Attribution
Data sources
We do not run a private honeypot network. Scores come from the feeds below and from the ASN table compiled with the code. Only sources whose terms allow commercial use are downloaded by default.
| Source | From | Used for | Licence |
|---|---|---|---|
| Tor exit list | check.torproject.org/torbulkexitlist | Sets is_tor. Refreshed every 6 hours. | The Tor Project publishes this list so operators can identify exit relays. Attribute The Tor Project. The list has no separate licence file. |
| DB-IP ASN lite | db-ip.com | ASN and organisation. City lite stays off (DBIP_CITY_ENABLED). | CC BY 4.0. Commercial use is allowed with attribution to DB-IP (https://db-ip.com). |
| Spamhaus DROP | spamhaus.org/drop | Do-not-route ranges, merged into the blocklist. On by default. | Spamhaus publishes DROP free of charge for any use, including inside a product, when the product credits Spamhaus Project. eDROP was merged into DROP on 10 April 2024. The DNSBL and SBL are not used. |
| stamparm ipsum level 3 | github.com/stamparm/ipsum, levels/3.txt | Blocklist. On by default (IPSUM_ENABLED). | The Unlicense (public-domain dedication). The licence text permits any purpose, including commercial use and sale. nestIP attributes stamparm/ipsum. The level-3 file is a compiled aggregate: addresses seen on at least three lists. |
| X4BNet VPN list | github.com/X4BNet/lists_vpn, output/vpn/ipv4.txt | Sets is_vpn. On by default (VPN_FEED_ENABLED). | MIT License. Copyright (c) 2024 X4B (Mathew Heard). That repository states the licence covers the generated lists. Commercial use is permitted; this page keeps the copyright and permission notice. |
| Mullvad relays | seed file vpn_cidrs.txt | Snapshot of published relay addresses. | Addresses Mullvad publishes for its subscribers. Attribute Mullvad. The snapshot is not a complete live feed. |
| FireHOL level 1 and level 2 | Not downloaded | Off. FIREHOL_ENABLED and FIREHOL_LEVEL2_ENABLED default to false. | Both levels include DShield data from the SANS Internet Storm Center. SANS ISC permits use with attribution and forbids resale (https://isc.sans.edu/feeds_doc.html). A paid API is resale, so these feeds are not downloaded. When the flags are off, the worker deletes feed_blacklist.txt and feed_blacklist_level2.txt. |
| AWS ranges | ip-ranges.amazonaws.com/ip-ranges.json | Identifies AWS hosting ranges. | Amazon publishes this file so customers can identify AWS ranges. nestIP uses it for classification and does not republish it as a standalone dataset. |
| Google Cloud and Google | gstatic.com/ipranges/cloud.json and goog.json | Hosting ranges. goog.json includes Google Public DNS 8.8.8.0/24. | Google publishes these ranges. Used to identify Google addresses. |
| Cloudflare | cloudflare.com/ips-v4 and ips-v6 | Identifies Cloudflare ranges. | Cloudflare publishes these lists so customers can allow-list Cloudflare. Used for identification, not republished as a raw file. |
| DigitalOcean | digitalocean.com/geo/google.csv | Identifies DigitalOcean ranges. | DigitalOcean publishes this CSV of its ranges. |
| Hosting ASN table and curated prefixes | Compiled into the binary and datacenter_cidrs.txt | Fallback when a cloud CIDR does not match. | Facts compiled from public BGP summaries (Hetzner, OVH, Vultr, Linode, Azure, and others). Not a live feed and not a copy of a third-party blocklist. Azure service tags are not downloaded. |
| Vietnamese ASNs and prefixes | vn_asns.json and vn_prefixes.txt | Separates mobile, fixed, hosting, education, and government. | Hand-curated from public BGP summaries. Not a full routing table. SCTV is omitted until an ASN is confirmed. Vietnamobile is stored as AS38247 and should be re-checked against APNIC. |
| Bogon ranges | RFCs 1918, 5735, 6598, 6890 | Flags reserved and unroutable ranges. | Public standards. |