Downloadable data

List of all IPs in NERD database with their reputation scores: ip_rep.csv (5.2 MB)
- Don't use this file as a blocklist as is! It contains every single IP reported as malicious by some of our data sources and it probably contains some false positives (FP). Look at the associated reputation score, which summarizes the number of alerts, their age, and number of different sources that reported the IP. Higher score means lower probability of FP. So, if this data is to be used as a blocklist, we recommend to select only the IPs with reputation score greater than some threshold. Or use one of the files below, instead.
List of malicious IPs (high confidence): bad_ips.txt (77.5 kB)
- IP addresses with reputation score greater than 0.5 (means many recent reports from multiple sources). Very low chance of false positives. IPs tagged as research scanners are not included.
List of malicious IPs (medium confidence): bad_ips_med_conf.txt (516.8 kB)
- IP addresses with reputation score greater than 0.2. This also includes less active IPs or those reported by just one source (but still multiple recent alerts are needed). Mostly reliable, but may contain a few false positives. IPs tagged as research scanners are not included.

All files are updated once per hour. Please, don't download the data more often than once per hour!
We recommend downloading it a few minutes after a whole hour (i.e. between xx:01 and xx:05).