Downloadable data

Reputation score

Lists of IPs based on their overall reputation score.

• List of all IPs in NERD database with their reputation scores: ip_rep.csv (4.7 MB)
  • Don't use this file as a blocklist as is! It contains every single IP reported as malicious by some of our data sources and it probably contains some false positives (FP). Look at the associated reputation score, which summarizes the number of alerts, their age, and number of different sources that reported the IP. Higher score means lower probability of FP. So, if this data is to be used as a blocklist, we recommend to select only the IPs with reputation score greater than some threshold. Or use one of the files below, instead.
• List of malicious IPs (high confidence): bad_ips.txt (81.1 kB)
  • IP addresses with reputation score greater than 0.5 (means many recent reports from multiple sources). Very low chance of false positives. IPs tagged as research scanners are not included.
• List of malicious IPs (medium confidence): bad_ips_med_conf.txt (341.6 kB)
  • IP addresses with reputation score greater than 0.2. This also includes less active IPs or those reported by just one source (but still multiple recent alerts are needed). Mostly reliable, but may contain a few false positives. IPs tagged as research scanners are not included.

Threat categorization

Lists of IPs based on their threat-level/confidence in individual categories.

• List of all IPs in NERD with their categories:
  • Line format: ip_category.csv (7.1 MB)
  • Table format: ip_category_table.csv (21.6 MB)
• Lists of IPs for each category (IPs with confidence greater than 0.2):
  • bl_scan.txt (2.7 MB)
  • bl_login.txt (498.0 kB)
  • bl_ddos.txt (1.6 kB)
  • bl_ddos-amplifier.txt (1.1 kB)
  • bl_spam.txt (1.6 kB)
  • bl_malware_distribution.txt (378 Bytes)
  • bl_cc.txt (126 Bytes)
  • bl_botnet_drone.txt (46.1 kB)
  • bl_phishing_site.txt (137 Bytes)
  • bl_exploit.txt (12.7 kB)

All files are updated once per hour. Please, don't download the data more often than once per hour!
We recommend downloading it few minutes after a whole hour (i.e. between xx:01 and xx:05).