	Germany	646
6	Netherlands	591
7	France	577
8	Brazil	510
9	India	459
10	Hong Kong	334

Saturday, May 2, 2026

Botnet Statistics [2026-05-01]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for May 2026.
detection period: 2026-05-01 00:00-23:59 UTC
total number of suspected botnet IPs: 22256
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20879
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	487709
2	23	142035
3	7777	125922
4	58603	80778
5	8088	62554
6	2252	51265
7	8082	40174
8	51005	37866
9	11361	36255
10	2209	35092

Rank	Network	# of suspected botnet IPs
1	AL-3	1519
2	MSFT	1453
3	GOOGLE-CLOUD	1042
4	INFRAWATCH	1004
5	PAN-22	952
6	ASEPL-SG	516
7	FR-ONYPHE-20191111	448
8	CENSY	382
9	cloud	316
10	VOLCANO-ENGINE	312

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9335
2	China	3328
3	United Kingdom	914
4	Singapore	876
5	Netherlands	644
6	Germany	630
7	France	620
8	India	535
9	Brazil	500
10	Indonesia	365

Daily Zombie Lists for May 2026（2026年05月，每日殭屍電腦IP清單）

To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:

為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：

Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;

第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；

Column 2: Zombie IP;

第2欄：該殭屍電腦的IP位址；

Column 3: TCP destination port number scanned by the zombie.

第3欄：該殭屍電腦所掃描的TCP埠號。

Join the "Suspected Zombie IP List" Telegram channel to get notified when the latest data are ready for download.

想在第一時間取得資料下載網址？請加入Suspected Zombie IP List的Telegram頻道。

Here are the download links of the daily zombie IP lists for May 2026 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):

以下是2026年05月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：

05/01: download link 下載網址; MD5sum: b5c91d5b9d5abfaad8916d4dca40e513

05/02: download link 下載網址; MD5sum: 3f90f43a49a1237f31d70928f550657b

05/03: download link 下載網址; MD5sum: be255f5cc7e639f4e2dfc47d9a316d0b

05/04: download link 下載網址; MD5sum: d74330fbc22a11ab01e404ced57517e4

05/05: download link 下載網址; MD5sum: e180e5d4af90c746608c5de74a825747

05/06: download link 下載網址; MD5sum: 50f2a61d0edf5ff9b17043817c09beb2

05/07: download link 下載網址; MD5sum: ca80ae2fb0bf47a7ee48621dc9a68ac5

05/08: download link 下載網址; MD5sum: 1f501d176f1fbba9de8404129c2d0890

05/09: download link 下載網址; MD5sum: 12ef83a9e9b010ed29efa38d2d068bb0

05/10: download link 下載網址; MD5sum: 334e2ea42a42e6ce04b2072abdd9d940

05/11: download link 下載網址; MD5sum: af4a1c8f9cdb31aa00ecd99ba18ba757

05/12: download link 下載網址; MD5sum: 8caaacec004dc0c605568fff95a24f76

05/13: download link 下載網址; MD5sum: c43e809c83169bf149e999e0b1cd86fe

05/14: download link 下載網址; MD5sum: c13372e6b9666a892f455ae83d35e9a9

05/15: download link 下載網址; MD5sum: 8acbfe75701676f6cec542be2d5ef9c8

05/16: download link 下載網址; MD5sum: 105450bec908d9b186ba0845630c216a

05/17: download link 下載網址; MD5sum: 57dc0a4a90a7517aeba41328c019d01b

05/18: download link 下載網址; MD5sum: e2dfd2ce61e3d48fe51bd36348b3362b

05/19: download link 下載網址; MD5sum: 22382c0993c4802ef6f9939b5c9f606d

05/20: download link 下載網址; MD5sum: 2b2aaa0e04c6df6d4baf7e09e147d54b

05/21: download link 下載網址; MD5sum: 8c6c24e3f5512672e9eb3f41a658c176

Friday, May 1, 2026

Botnet Statistics [2026-04-30]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for April 2026.
detection period: 2026-04-30 00:00-23:59 UTC
total number of suspected botnet IPs: 23468
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 22016
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	457650
2	23	314304
3	8088	116313
4	8594	71640
5	7777	62648
6	2252	51004
7	2278	49064
8	22	35287
9	2108	29040
10	1122	25791

Rank	Network	# of suspected botnet IPs
1	AL-3	1544
2	MSFT	1517
3	GOOGLE-CLOUD	1050
4	PAN-22	955
5	ASEPL-SG	481
6	FR-ONYPHE-20191111	400
7	CENSY	381
8	INFRAWATCH	332
9	VOLCANO-ENGINE	319
10	cloud	289

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	10258
2	China	3500
3	United Kingdom	1032
4	Singapore	871
5	Germany	692
6	India	564
7	Netherlands	558
8	France	533
9	Indonesia	435
10	Brazil	391

Subscribe to: Posts (Atom)

Subscribe for Free

Daily Top 10 Botnet Info!

Pages

• Home
• Human Readable Sitemap

Featured Posts

• ZBTrap: a Virtual Appliance for Botnet Detection
• Botnet Statistics for February 2018
• Botnet Statistics for the year of 2017
• Building a botnet detector with Exim and SQLite, a step-by-step procedure wannabe
• How could China cut spam so effectively?
• DISAN: a proposed framework for botnet mitigation
• DDoS attacks make Wikileaks a great botnet detection system

About Botnet Tracker

Chih-Cherng Chin

Taiwan

I submitted a paper titled "Follow the spam: a botnet detection and notification mechanism" (in Chinese) to this year's TANET conference (TANET 2010), and it has been accepted. In that paper, I pointed out the problem with botnet mitigation measures which focus on taking C&C servers offline, described the detection strategy of "follow the spam," and made a general sketch of how I detect and report botnets. So far I have only implemented half of the "follow the spam" strategy. Hope someone else will implement the other half.

My previous work was an open relay detection and notification system (presented at TANET 2006 conference), which was able to uncover more than 1200 open relays (confirmed by ORDB) each month at the time.

View my complete profile

Labels

• bot list (3009)
• botnet chart (6034)
• botnet detection (8)
• botnet mitigation (6)
• cyber security (2)
• daily zombie IP list (66)
• google adsense (1)
• greylisting (3)
• haproxy (2)
• monthly statistics (125)
• open proxy (1)
• port scan (2)
• suspected bots ip (96)
• yearly statistics (8)
• ZBTrap (1)

Blog Archive

• ▼  2026 (144)
  • May (23)
  • April (31)
  • March (31)
  • February (29)
  • January (30)

• ►  2025 (371)
  • December (31)
  • November (31)
  • October (32)
  • September (31)
  • August (30)
  • July (31)
  • June (30)
  • May (32)
  • April (30)
  • March (32)
  • February (29)
  • January (32)

• ►  2024 (378)
  • December (32)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (30)
  • January (32)

• ►  2023 (376)
  • December (32)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (29)
  • January (31)

• ►  2022 (376)
  • December (32)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (28)
  • January (32)

• ►  2021 (373)
  • December (28)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (29)
  • January (32)

• ►  2020 (701)
  • December (33)
  • November (60)
  • October (62)
  • September (60)
  • August (62)
  • July (62)
  • June (60)
  • May (60)
  • April (60)
  • March (62)
  • February (58)
  • January (62)

• ►  2019 (738)
  • December (62)
  • November (59)
  • October (65)
  • September (60)
  • August (62)
  • July (62)
  • June (60)
  • May (64)
  • April (58)
  • March (66)
  • February (56)
  • January (64)

• ►  2018 (752)
  • December (62)
  • November (65)
  • October (63)
  • September (62)
  • August (65)
  • July (64)
  • June (61)
  • May (64)
  • April (61)
  • March (64)
  • February (59)
  • January (62)

• ►  2017 (729)
  • December (64)
  • November (62)
  • October (58)
  • September (58)
  • August (64)
  • July (62)
  • June (62)
  • May (58)
  • April (54)
  • March (64)
  • February (58)
  • January (65)

• ►  2016 (757)
  • December (64)
  • November (62)
  • October (64)
  • September (62)
  • August (64)
  • July (64)
  • June (61)
  • May (64)
  • April (62)
  • March (64)
  • February (61)
  • January (65)

• ►  2015 (737)
  • December (64)
  • November (62)
  • October (62)
  • September (61)
  • August (64)
  • July (62)
  • June (60)
  • May (64)
  • April (54)
  • March (64)
  • February (56)
  • January (64)

• ►  2014 (745)
  • December (64)
  • November (60)
  • October (64)
  • September (58)
  • August (60)
  • July (64)
  • June (62)
  • May (64)
  • April (62)
  • March (64)
  • February (58)
  • January (65)

• ►  2013 (750)
  • December (64)
  • November (62)
  • October (64)
  • September (62)
  • August (64)
  • July (64)
  • June (64)
  • May (63)
  • April (61)
  • March (61)
  • February (57)
  • January (64)

• ►  2012 (528)
  • December (63)
  • November (61)
  • October (63)
  • September (61)
  • August (59)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (30)
  • January (33)

• ►  2011 (382)
  • December (32)
  • November (31)
  • October (33)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (33)
  • April (31)
  • March (33)
  • February (29)
  • January (34)

• ►  2010 (387)
  • December (33)
  • November (32)
  • October (32)
  • September (33)
  • August (30)
  • July (32)
  • June (31)
  • May (32)
  • April (40)
  • March (32)
  • February (29)
  • January (31)

• ►  2009 (119)
  • December (31)
  • November (31)
  • October (33)
  • September (24)

Rank	TCP port number	# of connection attempts received
1	5900	520702
2	23	362870
3	110	116158
4	9011	63360
5	2252	51291
6	8088	38545
7	22	31388
8	8082	28084
9	8015	27449
10	1122	25417