Spamhaus H1 2026 botnet report: C&C servers down 30%, .cn domains up 771%

The Spamhaus Project published its Botnet Threat Update for January–June 2026 on July 10, and the headline number moved in an unusual direction: observed botnet command-and-control (C&C) servers fell 30% to 14,952 over the half-year. Beneath the decline, the report describes a threat landscape that shifted rather than shrank.

Key findings

Per Spamhaus's data, Sliver overtook Cobalt Strike as the most prevalent malware associated with botnet C&C infrastructure, rising 58% — the open-source red-team framework continuing its migration into criminal use. The geographic picture moved too: botnet C&C domains registered under the .cn top-level domain grew 771% in the half. On the registrar side, Spamhaus reports a 901% spike in malicious registrations through India-based PDR, while Russia's REG.RU cut abused domains by 90% — evidence, in both directions, of how much registrar policy shapes where abuse concentrates.

Why deliverability teams should read it

Botnet infrastructure is upstream of almost everything a blocklist operator does, and Spamhaus data feeds — SBL, XBL, DBL and the composite zones — are queried by a large share of the world's mail servers. When C&C hosting and domain registration patterns shift, blocklist coverage shifts with them, and that is felt by legitimate senders in two ways. First, compromised infrastructure in your network neighborhood affects IP reputation: senders on shared ranges near infected hosts inherit suspicion they did nothing to earn. Second, domain registration abuse drives domain-based blocking, which is why new or cheaply registered lookalike domains face cold-start distrust regardless of who operates them.

The report is attribution-grade primary data from the organization whose listings most directly gate SMTP connections. If your mail is being refused and you suspect a listing, check where you stand with our blacklist checker, and see domain reputation for how blocklists fit into the wider reputation picture.