CERT Polska Warning List

Use in your agent

Load CERT Polska warning domains into pandas and Parquet. Checked against the provider's documentation on Nov 1, 2026.

Access

• No account or key. TXT, TSV, JSON, XML, ad-blocker, hosts, MikroTik and RPZ files are public downloads.

Request

curl 'https://hole.cert.pl/domains/v2/domains.csv'

Format

Tab-separated rows with Polish headers for register position, domain address, insertion timestamp and deletion timestamp; blank deletion timestamps mark active records.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

"""CERT Polska Warning List TSV -> pandas -> Parquet. Does not visit listed domains."""
import io
import requests
import pandas as pd

URL = "https://hole.cert.pl/domains/v2/domains.csv"
r = requests.get(URL, timeout=120)
r.raise_for_status()
df = pd.read_csv(io.StringIO(r.text), sep="\t")
df = df.rename(columns={"PozycjaRejestru": "register_position",
                        "AdresDomeny": "domain",
                        "DataWpisu": "inserted_at",
                        "DataWykreslenia": "deleted_at"})
df["inserted_at"] = pd.to_datetime(df["inserted_at"], utc=True)
df["deleted_at"] = pd.to_datetime(df["deleted_at"], utc=True)
df.to_parquet("cert_pl_warning_list.parquet", index=False)
print(len(df), "records", int(df["deleted_at"].isna().sum()), "active",
      df["inserted_at"].min().isoformat(), "to", df["inserted_at"].max().isoformat())

Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 126201 records 126160 active 2026-05-01T17:12:53+00:00 to 2026-11-01T16:47:06+00:00

Limits

• Rate limit: Not stated.
• Administrators are instructed to update the blocked-domain list every five minutes.
• Version 2 formats retain the latest six months of list activity.

Quirks

• The file named domains.csv is tab-separated and uses Polish column names.
• The TXT format is active-only; in the TSV, filter blank deleted_at values when only active domains are wanted.
• Do not visit listed domains; use the downloaded feed only for defensive matching.

Terms and attribution

• The Warning List may be used for any purpose, including commercial purposes.
• Attribution is optional and must not imply cooperation, partnership, endorsement, certification or support.
• Use is at the user's risk and CERT Polska disclaims completeness, accuracy and the malicious nature of listed domains.

Sources

• https://cert.pl/en/warning-list/: “list of blocked domains should be updated every 5 minutes”
• https://cert.pl/en/warning-list/: “The Warning List may be used by any user for any purpose, including commercial purposes, without any representation or warranty as to its completeness, accuracy or the malicious nature of the domains included in the List.”
• https://cert.pl/en/warning-list/: “Attribution of the data source is not required.”