Products
Threat Intelligence Solution
Pure Signal ReconPure Signal Scout
Threat Feeds
Use Cases
Supply Chain and Risk ThreatsRansomwareNation-State Threat ActorsPhishing
Community Services
Request Service
Bogon SignupDDOS Mitigation UTRS SignupNimbus SignupMHR - API SignupCSIRT Assistance Program Signup
Service Overview
Bogon NetworksDDOS Mitigation UTRSNimbus Threat MonitorMHR - API CSIRT Assistance Program
Network ServicesNews Bytes SubscriptionRISE & UE
Customers
Resources
BlogPodcastEvents & WebinarsResources LibraryIntelligence Terms
Partners
Resellers, MSPs & SIs
Technology Alliance Partners
GoogleMicrosoftPalo AltoSplunkMaltegoTinesThreatQuotientCyware
API IntegrationBecome a Partner
Company
About UsNewsPress ReleasesCareersContact Us
Talk To an expert
Heading 6

The IP Reputation Feed

Along with every Command and Control IP address (C2) for botnets we track, the feed contains IP addresses that have communicated with a C2, a honeypot, or sinkhole we operate. Other example categories of malicious behavior include darknet scans, abused proxies, openresolvers, and IPs hosting phishing sites. Using our global network of darknets, sensors, and sinkholes we formed the most comprehensive feed we have ever produced.

The IP Reputation Feed is updated hourly and contains an aggregate of the last 24 hours of activity.

​Every IP in the feed receives an individual reputation score using several different categories of patterns observed over the past 30 days. The key used to calculate the score is included in the feed and can be used to reconstruct the behavior patterns observed for each individual IP in the feed.

​IP Reputation Scoring Categories

  • Number of days in feed
  • Number of active detections
  • Number of passive detections
  • Detection type
  • Controller behavior:​
  • Non-standard port
    • # controllers on same IP
    • # unique domains on same IP
    • Instructions decoded
    • SSL usage
    • Malicious IPs in /24

‍

Products
Pure Signal™ ReconPure Signal™ ScoutIP Reputation FeedController FeedBotnet Analysis & Reporting
Community Services
Nimbus Threat MonitorUTRSBOGON ReferenceCSIRT Assistance Program
Contact us
tel: +1 847-378-3300
Follow Us
Support
0900-1700 ET1400-2200 UTCsupport@cymru.comPGP KeyEmergencies: +1 847-378-3301
© 2025 Team Cymru. All Rights Reserved.
GDPRPrivacy PolicyModern Slavery Act