---
name: cert-pl-warning-list-ingestion
description: "How to get CERT Polska Warning List data into a pandas DataFrame and Parquet: access, the request, the format, limits, quirks and terms."
---

# Load CERT Polska warning domains into pandas and Parquet

Source entry: https://signal-lab-jet.vercel.app/datasets/cert-pl-warning-list
Provider: https://cert.pl/en/warning-list/
Checked against the provider's documentation: 2026-11-01

## Access
- No account or key. TXT, TSV, JSON, XML, ad-blocker, hosts, MikroTik and RPZ files are public downloads.

## Request
```bash
curl 'https://hole.cert.pl/domains/v2/domains.csv'
```

## Format
Tab-separated rows with Polish headers for register position, domain address, insertion timestamp and deletion timestamp; blank deletion timestamps mark active records.

## Load into pandas and Parquet
Needs Python 3 with requests, pandas and pyarrow.
```python
"""CERT Polska Warning List TSV -> pandas -> Parquet. Does not visit listed domains."""
import io
import requests
import pandas as pd

URL = "https://hole.cert.pl/domains/v2/domains.csv"
r = requests.get(URL, timeout=120)
r.raise_for_status()
df = pd.read_csv(io.StringIO(r.text), sep="\t")
df = df.rename(columns={"PozycjaRejestru": "register_position",
                        "AdresDomeny": "domain",
                        "DataWpisu": "inserted_at",
                        "DataWykreslenia": "deleted_at"})
df["inserted_at"] = pd.to_datetime(df["inserted_at"], utc=True)
df["deleted_at"] = pd.to_datetime(df["deleted_at"], utc=True)
df.to_parquet("cert_pl_warning_list.parquet", index=False)
print(len(df), "records", int(df["deleted_at"].isna().sum()), "active",
      df["inserted_at"].min().isoformat(), "to", df["inserted_at"].max().isoformat())
```
Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 126201 records 126160 active 2026-05-01T17:12:53+00:00 to 2026-11-01T16:47:06+00:00

## Limits
- Rate limit: Not stated.
- Administrators are instructed to update the blocked-domain list every five minutes.
- Version 2 formats retain the latest six months of list activity.

## Quirks
- The file named domains.csv is tab-separated and uses Polish column names.
- The TXT format is active-only; in the TSV, filter blank deleted_at values when only active domains are wanted.
- Do not visit listed domains; use the downloaded feed only for defensive matching.

## Terms and attribution
- The Warning List may be used for any purpose, including commercial purposes.
- Attribution is optional and must not imply cooperation, partnership, endorsement, certification or support.
- Use is at the user's risk and CERT Polska disclaims completeness, accuracy and the malicious nature of listed domains.
- Terms page: https://cert.pl/en/warning-list/

## Sources
- https://cert.pl/en/warning-list/: "list of blocked domains should be updated every 5 minutes"
- https://cert.pl/en/warning-list/: "The Warning List may be used by any user for any purpose, including commercial purposes, without any representation or warranty as to its completeness, accuracy or the malicious nature of the domains included in the List."
- https://cert.pl/en/warning-list/: "Attribution of the data source is not required."

## Help improve this skill
Missing a source, or see something to improve? Call the MCP tool suggest_source or feedback (or POST /api/suggest or /api/feedback). Reviewed ideas: https://signal-lab-jet.vercel.app/agent-suggestions

Information for educational purposes only. Free tiers, limits and licenses belong to the providers and may change; check the provider's own terms before using the data.