Downloadable data

Reputation score

Lists of IPs based on their overall reputation score.

• List of all IPs in NERD database with their reputation scores: ip_rep.csv (13.8 MB)
  • Don't use this file as a blocklist as is! It contains every single IP reported as malicious by some of our data sources and it probably contains some false positives (FP). Look at the associated reputation score, which summarizes the number of alerts, their age, and number of different sources that reported the IP. Higher score means lower probability of FP. So, if this data is to be used as a blocklist, we recommend to select only the IPs with reputation score greater than some threshold. Or use one of the files below, instead.
• List of malicious IPs (high confidence): bad_ips.txt (413.5 kB)
  • IP addresses with reputation score greater than 0.5 (means many recent reports from multiple sources). Very low chance of false positives. IPs tagged as research scanners are not included.
• List of malicious IPs (medium confidence): bad_ips_med_conf.txt (3.1 MB)
  • IP addresses with reputation score greater than 0.2. This also includes less active IPs or those reported by just one source (but still multiple recent alerts are needed). Mostly reliable, but may contain a few false positives. IPs tagged as research scanners are not included.

Note: On May 12, 2026, we changed the way the reputation score (which these blacklists are based on) is computed. Previously it was based on data from Warden detectors only, not it incorporates all other data sources as well - DShield, AV OTX and blacklists. If you encounter any issues, let us know at nerd@cesnet.cz.