FAQ

Frequently asked questions

Everything below describes the SciScope Scanner Feed as it works today. Where something is not built yet, this page says so rather than implying otherwise.

The feed

What is the SciScope Scanner Feed?

A curated IP-reputation feed built from SciScope's own distributed network of passive sensors. It scores the addresses that are genuinely scanning and attacking, and it guarantees that legitimate infrastructure (search and AI crawlers, public DNS resolvers, NTP and root DNS servers, cloud health-checkers, uptime monitors and attributed research scanners) never appears on it.

How is it different from a free public blocklist?

Two differences, and only one of them is about coverage. The first is curation: on 2026-07-06 we cross-referenced widely-used public lists against our curated reference set of known-good infrastructure and found false-positive rates from ~1.6% to ~10%, including 3,725 legitimate addresses in a single abuse-report feed's top 100,000. Not one of those reaches the SciScope feed. The second is provenance: the signal is first-party, from sensors we run, so every flagged address ships with the evidence and timestamps behind the verdict instead of an unattributable score.

Will the feed ever list Googlebot, Bingbot or an AI crawler?

No. Search and AI crawlers, public DNS resolvers, core time and name infrastructure, cloud health-checkers, uptime probes and attributed research scanners are screened out of the feed continuously: that is the product, not a best effort. Research scanners are still identified as what they are, so you can see them in your telemetry without blocking them.

Where does the data come from?

From our own sensors, deployed across independent vantage points and networks, which observe unsolicited traffic passively. Nothing is resold from a third-party feed. We do not publish the curation mechanics, but the outcomes are measured and published. The figures on this site are our own measurements, dated, and re-run as the public lists change.

How often is it updated?

The feed bundle is rebuilt and pushed to the serving edge hourly. The free live statistics page is regenerated from exactly the same bundle a subscriber's firewall is pulling, so what you see there is the current state of the feed rather than a marketing snapshot.

What formats do I get?

A scored feed as JSON and CSV, with scores, tags and per-IP evidence; a high-confidence blocklist.txt of plain addresses for direct firewall consumption; and an opt-in crawler-identity list, so you can make your own decision about regional crawlers instead of having one made for you by accident.

Using it

How do I access the API?

It is a token-gated REST API at https://api.sciscope.ee/, authenticated with a bearer token:

curl -s -H "Authorization: Bearer $SCISCOPE_KEY" \
     https://api.sciscope.ee/v1/feeds/blocklist.txt

The same key introspects itself at /v1/key, which tells you your tier, your limits and your expiry, and keeps working even when you are rate-limited, so a key can never go silently dark on you.

Is there a free tier, and what is actually in it?

Yes, and it is a real API rather than a demo: the top 10 scored addresses (/v1/free/top) and aggregate statistics (/v1/stats), at 10 requests per minute and 500 per day. It uses the same schema and the same field names as the paid feed, so an integration written against Free keeps working unchanged when you upgrade: the upgrade is a config change, not a rewrite. There is no dashboard UI; Free is the API and the public statistics page.

Can I try the paid feed?

Yes. A 14-day trial on the full Pro feature set: the whole feed, per-IP lookups with evidence, history, everything. No card and no signup funnel. Tell us what you are trying to evaluate and we will extend it to 30 days. When a trial ends the key drops to the Free level rather than dying, so nothing in your pipeline breaks at midnight. Trials are currently issued by hand, which means you will talk to a person rather than a form.

What does it cost?

Free is €0. Entry is €5/month or €45/year, Pro is €15/month or €135/year, both net of VAT, and MSSP/Enterprise is quoted. Those are early-adopter prices, available for subscriptions started on or before 31 December 2026; once you are on one it stays with you for as long as the subscription stays continuously active, renewals and tier changes included. Full detail is on the pricing section of the product page.

How does VAT work?

Prices are quoted net. Estonia's standard rate of 24% applies to consumers; EU business customers with a valid VAT ID are reverse-charged, so give us the ID when you sign up and you pay the net price. Non-EU business customers pay the net price.

Can I redistribute the feed or embed it in my product?

Not on Entry or Pro: those are licensed for internal use by one organisation. Redistribution and rebranding are what the MSSP/Enterprise tier exists for, together with day-over-day diffs, per-IP timelines, custom allowlists and an SLA. If you are building a product on top of it, that is the conversation to have.

What happens if I exceed my rate limit?

You get an HTTP 429 with a Retry-After, and nothing else changes. Keys are not suspended for hitting a limit. Per-minute and per-day quotas are counted separately, and a request refused by the minute limit does not consume your daily budget. Key introspection at /v1/key is always available regardless.

Is processing IP addresses like this lawful under the GDPR?

IP addresses can be personal data, and we treat them as such. The processing is built on the legitimate interest in network and information security that the GDPR explicitly recognises: data minimisation, defined retention limits, and a licence that permits defensive use only. The detail is in our privacy notice and the terms of service.

Who runs SciScope?

SciScope OÜ is a specialist network-security company registered in Estonia (registry code 16731450). Beyond the feed we do IDS/NSM consulting, network-monitoring training and cybersecurity exercise instrumentation; the company site has the detail. The practice behind the curation includes doctoral research in cybersecurity and 25+ peer-reviewed publications on intrusion detection and security monitoring.

How do I get in touch?

Email hello@sciscope.ee. For training enquiries, trainings@sciscope.ee. There is no contact form on this site by design: the pages make no external requests and collect nothing.

See it on your own traffic

A 14-day trial on the full Pro feature set: the whole feed, per-IP lookups with evidence, and history. No card, no signup form: email us what you are trying to do.

Request a 14-day trial or see the pricing