(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-30 00:00-23:59 UTC
total number of suspected botnet IPs: 18273
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17479
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1288 |
| 2 | INFRAWATCH | 1087 |
| 3 | GOOGLE-CLOUD | 1050 |
| 4 | AL-3 | 976 |
| 5 | PAN-22 | 962 |
| 6 | CLOUDFLARENET | 760 |
| 7 | FR-ONYPHE-20191111 | 448 |
| 8 | CENSY | 376 |
| 9 | ASEPL-SG | 349 |
| 10 | cloud | 260 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 9090 |
| 2 | China | 2397 |
| 3 | United Kingdom | 1142 |
| 4 | Germany | 635 |
| 5 | Netherlands | 532 |
| 6 | France | 515 |
| 7 | Singapore | 473 |
| 8 | Hong Kong | 304 |
| 9 | Russian Federation | 266 |
| 10 | India | 209 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 8015 | 106469 |
| 2 | 5555 | 95994 |
| 3 | 8888 | 67966 |
| 4 | 2266 | 41035 |
| 5 | 6000 | 34585 |
| 6 | 2000 | 33296 |
| 7 | 888 | 30591 |
| 8 | 23 | 29783 |
| 9 | 3306 | 24945 |
| 10 | 7000 | 24190 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-29 00:00-23:59 UTC
total number of suspected botnet IPs: 17463
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16629
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1274 |
| 2 | INFRAWATCH | 1074 |
| 3 | GOOGLE-CLOUD | 1042 |
| 4 | AL-3 | 1017 |
| 5 | PAN-22 | 958 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | CENSY | 375 |
| 8 | ASEPL-SG | 354 |
| 9 | cloud | 266 |
| 10 | UCLOUD-US | 247 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7739 |
| 2 | China | 2846 |
| 3 | United Kingdom | 1103 |
| 4 | Germany | 678 |
| 5 | Netherlands | 559 |
| 6 | France | 473 |
| 7 | Singapore | 465 |
| 8 | Russian Federation | 324 |
| 9 | Hong Kong | 310 |
| 10 | European Union | 211 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 6000 | 86449 |
| 2 | 5555 | 82927 |
| 3 | 2227 | 76633 |
| 4 | 8888 | 54401 |
| 5 | 2266 | 42200 |
| 6 | 22010 | 37842 |
| 7 | 3222 | 25337 |
| 8 | 22 | 24226 |
| 9 | 182 | 20881 |
| 10 | 153 | 20301 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-28 00:00-23:59 UTC
total number of suspected botnet IPs: 17429
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16680
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1328 |
| 2 | INFRAWATCH | 1082 |
| 3 | GOOGLE-CLOUD | 1045 |
| 4 | AL-3 | 1015 |
| 5 | PAN-22 | 959 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | CENSY | 380 |
| 8 | ASEPL-SG | 376 |
| 9 | cloud | 299 |
| 10 | FR-ONYPHE-20221109 | 240 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8080 |
| 2 | China | 2679 |
| 3 | United Kingdom | 1142 |
| 4 | Germany | 702 |
| 5 | Netherlands | 601 |
| 6 | Singapore | 484 |
| 7 | France | 420 |
| 8 | Russian Federation | 297 |
| 9 | Hong Kong | 243 |
| 10 | European Union | 210 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 2227 | 76951 |
| 2 | 6001 | 50160 |
| 3 | 6000 | 45312 |
| 4 | 2266 | 41159 |
| 5 | 9011 | 40310 |
| 6 | 4722 | 27037 |
| 7 | 22 | 26861 |
| 8 | 3222 | 24860 |
| 9 | 5522 | 23255 |
| 10 | 182 | 22447 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-27 00:00-23:59 UTC
total number of suspected botnet IPs: 17515
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16626
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1421 |
| 2 | INFRAWATCH | 1099 |
| 3 | GOOGLE-CLOUD | 1045 |
| 4 | AL-3 | 1006 |
| 5 | PAN-22 | 964 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | ASEPL-SG | 389 |
| 8 | CENSY | 380 |
| 9 | cloud | 289 |
| 10 | FR-ONYPHE-20221109 | 240 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7779 |
| 2 | China | 2876 |
| 3 | United Kingdom | 1148 |
| 4 | Germany | 734 |
| 5 | Netherlands | 568 |
| 6 | Singapore | 503 |
| 7 | France | 407 |
| 8 | Russian Federation | 295 |
| 9 | Hong Kong | 262 |
| 10 | Ukraine | 216 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 2227 | 77780 |
| 2 | 2228 | 61077 |
| 3 | 2266 | 41409 |
| 4 | 4722 | 29696 |
| 5 | 2226 | 27491 |
| 6 | 22 | 27096 |
| 7 | 9422 | 23996 |
| 8 | 3222 | 23019 |
| 9 | 5900 | 22472 |
| 10 | 182 | 22382 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-26 00:00-23:59 UTC
total number of suspected botnet IPs: 17778
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16976
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1453 |
| 2 | INFRAWATCH | 1129 |
| 3 | AL-3 | 1101 |
| 4 | GOOGLE-CLOUD | 1044 |
| 5 | PAN-22 | 961 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | CENSY | 357 |
| 8 | ASEPL-SG | 356 |
| 9 | cloud | 308 |
| 10 | DE-ALPHA | 246 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8364 |
| 2 | China | 2637 |
| 3 | United Kingdom | 1185 |
| 4 | Germany | 765 |
| 5 | Netherlands | 568 |
| 6 | Singapore | 443 |
| 7 | France | 422 |
| 8 | Hong Kong | 268 |
| 9 | Russian Federation | 261 |
| 10 | Ukraine | 198 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 2266 | 42182 |
| 2 | 5900 | 31460 |
| 3 | 4722 | 29752 |
| 4 | 22 | 25526 |
| 5 | 2222 | 22978 |
| 6 | 182 | 22542 |
| 7 | 322 | 22012 |
| 8 | 5322 | 21615 |
| 9 | 3222 | 21006 |
| 10 | 4422 | 19771 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-25 00:00-23:59 UTC
total number of suspected botnet IPs: 17622
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16666
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1351 |
| 2 | INFRAWATCH | 1107 |
| 3 | AL-3 | 1047 |
| 4 | GOOGLE-CLOUD | 1039 |
| 5 | PAN-22 | 960 |
| 6 | CLOUDFLARENET | 755 |
| 7 | FR-ONYPHE-20191111 | 448 |
| 8 | CENSY | 380 |
| 9 | ASEPL-SG | 365 |
| 10 | FR-ONYPHE-20221109 | 240 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7988 |
| 2 | China | 2783 |
| 3 | United Kingdom | 1203 |
| 4 | Germany | 787 |
| 5 | Netherlands | 587 |
| 6 | Singapore | 452 |
| 7 | France | 412 |
| 8 | Hong Kong | 249 |
| 9 | Russian Federation | 228 |
| 10 | European Union | 208 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 8005 | 41631 |
| 2 | 2266 | 40897 |
| 3 | 4722 | 30998 |
| 4 | 5900 | 30091 |
| 5 | 9322 | 27603 |
| 6 | 22 | 26395 |
| 7 | 5322 | 22688 |
| 8 | 4222 | 22252 |
| 9 | 182 | 22197 |
| 10 | 4322 | 21358 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-24 00:00-23:59 UTC
total number of suspected botnet IPs: 16917
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16182
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1328 |
| 2 | INFRAWATCH | 1143 |
| 3 | GOOGLE-CLOUD | 1035 |
| 4 | AL-3 | 988 |
| 5 | PAN-22 | 963 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | CENSY | 379 |
| 8 | ASEPL-SG | 371 |
| 9 | cloud | 319 |
| 10 | DE-ALPHA | 246 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7514 |
| 2 | China | 2962 |
| 3 | United Kingdom | 1164 |
| 4 | Germany | 719 |
| 5 | Netherlands | 557 |
| 6 | Singapore | 491 |
| 7 | France | 440 |
| 8 | Hong Kong | 247 |
| 9 | Brazil | 213 |
| 10 | European Union | 208 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 2266 | 41870 |
| 2 | 4722 | 29712 |
| 3 | 22 | 27077 |
| 4 | 622 | 26980 |
| 5 | 5900 | 26965 |
| 6 | 6122 | 23481 |
| 7 | 3222 | 23164 |
| 8 | 4322 | 22689 |
| 9 | 2122 | 22567 |
| 10 | 4222 | 22195 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-23 00:00-23:59 UTC
total number of suspected botnet IPs: 18389
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17317
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1456 |
| 2 | GOOGLE-CLOUD | 1045 |
| 3 | AL-3 | 1028 |
| 4 | PAN-22 | 963 |
| 5 | INFRAWATCH | 904 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | ASEPL-SG | 380 |
| 8 | CENSY | 378 |
| 9 | cloud | 289 |
| 10 | DE-ALPHA | 243 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8251 |
| 2 | China | 3210 |
| 3 | United Kingdom | 1272 |
| 4 | Netherlands | 586 |
| 5 | Germany | 493 |
| 6 | Singapore | 492 |
| 7 | France | 415 |
| 8 | European Union | 255 |
| 9 | Hong Kong | 240 |
| 10 | Russian Federation | 232 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 2266 | 42694 |
| 2 | 5900 | 39967 |
| 3 | 8022 | 39168 |
| 4 | 1022 | 31134 |
| 5 | 622 | 29698 |
| 6 | 4722 | 29256 |
| 7 | 22 | 28530 |
| 8 | 5922 | 28523 |
| 9 | 322 | 27850 |
| 10 | 2022 | 27817 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-22 00:00-23:59 UTC
total number of suspected botnet IPs: 18625
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17815
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1535 |
| 2 | INFRAWATCH | 1097 |
| 3 | GOOGLE-CLOUD | 1046 |
| 4 | AL-3 | 1006 |
| 5 | PAN-22 | 961 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | CENSY | 380 |
| 8 | ASEPL-SG | 344 |
| 9 | cloud | 335 |
| 10 | FR-ONYPHE-20221109 | 240 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7792 |
| 2 | China | 3995 |
| 3 | United Kingdom | 1226 |
| 4 | Germany | 645 |
| 5 | Netherlands | 526 |
| 6 | Singapore | 461 |
| 7 | France | 440 |
| 8 | Hong Kong | 262 |
| 9 | India | 243 |
| 10 | European Union | 212 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 71969 |
| 2 | 2266 | 43899 |
| 3 | 2022 | 28959 |
| 4 | 622 | 28855 |
| 5 | 4722 | 28726 |
| 6 | 322 | 27458 |
| 7 | 9122 | 26342 |
| 8 | 1622 | 26210 |
| 9 | 22 | 26129 |
| 10 | 9822 | 26120 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-21 00:00-23:59 UTC
total number of suspected botnet IPs: 19130
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18358
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1346 |
| 2 | AL-3 | 1113 |
| 3 | INFRAWATCH | 1078 |
| 4 | GOOGLE-CLOUD | 1040 |
| 5 | PAN-22 | 960 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | CENSY | 380 |
| 8 | ASEPL-SG | 349 |
| 9 | cloud | 275 |
| 10 | CMNET | 244 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8173 |
| 2 | China | 4009 |
| 3 | United Kingdom | 1189 |
| 4 | Germany | 651 |
| 5 | Netherlands | 537 |
| 6 | Singapore | 458 |
| 7 | France | 402 |
| 8 | Hong Kong | 241 |
| 9 | South Korea | 205 |
| 10 | European Union | 193 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 69034 |
| 2 | 5422 | 49256 |
| 3 | 2266 | 46406 |
| 4 | 1122 | 32181 |
| 5 | 9222 | 30604 |
| 6 | 6522 | 30276 |
| 7 | 4722 | 28202 |
| 8 | 622 | 27693 |
| 9 | 2022 | 27689 |
| 10 | 1622 | 27120 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-20 00:00-23:59 UTC
total number of suspected botnet IPs: 18080
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17267
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1326 |
| 2 | INFRAWATCH | 1092 |
| 3 | GOOGLE-CLOUD | 1068 |
| 4 | AL-3 | 973 |
| 5 | PAN-22 | 961 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | CENSY | 376 |
| 8 | ASEPL-SG | 366 |
| 9 | cloud | 281 |
| 10 | FR-ONYPHE-20221109 | 240 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7536 |
| 2 | China | 3986 |
| 3 | United Kingdom | 1136 |
| 4 | Germany | 591 |
| 5 | Netherlands | 570 |
| 6 | Singapore | 467 |
| 7 | France | 413 |
| 8 | Hong Kong | 276 |
| 9 | Russian Federation | 261 |
| 10 | India | 219 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5422 | 109216 |
| 2 | 5900 | 82230 |
| 3 | 2422 | 71442 |
| 4 | 2758 | 54317 |
| 5 | 9617 | 49354 |
| 6 | 2266 | 47921 |
| 7 | 9022 | 36181 |
| 8 | 11483 | 34138 |
| 9 | 8001 | 30037 |
| 10 | 23 | 29934 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-19 00:00-23:59 UTC
total number of suspected botnet IPs: 17930
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17189
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1312 |
| 2 | GOOGLE-CLOUD | 1040 |
| 3 | INFRAWATCH | 1005 |
| 4 | AL-3 | 969 |
| 5 | PAN-22 | 959 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | CENSY | 374 |
| 8 | ASEPL-SG | 323 |
| 9 | cloud | 243 |
| 10 | FR-ONYPHE-20221109 | 240 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8134 |
| 2 | China | 3946 |
| 3 | United Kingdom | 961 |
| 4 | Netherlands | 541 |
| 5 | Germany | 497 |
| 6 | Singapore | 459 |
| 7 | France | 410 |
| 8 | Hong Kong | 271 |
| 9 | South Korea | 203 |
| 10 | India | 172 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 101487 |
| 2 | 5422 | 98821 |
| 3 | 3822 | 92258 |
| 4 | 2422 | 71712 |
| 5 | 6415 | 54885 |
| 6 | 5534 | 49527 |
| 7 | 2266 | 49270 |
| 8 | 9022 | 44657 |
| 9 | 7022 | 41108 |
| 10 | 15844 | 41105 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-18 00:00-23:59 UTC
total number of suspected botnet IPs: 18052
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17278
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1337 |
| 2 | INFRAWATCH | 1088 |
| 3 | GOOGLE-CLOUD | 1045 |
| 4 | AL-3 | 1009 |
| 5 | PAN-22 | 960 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | ASEPL-SG | 392 |
| 8 | CENSY | 384 |
| 9 | cloud | 288 |
| 10 | FR-ONYPHE-20221109 | 240 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7521 |
| 2 | China | 4138 |
| 3 | United Kingdom | 1111 |
| 4 | Netherlands | 548 |
| 5 | Singapore | 512 |
| 6 | Germany | 431 |
| 7 | France | 425 |
| 8 | Hong Kong | 248 |
| 9 | India | 241 |
| 10 | South Korea | 209 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 3822 | 117119 |
| 2 | 5900 | 79192 |
| 3 | 2422 | 61150 |
| 4 | 7022 | 59026 |
| 5 | 3708 | 54441 |
| 6 | 2266 | 51132 |
| 7 | 9022 | 45689 |
| 8 | 3950 | 41128 |
| 9 | 9131 | 36735 |
| 10 | 2022 | 35479 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-17 00:00-23:59 UTC
total number of suspected botnet IPs: 18279
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17355
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1350 |
| 2 | AL-3 | 1131 |
| 3 | INFRAWATCH | 1098 |
| 4 | GOOGLE-CLOUD | 1046 |
| 5 | PAN-22 | 961 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | CENSY | 383 |
| 8 | ASEPL-SG | 358 |
| 9 | FR-ONYPHE-20221109 | 240 |
| 10 | CMNET | 230 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7846 |
| 2 | China | 4086 |
| 3 | United Kingdom | 1093 |
| 4 | Netherlands | 543 |
| 5 | Germany | 484 |
| 6 | Singapore | 464 |
| 7 | France | 403 |
| 8 | India | 250 |
| 9 | Hong Kong | 240 |
| 10 | European Union | 196 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 7022 | 58820 |
| 2 | 5900 | 45905 |
| 3 | 3822 | 43316 |
| 4 | 2022 | 38833 |
| 5 | 9222 | 33098 |
| 6 | 1022 | 32257 |
| 7 | 4122 | 32132 |
| 8 | 222 | 30131 |
| 9 | 22 | 29071 |
| 10 | 6522 | 28967 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-16 00:00-23:59 UTC
total number of suspected botnet IPs: 17502
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16726
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1294 |
| 2 | INFRAWATCH | 1073 |
| 3 | GOOGLE-CLOUD | 1054 |
| 4 | AL-3 | 985 |
| 5 | PAN-22 | 960 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | CENSY | 377 |
| 8 | ASEPL-SG | 356 |
| 9 | cloud | 272 |
| 10 | FR-ONYPHE-20221109 | 240 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7663 |
| 2 | China | 4041 |
| 3 | United Kingdom | 856 |
| 4 | Netherlands | 535 |
| 5 | Singapore | 442 |
| 6 | Germany | 433 |
| 7 | France | 422 |
| 8 | India | 296 |
| 9 | Hong Kong | 239 |
| 10 | Russian Federation | 209 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 7022 | 51620 |
| 2 | 5900 | 33910 |
| 3 | 1022 | 32974 |
| 4 | 2022 | 32814 |
| 5 | 4122 | 30687 |
| 6 | 9222 | 29285 |
| 7 | 5822 | 28712 |
| 8 | 222 | 28627 |
| 9 | 6522 | 28152 |
| 10 | 4722 | 27861 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-15 00:00-23:59 UTC
total number of suspected botnet IPs: 17993
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16942
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1327 |
| 2 | GOOGLE-CLOUD | 1044 |
| 3 | AL-3 | 968 |
| 4 | PAN-22 | 961 |
| 5 | INFRAWATCH | 892 |
| 6 | FR-ONYPHE-20191111 | 448 |
| 7 | CENSY | 381 |
| 8 | ASEPL-SG | 341 |
| 9 | cloud | 247 |
| 10 | FR-ONYPHE-20221109 | 240 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 7990 |
| 2 | China | 3649 |
| 3 | United Kingdom | 1057 |
| 4 | Netherlands | 536 |
| 5 | France | 429 |
| 6 | Singapore | 425 |
| 7 | Hong Kong | 279 |
| 8 | India | 250 |
| 9 | Germany | 235 |
| 10 | South Korea | 197 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5822 | 91180 |
| 2 | 7022 | 54676 |
| 3 | 8559 | 43550 |
| 4 | 2122 | 34780 |
| 5 | 4122 | 33964 |
| 6 | 1022 | 33144 |
| 7 | 5900 | 31268 |
| 8 | 822 | 30525 |
| 9 | 4322 | 30464 |
| 10 | 622 | 29964 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-14 00:00-23:59 UTC
total number of suspected botnet IPs: 21085
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20188
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1401 |
| 2 | AL-3 | 1387 |
| 3 | INFRAWATCH | 1118 |
| 4 | GOOGLE-CLOUD | 1040 |
| 5 | PAN-22 | 960 |
| 6 | ASEPL-SG | 522 |
| 7 | VOLCANO-ENGINE | 469 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 379 |
| 10 | cloud | 314 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8775 |
| 2 | China | 5005 |
| 3 | United Kingdom | 1042 |
| 4 | Singapore | 709 |
| 5 | Netherlands | 578 |
| 6 | Germany | 488 |
| 7 | France | 419 |
| 8 | Hong Kong | 323 |
| 9 | Indonesia | 306 |
| 10 | South Korea | 275 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 14406 | 46907 |
| 2 | 7606 | 43777 |
| 3 | 4910 | 42055 |
| 4 | 9872 | 38823 |
| 5 | 1522 | 35668 |
| 6 | 2122 | 35211 |
| 7 | 4122 | 34054 |
| 8 | 5900 | 33456 |
| 9 | 5822 | 33020 |
| 10 | 9999 | 32036 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-13 00:00-23:59 UTC
total number of suspected botnet IPs: 20643
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19737
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1397 |
| 2 | AL-3 | 1397 |
| 3 | GOOGLE-CLOUD | 1061 |
| 4 | INFRAWATCH | 1056 |
| 5 | PAN-22 | 963 |
| 6 | ASEPL-SG | 523 |
| 7 | VOLCANO-ENGINE | 462 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 375 |
| 10 | cloud | 322 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8529 |
| 2 | China | 4963 |
| 3 | United Kingdom | 803 |
| 4 | Singapore | 721 |
| 5 | Netherlands | 604 |
| 6 | Germany | 470 |
| 7 | France | 423 |
| 8 | Indonesia | 317 |
| 9 | Hong Kong | 317 |
| 10 | South Korea | 275 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 9999 | 57595 |
| 2 | 9011 | 39039 |
| 3 | 22 | 38869 |
| 4 | 3333 | 35960 |
| 5 | 622 | 34221 |
| 6 | 14387 | 34094 |
| 7 | 4122 | 33130 |
| 8 | 4322 | 31568 |
| 9 | 2122 | 31202 |
| 10 | 5781 | 31002 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-12 00:00-23:59 UTC
total number of suspected botnet IPs: 21541
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 20634
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1412 |
| 2 | AL-3 | 1381 |
| 3 | INFRAWATCH | 1067 |
| 4 | GOOGLE-CLOUD | 1057 |
| 5 | PAN-22 | 961 |
| 6 | ASEPL-SG | 567 |
| 7 | VOLCANO-ENGINE | 471 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 383 |
| 10 | cloud | 332 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8928 |
| 2 | China | 4948 |
| 3 | United Kingdom | 1179 |
| 4 | Singapore | 798 |
| 5 | Netherlands | 621 |
| 6 | Germany | 522 |
| 7 | France | 440 |
| 8 | Hong Kong | 322 |
| 9 | South Korea | 286 |
| 10 | Indonesia | 279 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 622 | 38284 |
| 2 | 4122 | 38027 |
| 3 | 4322 | 37648 |
| 4 | 2023 | 37052 |
| 5 | 9999 | 35501 |
| 6 | 222 | 34435 |
| 7 | 9022 | 34046 |
| 8 | 4722 | 31777 |
| 9 | 2022 | 31450 |
| 10 | 5322 | 31444 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-11 00:00-23:59 UTC
total number of suspected botnet IPs: 22091
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 21089
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | AL-3 | 1489 |
| 2 | MSFT | 1362 |
| 3 | INFRAWATCH | 1087 |
| 4 | GOOGLE-CLOUD | 1048 |
| 5 | PAN-22 | 961 |
| 6 | ASEPL-SG | 517 |
| 7 | VOLCANO-ENGINE | 468 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | CENSY | 381 |
| 10 | CMNET | 286 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | United States | 8222 |
| 2 | China | 6122 |
| 3 | United Kingdom | 1078 |
| 4 | Singapore | 715 |
| 5 | Netherlands | 629 |
| 6 | Germany | 535 |
| 7 | France | 447 |
| 8 | Hong Kong | 326 |
| 9 | Indonesia | 307 |
| 10 | South Korea | 290 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 2023 | 104123 |
| 2 | 5900 | 99660 |
| 3 | 3322 | 44636 |
| 4 | 4122 | 41076 |
| 5 | 4322 | 38750 |
| 6 | 622 | 36927 |
| 7 | 222 | 35057 |
| 8 | 2022 | 34584 |
| 9 | 5222 | 33775 |
| 10 | 5322 | 33682 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-10 00:00-23:59 UTC
total number of suspected botnet IPs: 24661
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 23688
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
| Rank | Network | # of suspected botnet IPs |
|---|
| 1 | MSFT | 1379 |
| 2 | AL-3 | 1378 |
| 3 | INFRAWATCH | 1089 |
| 4 | GOOGLE-CLOUD | 1057 |
| 5 | PAN-22 | 962 |
| 6 | ASEPL-SG | 512 |
| 7 | VOLCANO-ENGINE | 470 |
| 8 | FR-ONYPHE-20191111 | 448 |
| 9 | UNICOM | 427 |
| 10 | CENSY | 381 |
The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:
| Rank | Country/Region | # of suspected botnet IPs |
|---|
| 1 | China | 8597 |
| 2 | United States | 8287 |
| 3 | United Kingdom | 1031 |
| 4 | Singapore | 707 |
| 5 | Netherlands | 609 |
| 6 | Germany | 566 |
| 7 | France | 469 |
| 8 | Hong Kong | 328 |
| 9 | Indonesia | 323 |
| 10 | India | 315 |
The top 10 TCP ports, ordered by the number of connection attempts received are:
| Rank | TCP port number | # of connection attempts received |
|---|
| 1 | 5900 | 128099 |
| 2 | 2023 | 56007 |
| 3 | 3322 | 50226 |
| 4 | 4122 | 37820 |
| 5 | 622 | 36140 |
| 6 | 9022 | 35345 |
| 7 | 222 | 35076 |
| 8 | 4322 | 35005 |
| 9 | 5222 | 33800 |
| 10 | 2022 | 33403 |
(To download the latest zombie ip list, please visit the
Daily Zombie IP Lists for July 2026.
detection period: 2026-07-09 00:00-23:59 UTC
total number of suspected botnet IPs: 20781
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19624
number of spam blocked: 0
recipient count of spam blocked: 0
The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:
