CINS Army IP List
CINS Army IP List
Keyless CINS Army threat intelligence as a plain-text list of IP addresses selected from the provider's active threat data. Each line contains one IPv4 address, with no score, timestamp or reason field.
Coverage
CINS gathers attack observations from sensors around the world and has shared threat intelligence with the community for over a decade. The Army list is capped at 15,000 IP addresses; the provider does not state a feed refresh interval or provide historical snapshots on the checked pages.
Verdict
This is defensive data for screening inbound IPs against a compact set of addresses selected from observed attack activity. The file offers only the IP, so it cannot explain when or why an address was listed and should be treated as a changing reputation signal. False positives and reassigned addresses remain possible, and the provider does not state the refresh cadence. Do not visit or fetch listed hosts; compare the feed locally with network telemetry.
Get the free weekly email
Free weekly email of newly verified free data. Unsubscribe by emailing us.
By entering your email and clicking Subscribe, you agree to receive the Signal Lab weekly email from Quantum Data Technologies Ltd., 3200-650 West Georgia Street, Vancouver, BC V6B 4P7, Canada (signal-lab@qdt.ai). You can unsubscribe at any time: reply "unsubscribe" to any email or write to signal-lab@qdt.ai. See our Privacy Policy.
Use in your agent
Load the CINS Army IP list into pandas and Parquet. Checked against the provider's documentation on Nov 1, 2026.
Access
- No account or key. The provider publishes a keyless plain-text file with one IP address per line.
Request
curl 'https://cinsscore.com/list/ci-badguys.txt'Format
Plain text with one IPv4 address per line and no header, score, timestamp or reason field.
Load into pandas and Parquet
Needs Python 3 with requests, pandas and pyarrow.
"""CINS Army IP list -> pandas -> Parquet. No key."""
import ipaddress
import requests
import pandas as pd
URL = "https://cinsscore.com/list/ci-badguys.txt"
r = requests.get(URL, timeout=60)
r.raise_for_status()
ips = [line.strip() for line in r.text.splitlines()
if line.strip() and not line.startswith("#")]
df = pd.DataFrame({"ip": ips})
df["ip_version"] = df["ip"].map(lambda value: ipaddress.ip_address(value).version)
df.to_parquet("cins_army.parquet", index=False)
print(len(df), "IP addresses", df["ip"].nunique(), "unique",
int((df["ip_version"] == 4).sum()), "IPv4")Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 15000 IP addresses 15000 unique 15000 IPv4
Limits
- Rate limit: Not stated.
- The provider caps the list at 15,000 IP addresses.
- No historical snapshots are documented on the checked pages.
Quirks
- The file has no header and supplies only IP addresses; it does not include CINS scores, observation times or listing reasons.
- Validate every line as an IP address before loading it into a firewall or matching system.
- Do not connect to listed hosts; use the downloaded feed only for defensive matching.
Terms and attribution
- The provider says the text file may be parsed and used in any way the user sees fit.
- No attribution requirement is stated on the feed page.
Sources
- https://cinsscore.com/: “The link below is provided as a simple text file, with which you can parse and use in any way you see fit.”
- https://cinsscore.com/: “capped the list (for now) at 15,000 IP addresses.”
- https://cinsscore.com/: “Our CINS system is constantly gathering attack data from each of our Sentinel units in the field.”
Information and education only. Not financial, investment, legal or tax advice. Listings can be inaccurate, incomplete or out of date and are provided "as is". Free tiers, limits and licenses belong to each provider and can change, so check the provider's own terms before you rely on them. Terms & Disclaimer