Daily Botnet Statistics

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-10-01 00:00-23:59 UTC
total number of suspected botnet IPs: 20262
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 18984
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	Network	# of suspected botnet IPs
1	MSFT	1512
2	AL-3	1333
3	GOOGLE-CLOUD	1067
4	PAN-22	950
5	FR-ONYPHE-20191111	480
6	ASEPL-SG	459
7	INFRAWATCH	388
8	CENSY	375
9	DE-ALPHA	328
10	FR-ONYPHE-20221220	240

The top 10 countries (as defined by the 2-character country code), ordered by the number of suspected botnet IPs are:

The top 10 TCP ports, ordered by the number of connection attempts received are:

Rank	Country/Region	# of suspected botnet IPs
1	United States	9054
2	China	4072
3	United Kingdom	779
4	Singapore	633
5	France	574
6	Germany	566
7	Netherlands	334
8	South Korea	290
9	Hong Kong	287
10	Russian Federation	256

Friday, October 2, 2026

Daily Zombie Lists for October 2026（2026年10月，每日殭屍電腦IP清單）

To facilitate security research, I will release the daily zombie IP lists in CSV format here for anyone interested to download. The data columns are defined as follows:

為協助資安方面的研究，我將每日釋出CSV格式的殭屍電腦IP清單，供任何有興趣的人下載。資料欄位定義如下：

Column 1: The date and time in UTC when the last connection attempt (port scans) from the zombie IP (column 2) was detected;

第1欄：該殭屍電腦最後一次被偵測到企圖連線的日期、時間，時區為UTC；

Column 2: Zombie IP;

第2欄：該殭屍電腦的IP位址；

Column 3: TCP destination port number scanned by the zombie.

第3欄：該殭屍電腦所掃描的TCP埠號。

Join the "Suspected Zombie IP List" Telegram channel to get notified when the latest data are ready for download.

想在第一時間取得資料下載網址？請加入Suspected Zombie IP List的Telegram頻道。

Here are the download links of the daily zombie IP lists for October 2026 (without excluding IP addresses of TOR exits and so-called security researchers' nodes.):

以下是2026年10月的每日殭屍電腦IP清單的下載網址(未濾除TOR exit與所謂“資安研究者”的主機IP)：

10/01: download link 下載網址; MD5sum: 5d358b944bd0b78319ad645fc1e8850e

10/02: download link 下載網址; MD5sum: a06b53bcb61aaadab5de1b9daf419e4e

10/03: download link 下載網址; MD5sum: 11289315c81ea37a5e2c9be66244e844

10/04: download link 下載網址; MD5sum: 165d5387e04a5930d5e441d28141d4c0

10/05: download link 下載網址; MD5sum: d26b2b6c5ab4e7a6910737822f23e074

Thursday, October 1, 2026

Botnet Statistics [2026-09-30]

(To download the latest zombie ip list, please visit the Daily Zombie IP Lists for September 2026.
detection period: 2026-09-30 00:00-23:59 UTC
total number of suspected botnet IPs: 19015
number of botnet IPs notified to network operators (best case, if all mail were sent out successfully): 17595
number of spam blocked: 0
recipient count of spam blocked: 0

The top 10 networks (as found in WHOIS), ordered by the number of suspected botnet IPs are:

Rank	TCP port number	# of connection attempts received
1	5900	202712
2	55555	135917
3	2095	49484
4	8020	31453
5	8027	31287
6	888	31181
7	7100	30217
8	7094	29132
9	8025	29097
10	22	27852

Rank	Network	# of suspected botnet IPs
1	MSFT	1518
2	AL-3	1366
3	GOOGLE-CLOUD	1061
4	PAN-22	928
5	FR-ONYPHE-20191111	480
6	ASEPL-SG	452
7	INFRAWATCH	382
8	CENSY	374
9	DE-ALPHA	277
10	FR-ONYPHE-20221220	240