Botnet Statistics [2026-10-06]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-10-06 00:00-23:59 UTC
total number of suspected botnet IPs: 20769
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 19415
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	MSFT	1506
2	AL-3	1304
3	GOOGLE-CLOUD	1059
4	PAN-22	934
5	CLOUDFLARENET	785
6	FR-ONYPHE-20191111	480
7	ASEPL-SG	458
8	CENSY	374
9	INFRAWATCH	316
10	CMNET	251

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9598
2	China	4571
3	United Kingdom	692
4	Singapore	667
5	France	550
6	Hong Kong	319
7	Netherlands	303
8	Germany	288
9	Russian Federation	215
10	Indonesia	209

Tuesday, October 6, 2026

Botnet Statistics [2026-10-05]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-10-05 00:00-23:59 UTC
total number of suspected botnet IPs: 19714
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18338
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	163082
2	2095	84347
3	322	43478
4	12022	39591
5	6924	38338
6	6600	33664
7	23	32945
8	55555	27624
9	9339	26747
10	4117	25448

Rank	Network	# of suspected botnet IPs
1	MSFT	1552
2	AL-3	1274
3	GOOGLE-CLOUD	1070
4	PAN-22	933
5	FR-ONYPHE-20191111	480
6	ASEPL-SG	456
7	CENSY	374
8	INFRAWATCH	321
9	FR-ONYPHE-20221220	240
10	FR-ONYPHE-20221109	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8572
2	China	4060
3	Singapore	692
4	United Kingdom	687
5	France	636
6	Germany	449
7	Netherlands	325
8	Hong Kong	314
9	South Korea	261
10	Indonesia	223

Monday, October 5, 2026

Botnet Statistics [2026-10-04]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-10-04 00:00-23:59 UTC
total number of suspected botnet IPs: 20010
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18603
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	63937
2	1023	52757
3	12022	39362
4	2095	32176
5	23	32082
6	7093	24697
7	8025	22927
8	8030	22832
9	7094	22468
10	8027	22466

Rank	Network	# of suspected botnet IPs
1	MSFT	1530
2	AL-3	1372
3	GOOGLE-CLOUD	1058
4	PAN-22	940
5	FR-ONYPHE-20191111	480
6	ASEPL-SG	462
7	CENSY	376
8	DE-ALPHA	327
9	INFRAWATCH	312
10	ALISOFT	255

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9093
2	China	3842
3	Germany	705
4	United Kingdom	673
5	Singapore	647
6	France	634
7	Netherlands	332
8	Hong Kong	258
9	South Korea	241
10	Russian Federation	228

Sunday, October 4, 2026

Botnet Statistics [2026-10-03]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-10-03 00:00-23:59 UTC
total number of suspected botnet IPs: 18422
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17082
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	93307
2	1023	85355
3	2095	55226
4	8020	37130
5	12022	35927
6	2425	33196
7	23	32089
8	7094	31214
9	8030	30084
10	888	28524

Rank	Network	# of suspected botnet IPs
1	MSFT	1504
2	AL-3	1359
3	GOOGLE-CLOUD	1058
4	PAN-22	950
5	FR-ONYPHE-20191111	480
6	ASEPL-SG	467
7	CENSY	376
8	DE-ALPHA	327
9	INFRAWATCH	311
10	FR-ONYPHE-20221220	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	7960
2	China	3843
3	United Kingdom	671
4	Singapore	626
5	France	575
6	Germany	574
7	Netherlands	336
8	Hong Kong	231
9	South Korea	216
10	Russian Federation	204

Saturday, October 3, 2026

Botnet Statistics [2026-10-02]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-10-02 00:00-23:59 UTC
total number of suspected botnet IPs: 19350
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18045
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	149339
2	2095	52657
3	1023	47935
4	8020	34769
5	7094	30565
6	8030	29622
7	888	29549
8	23	28863
9	8025	28577
10	22	28421

Rank	Network	# of suspected botnet IPs
1	MSFT	1486
2	AL-3	1339
3	GOOGLE-CLOUD	1064
4	PAN-22	950
5	FR-ONYPHE-20191111	480
6	ASEPL-SG	461
7	CENSY	376
8	INFRAWATCH	334
9	DE-ALPHA	311
10	FR-ONYPHE-20221220	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8518
2	China	3944
3	United Kingdom	698
4	Singapore	622
5	Germany	572
6	France	567
7	Netherlands	337
8	Hong Kong	310
9	South Korea	278
10	Russian Federation	234

Botnet Statistics [2026-10-01]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-10-01 00:00-23:59 UTC
total number of suspected botnet IPs: 20262
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18984
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	145830
2	55555	104578
3	2095	46038
4	2022	35511
5	8020	33233
6	888	31741
7	23	30707
8	7094	30136
9	22	28992
10	8088	28481

Rank	Network	# of suspected botnet IPs
1	MSFT	1512
2	AL-3	1333
3	GOOGLE-CLOUD	1067
4	PAN-22	950
5	FR-ONYPHE-20191111	480
6	ASEPL-SG	459
7	INFRAWATCH	388
8	CENSY	375
9	DE-ALPHA	328
10	FR-ONYPHE-20221220	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9054
2	China	4072
3	United Kingdom	779
4	Singapore	633
5	France	574
6	Germany	566
7	Netherlands	334
8	South Korea	290
9	Hong Kong	287
10	Russian Federation	256

Friday, October 2, 2026

Daily Zombie Lists for October 2026（2026年10月，每日殭屍電腦IP清單）

To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:

為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：

Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;

第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；

Column 2: Zombie IP;

第2欄：該殭屍電腦的IP位址；

Column 3: TCP destination port number scanned by the zombie.

第3欄：該殭屍電腦所掃描的TCP埠號。

Join the "Suspected Zombie IP List" Telegram channel to get notified when the latest data are ready for download.

想在第一時間取得資料下載網址？請加入Suspected Zombie IP List的Telegram頻道。

Here are the download links of the daily zombie IP lists for October 2026 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):

以下是2026年10月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：

10/01: download link 下載網址; MD5sum: 5d358b944bd0b78319ad645fc1e8850e

10/02: download link 下載網址; MD5sum: a06b53bcb61aaadab5de1b9daf419e4e

10/03: download link 下載網址; MD5sum: 11289315c81ea37a5e2c9be66244e844

10/04: download link 下載網址; MD5sum: 165d5387e04a5930d5e441d28141d4c0

10/05: download link 下載網址; MD5sum: d26b2b6c5ab4e7a6910737822f23e074

10/06: download link 下載網址; MD5sum: 0bc58bafe8285e073a95da78175d7615

Thursday, October 1, 2026

Botnet Statistics [2026-09-30]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-30 00:00-23:59 UTC
total number of suspected botnet IPs: 19015
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17595
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	202712
2	55555	135917
3	2095	49484
4	8020	31453
5	8027	31287
6	888	31181
7	7100	30217
8	7094	29132
9	8025	29097
10	22	27852

Rank	Network	# of suspected botnet IPs
1	MSFT	1518
2	AL-3	1366
3	GOOGLE-CLOUD	1061
4	PAN-22	928
5	FR-ONYPHE-20191111	480
6	ASEPL-SG	452
7	INFRAWATCH	382
8	CENSY	374
9	DE-ALPHA	277
10	FR-ONYPHE-20221220	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8420
2	China	3687
3	United Kingdom	659
4	Singapore	615
5	Germany	582
6	France	575
7	Netherlands	308
8	South Korea	265
9	India	244
10	Hong Kong	243

Wednesday, September 30, 2026

Botnet Statistics [2026-09-29]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-29 00:00-23:59 UTC
total number of suspected botnet IPs: 19871
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18472
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	212837
2	55555	121801
3	8085	87966
4	2095	76973
5	2078	64104
6	8025	43140
7	9999	42795
8	2222	40318
9	8027	39122
10	7100	34895

Rank	Network	# of suspected botnet IPs
1	MSFT	1519
2	AL-3	1318
3	GOOGLE-CLOUD	1055
4	PAN-22	879
5	FR-ONYPHE-20191111	480
6	ASEPL-SG	449
7	CENSY	373
8	INFRAWATCH	344
9	DE-ALPHA	317
10	DO-13	247

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8963
2	China	3795
3	United Kingdom	728
4	Singapore	588
5	Germany	580
6	France	565
7	Netherlands	313
8	Hong Kong	302
9	South Korea	292
10	Russian Federation	226

Tuesday, September 29, 2026

Botnet Statistics [2026-09-28]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-28 00:00-23:59 UTC
total number of suspected botnet IPs: 18974
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17668
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	192649
2	2222	63397
3	9999	62246
4	8020	41993
5	8000	41712
6	9011	38529
7	52885	36821
8	2177	36667
9	7283	35349
10	8088	34087

Rank	Network	# of suspected botnet IPs
1	MSFT	1467
2	AL-3	1291
3	GOOGLE-CLOUD	1052
4	PAN-22	938
5	FR-ONYPHE-20191111	480
6	ASEPL-SG	429
7	CENSY	377
8	INFRAWATCH	338
9	DE-ALPHA	303
10	CMNET	270

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8283
2	China	3660
3	United Kingdom	753
4	Singapore	576
5	Germany	576
6	France	564
7	Hong Kong	306
8	Netherlands	296
9	South Korea	267
10	Indonesia	264

Monday, September 28, 2026

Botnet Statistics [2026-09-27]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-27 00:00-23:59 UTC
total number of suspected botnet IPs: 18850
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17671
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	166880
2	7777	73121
3	5357	45903
4	2222	45094
5	8020	41569
6	56641	33605
7	5000	32731
8	2000	32425
9	8027	31731
10	7100	29657

Rank	Network	# of suspected botnet IPs
1	MSFT	1434
2	AL-3	1238
3	GOOGLE-CLOUD	1018
4	PAN-22	938
5	FR-ONYPHE-20191111	480
6	ASEPL-SG	428
7	CENSY	377
8	INFRAWATCH	301
9	DE-ALPHA	301
10	CMNET	257

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8519
2	China	3708
3	United Kingdom	750
4	France	584
5	Singapore	572
6	Germany	552
7	Hong Kong	308
8	South Korea	271
9	Netherlands	241
10	Russian Federation	237

Sunday, September 27, 2026

Botnet Statistics [2026-09-26]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-26 00:00-23:59 UTC
total number of suspected botnet IPs: 19058
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17802
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	172510
2	8000	166063
3	2078	143591
4	7777	100454
5	2095	66213
6	2222	62683
7	2000	51942
8	2617	43762
9	19233	43655
10	8020	43347

Rank	Network	# of suspected botnet IPs
1	CLOUDFLARENET	1509
2	MSFT	1450
3	AL-3	1241
4	GOOGLE-CLOUD	1021
5	PAN-22	953
6	FR-ONYPHE-20191111	480
7	ASEPL-SG	419
8	CENSY	373
9	INFRAWATCH	339
10	CMNET	268

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9113
2	China	3628
3	Singapore	584
4	France	562
5	United Kingdom	521
6	Germany	373
7	Hong Kong	288
8	South Korea	282
9	Netherlands	247
10	Russian Federation	209

Saturday, September 26, 2026

Botnet Statistics [2026-09-25]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-25 00:00-23:59 UTC
total number of suspected botnet IPs: 17583
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16419
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	7777	219954
2	5900	131920
3	8000	73734
4	2078	71259
5	9222	56563
6	8020	42289
7	2000	38421
8	2222	37649
9	2095	37017
10	24022	35819

Rank	Network	# of suspected botnet IPs
1	MSFT	1418
2	AL-3	1291
3	GOOGLE-CLOUD	1019
4	PAN-22	953
5	FR-ONYPHE-20191111	480
6	ASEPL-SG	460
7	CENSY	376
8	INFRAWATCH	367
9	CMNET	267
10	FR-ONYPHE-20221220	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	7893
2	China	3341
3	Singapore	619
4	France	555
5	United Kingdom	526
6	Germany	385
7	Hong Kong	313
8	Netherlands	295
9	South Korea	264
10	Russian Federation	245

Friday, September 25, 2026

Botnet Statistics [2026-09-24]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-24 00:00-23:59 UTC
total number of suspected botnet IPs: 18896
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17911
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	7777	230405
2	5900	179751
3	9222	67911
4	1122	50663
5	8020	37324
6	2078	34857
7	2026	31789
8	7100	28817
9	8000	28775
10	8027	24774

Rank	Network	# of suspected botnet IPs
1	MSFT	1409
2	AL-3	1301
3	GOOGLE-CLOUD	1060
4	PAN-22	955
5	INFRAWATCH	521
6	FR-ONYPHE-20191111	480
7	ASEPL-SG	439
8	CENSY	375
9	CMNET	263
10	FR-ONYPHE-20221220	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8739
2	China	3581
3	Singapore	625
4	Germany	585
5	France	551
6	United Kingdom	511
7	Hong Kong	334
8	Netherlands	327
9	South Korea	287
10	Russian Federation	279

Thursday, September 24, 2026

Botnet Statistics [2026-09-23]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-23 00:00-23:59 UTC
total number of suspected botnet IPs: 19703
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18592
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	169788
2	7777	123723
3	1122	72345
4	8030	37504
5	7100	36467
6	8020	35917
7	2078	29821
8	8018	27459
9	8027	26789
10	7094	25956

Rank	Network	# of suspected botnet IPs
1	MSFT	1570
2	AL-3	1317
3	GOOGLE-CLOUD	1054
4	PAN-22	958
5	INFRAWATCH	877
6	FR-ONYPHE-20191111	480
7	ASEPL-SG	434
8	CENSY	380
9	CMNET	334
10	DE-ALPHA	289

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8328
2	China	3922
3	United Kingdom	847
4	Germany	777
5	Singapore	597
6	France	556
7	Netherlands	411
8	Hong Kong	317
9	Indonesia	272
10	India	259

Wednesday, September 23, 2026

Botnet Statistics [2026-09-22]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-22 00:00-23:59 UTC
total number of suspected botnet IPs: 19655
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18550
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	196929
2	2078	130729
3	1122	80847
4	5357	77938
5	888	76689
6	51005	69931
7	2000	66634
8	8000	51645
9	7777	50065
10	8030	46756

Rank	Network	# of suspected botnet IPs
1	MSFT	1573
2	AL-3	1323
3	GOOGLE-CLOUD	1067
4	PAN-22	957
5	INFRAWATCH	497
6	FR-ONYPHE-20191111	480
7	ASEPL-SG	467
8	CENSY	373
9	cloud	304
10	DE-ALPHA	285

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8972
2	China	3894
3	Germany	680
4	Singapore	635
5	France	552
6	United Kingdom	506
7	Hong Kong	358
8	Netherlands	321
9	India	259
10	Indonesia	244

Monday, September 21, 2026

Botnet Statistics [2026-09-20]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-20 00:00-23:59 UTC
total number of suspected botnet IPs: 17453
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16547
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	83195
2	8016	30896
3	8022	30328
4	8030	29078
5	7100	28752
6	8020	28245
7	7091	28105
8	7092	27504
9	8026	27062
10	7099	26994

Rank	Network	# of suspected botnet IPs
1	MSFT	1368
2	AL-3	1335
3	GOOGLE-CLOUD	1042
4	PAN-22	895
5	ASEPL-SG	486
6	FR-ONYPHE-20191111	480
7	CENSY	376
8	DE-ALPHA	342
9	INFRAWATCH	328
10	FR-ONYPHE-20221220	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8615
2	China	2085
3	Germany	747
4	United Kingdom	712
5	Singapore	646
6	France	576
7	Hong Kong	335
8	Netherlands	278
9	Russian Federation	257
10	Indonesia	210

Sunday, September 20, 2026

Botnet Statistics [2026-09-19]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-19 00:00-23:59 UTC
total number of suspected botnet IPs: 17125
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16111
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	1704	138208
2	99	120162
3	2500	118156
4	9801	110120
5	4711	100694
6	5359	90638
7	7648	89715
8	18012	87277
9	4460	85493
10	3009	84807

Rank	Network	# of suspected botnet IPs
1	MSFT	1401
2	AL-3	1370
3	GOOGLE-CLOUD	1056
4	PAN-22	946
5	INFRAWATCH	697
6	ASEPL-SG	497
7	FR-ONYPHE-20191111	480
8	CENSY	373
9	DE-ALPHA	326
10	FR-ONYPHE-20221220	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	7927
2	China	2192
3	Germany	803
4	Singapore	693
5	United Kingdom	634
6	France	597
7	Hong Kong	335
8	Netherlands	305
9	Russian Federation	252
10	Indonesia	238

Saturday, September 19, 2026

Botnet Statistics [2026-09-18]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-18 00:00-23:59 UTC
total number of suspected botnet IPs: 17330
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16344
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	99	174693
2	2222	128794
3	1797	109025
4	14936	102758
5	54984	94125
6	2500	91089
7	36505	87589
8	1700	83663
9	2525	75101
10	3452	70358

Rank	Network	# of suspected botnet IPs
1	MSFT	1380
2	AL-3	1335
3	GOOGLE-CLOUD	1044
4	PAN-22	956
5	ASEPL-SG	526
6	FR-ONYPHE-20191111	480
7	INFRAWATCH	469
8	CENSY	377
9	DE-ALPHA	330
10	FR-ONYPHE-20221220	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8042
2	China	2265
3	Singapore	757
4	Germany	686
5	France	595
6	United Kingdom	454
7	Hong Kong	353
8	Netherlands	316
9	Indonesia	276
10	Russian Federation	272

Friday, September 18, 2026

Botnet Statistics [2026-09-17]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-17 00:00-23:59 UTC
total number of suspected botnet IPs: 17142
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 16156
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	99	184664
2	2500	158485
3	8085	131337
4	2343	131113
5	1704	128389
6	4711	127759
7	3452	127661
8	14936	123771
9	1797	118603
10	2222	117937

Rank	Network	# of suspected botnet IPs
1	AL-3	1332
2	MSFT	1329
3	GOOGLE-CLOUD	1044
4	PAN-22	959
5	FR-ONYPHE-20191111	480
6	ASEPL-SG	475
7	CENSY	366
8	INFRAWATCH	330
9	DE-ALPHA	293
10	CMNET	255

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	8749
2	China	2254
3	Singapore	626
4	France	557
5	United Kingdom	507
6	Germany	487
7	Hong Kong	309
8	Netherlands	293
9	Indonesia	224
10	Russian Federation	222

Subscribe to: Posts (Atom)

Subscribe for Free

Daily Top 10 Botnet Info!

Pages

• Home
• Human Readable Sitemap

Featured Posts

• ZBTrap: a Virtual Appliance for Botnet Detection
• Botnet Statistics for February 2018
• Botnet Statistics for the year of 2017
• Building a botnet detector with Exim and SQLite, a step-by-step procedure wannabe
• How could China cut spam so effectively?
• DISAN: a proposed framework for botnet mitigation
• DDoS attacks make Wikileaks a great botnet detection system

About Botnet Tracker

Chih-Cherng Chin

Taiwan

I submitted a paper titled "Follow the spam: a botnet detection and notification mechanism" (in Chinese) to this year's TANET conference (TANET 2010), and it has been accepted. In that paper, I pointed out the problem with botnet mitigation measures which focus on taking C&C servers offline, described the detection strategy of "follow the spam," and made a general sketch of how I detect and report botnets. So far I have only implemented half of the "follow the spam" strategy. Hope someone else will implement the other half.

My previous work was an open relay detection and notification system (presented at TANET 2006 conference), which was able to uncover more than 1200 open relays (confirmed by ORDB) each month at the time.

View my complete profile

Labels

• bot list (3009)
• botnet chart (6168)
• botnet detection (8)
• botnet mitigation (6)
• cyber security (2)
• daily zombie IP list (70)
• google adsense (1)
• greylisting (3)
• haproxy (2)
• monthly statistics (125)
• open proxy (1)
• port scan (2)
• suspected bots ip (96)
• yearly statistics (8)
• ZBTrap (1)

Blog Archive

• ▼  2026 (283)
  • October (8)
  • September (29)
  • August (32)
  • July (32)
  • June (29)
  • May (32)
  • April (31)
  • March (31)
  • February (29)
  • January (30)

• ►  2025 (371)
  • December (31)
  • November (31)
  • October (32)
  • September (31)
  • August (30)
  • July (31)
  • June (30)
  • May (32)
  • April (30)
  • March (32)
  • February (29)
  • January (32)

• ►  2024 (378)
  • December (32)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (30)
  • January (32)

• ►  2023 (376)
  • December (32)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (29)
  • January (31)

• ►  2022 (376)
  • December (32)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (28)
  • January (32)

• ►  2021 (373)
  • December (28)
  • November (31)
  • October (32)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (29)
  • January (32)

• ►  2020 (701)
  • December (33)
  • November (60)
  • October (62)
  • September (60)
  • August (62)
  • July (62)
  • June (60)
  • May (60)
  • April (60)
  • March (62)
  • February (58)
  • January (62)

• ►  2019 (738)
  • December (62)
  • November (59)
  • October (65)
  • September (60)
  • August (62)
  • July (62)
  • June (60)
  • May (64)
  • April (58)
  • March (66)
  • February (56)
  • January (64)

• ►  2018 (752)
  • December (62)
  • November (65)
  • October (63)
  • September (62)
  • August (65)
  • July (64)
  • June (61)
  • May (64)
  • April (61)
  • March (64)
  • February (59)
  • January (62)

• ►  2017 (729)
  • December (64)
  • November (62)
  • October (58)
  • September (58)
  • August (64)
  • July (62)
  • June (62)
  • May (58)
  • April (54)
  • March (64)
  • February (58)
  • January (65)

• ►  2016 (757)
  • December (64)
  • November (62)
  • October (64)
  • September (62)
  • August (64)
  • July (64)
  • June (61)
  • May (64)
  • April (62)
  • March (64)
  • February (61)
  • January (65)

• ►  2015 (737)
  • December (64)
  • November (62)
  • October (62)
  • September (61)
  • August (64)
  • July (62)
  • June (60)
  • May (64)
  • April (54)
  • March (64)
  • February (56)
  • January (64)

• ►  2014 (745)
  • December (64)
  • November (60)
  • October (64)
  • September (58)
  • August (60)
  • July (64)
  • June (62)
  • May (64)
  • April (62)
  • March (64)
  • February (58)
  • January (65)

• ►  2013 (750)
  • December (64)
  • November (62)
  • October (64)
  • September (62)
  • August (64)
  • July (64)
  • June (64)
  • May (63)
  • April (61)
  • March (61)
  • February (57)
  • January (64)

• ►  2012 (528)
  • December (63)
  • November (61)
  • October (63)
  • September (61)
  • August (59)
  • July (32)
  • June (31)
  • May (32)
  • April (31)
  • March (32)
  • February (30)
  • January (33)

• ►  2011 (382)
  • December (32)
  • November (31)
  • October (33)
  • September (31)
  • August (32)
  • July (32)
  • June (31)
  • May (33)
  • April (31)
  • March (33)
  • February (29)
  • January (34)

• ►  2010 (387)
  • December (33)
  • November (32)
  • October (32)
  • September (33)
  • August (30)
  • July (32)
  • June (31)
  • May (32)
  • April (40)
  • March (32)
  • February (29)
  • January (31)

• ►  2009 (119)
  • December (31)
  • November (31)
  • October (33)
  • September (24)

Rank	TCP port number	# of connection attempts received
1	5900	62151
2	6022	45763
3	2722	19680
4	2322	19599
5	1222	19529
6	7122	18776
7	4444	18537
8	3522	18374
9	1000	18081
10	2000	18061