A computer that is known to be infected with a worm or other malicious code and that has been observed attacking at least two distinct users. Zombie systems tend to be easily exploitable, poorly protected, and poorly administered, and may be utilized as initial infection points, significantly heightening the worm's initial speed and impact. Within the DeepSight system, an IP address is tagged as a zombie when it has attacked two or more sensors.