IP centric, with the widest range of victims.
Threat Intelligence Feeds
A full list of IP addresses and a full XML file, covering every command and control (C2) IP address for the botnets we track, plus the IP addresses that have communicated with a C2, a honeypot, or a sinkhole we operate.
Why it matters
IP centric, with the widest range of victims.
Provides a lighter weight feed of controller and victim IP addresses.
Enables users to vet visitors to a service, optimize firewalls, and automatically deprioritize low-criticality alerts.
Lightweight, near-real-time feed of all controllers and victims.
Offers visibility into botnets that normally evade monitoring.
Includes categories of potentially compromised devices like routers, darknet visitors, and abused proxies.
Use cases
E-commerce platforms can use the feed to identify and block traffic from compromised IP addresses, reducing fraud.
Healthcare organizations can ensure secure patient data transmission by filtering access from suspicious IPs.
Online gaming companies can prevent cheating and maintain fair play by monitoring and blocking connections from known malicious IPs.
About the data
Other example categories of malicious behavior include darknet scans, abused proxies, open resolvers, and IPs hosting phishing sites. Using our global network of darknets, sensors, and sinkholes, we formed the most comprehensive feed we have ever produced.
The IP Reputation Feed is updated hourly and contains an aggregate of the last 24 hours of activity.
Every IP in the feed receives an individual reputation score using several different categories of patterns observed over the past 30 days. The key used to calculate the score is included in the feed and can be used to reconstruct the behavior patterns observed for each individual IP in the feed.
IP reputation scoring categories
Controller behavior
Related feeds
Botnet intelligence
Botnet malware analysis across 40+ malware families, with IP, BGP, and GeoIP data for each bot.
Track botnets across 40+ familiesUnified threat feed
Unifies threat intelligence feeds into one machine-ready stream of 57M+ evaluated IPs with scoring and enriched context.
See the unified feedFAQ
This is designed to be a near-real-time feed to allow subscribers to monitor for infected computers visiting their networks. Subscribers can utilize the IP Reputation Feed to identify compromised hosts as they access their networks, thus enabling them to monitor or block these infected hosts before they can cause any damage. Combine the other categories we include and you have the most complete list possible. Possible uses include:
This information is gathered through a number of methods, including malware analysis, observation of botnet command and control (C&C) botnets that we have uniquely decoded, and monitoring of dark IP space (darknets).
As part of the XML file for this report, each IP has been assigned a “reputation” value derived from various methods. The key used to calculate this value is included in the feed.
The intention is that clients determine what issues are most important to them and adapt their policy accordingly. At Team Cymru, we understand that no one can make that determination for you better than you. To facilitate that decision-making capability, we prefer to give you a reputation value to assist you. You may decide that some threats are important, and others are not. This value will help you along the way.