Download & API
CyberGreen provides publicly observable measurements of internet infrastructure exposure and amplification risk. These datasets support research, operational analysis, and longitudinal measurement of internet infrastructure conditions.
The data reflects observed internet-exposed systems and estimated risk indicators. It should be interpreted as infrastructure exposure measurement, not as attribution of malicious activity.
We provide access to publicly available datasets through two primary methods:
- Bulk downloads: complete CSV files for offline analysis.
- API access: JSON and CSV endpoints for programmatic queries and application integration.
Interested in an SLA or supported access? Please contact us.
Bulk Data
Download the full aggregated dataset: http://bits.cybergreen.net/prod/stats/latest/count.csv
The CSV structure is:
date,risk,country,asn,count,count_amplifiedAPI
There are three groups of API endpoints:
- Count API: query the main dataset using
/countfor country/ASN-level data and/count_by_countryfor country-level aggregates. - Reference Data API: query supporting reference data for countries, risks, and ASNs.
- Rankings API: query country rankings for a given risk and reporting period.
API queries can specify custom date ranges, including earlier historical reporting periods that are not included in every public page download.
Risk ID Reference
API queries use numeric risk IDs. The current scanned risk indicators are IDs
1, 2, 4, 5, and 7. ID 100 is the calculated DDoS potential derived
from the scanned indicators.
| ID | Slug | Name | Notes |
|---|---|---|---|
| 1 | openrecursivedns |
Open DNS | Current scanned indicator |
| 2 | openntp |
Open NTP | Current scanned indicator |
| 4 | opensnmp |
Open SNMP | Current scanned indicator |
| 5 | openssdp |
Open SSDP | Current scanned indicator |
| 7 | chargen |
Open CHARGEN | Current scanned indicator |
| 100 | ddos |
DDoS | Calculated amplification potential |
The canonical risk reference data is available in
risk.csv.
You can also query the API reference endpoint at /api/v1/risk.
Archived Datasets
Archived datasets predate CyberGreen's current scanning systems and may require specifying the archived start date when querying the API.
| ID | Slug | Name | Availability | Notes |
|---|---|---|---|---|
| 6 | miraicertbr |
Mirai | 2016-11-07 through 2017-07-24 |
Include an early start date such as start=2016-11-07 when querying this dataset. |
Limitations
API requests are limited to 50,000 results per page. This limit helps avoid timeout errors, since some queries may return several million rows. To get the full dataset, you have two options:
- Download the full aggregated dataset and slice and dice on your own.
- Change the
pageattribute in the query string to get the next 50,000 results. The API will respond with an empty list ofresultsifpageexceeds the total number of pages.
You can find full documentation of the API below and try out the API using the interactive interface.