CINS Army (CI Army List) — threat-intel blacklist
by shop owners for shop owners.
CI Army List (ci-badguys) from the CINS Score system by Sentinel IPS — profile and cross-check with AbuseIPDB.
Profile of the CINS Army List
| Category / attack surface | General malicious IPs — network level (scans, rogue traffic, attacks), not a bot/crawler list |
|---|---|
| What it is | Free threat-intel IP list (ci-badguys.txt, „CI Army List“) from the CINS Score system |
| Operator | Sentinel IPS (Austin, Texas) — CINS = Collective Intelligence Network Security |
| How IPs get listed | From Sentinel's own IPS sensor network (IPS appliances at customers worldwide). Each IP gets a CINS Score from a „rogue packet“ rating plus reputation across the sensor fleet — independent of community reports. |
| Listing criterion | Poor CINS Score; the free list deliberately contains only IPs not already widely covered by other reputation lists |
| Size | ~15,000 IPs |
| Update interval | daily |
| Distributed via / aggregated in | FireHOL · Emerging Threats (Proofpoint) |
| Official site | cinsscore.com |
| Feed source | ci-badguys.txt — official list (TXT) |
Cross-check with AbuseIPDB as of 2026-06-26
All 15,000 IP addresses of the current CI Army List (ci-badguys, as of 2026-06-26) were queried against AbuseIPDB over a 30-day window and enriched with additional information.
AbuseIPDB score
100: 8936 (60%), 75–99: 683 (5%), 50–74: 1087 (7%), 25–49: 995 (7%), 1–24: 708 (5%), 0: 2591 (17%)
Usage type
Data Center/Web Hosting/Transit: 8800 (59%), Fixed Line ISP: 4448 (30%), Commercial: 1553 (10%), Mobile ISP: 145 (1%), University/College/School: 40 (0%), Other: 14 (0%)
Country distribution
US: 5689 (38%), CN: 2212 (15%), DE: 1037 (7%), GB: 907 (6%), SG: 537 (4%), BR: 523 (3%), HK: 458 (3%), JP: 433 (3%), Other: 3204 (21%)
Provider distribution (ISP)
Microsoft Corporation: 1468 (10%), Google LLC: 1041 (7%), Alpha Strike Labs GmbH: 865 (6%), Alibaba Cloud LLC: 687 (5%), Infrawatch Limited: 595 (4%), Palo Alto Networks, Inc: 553 (4%), Alibaba Cloud (Singapore) Private Limited: 456 (3%), UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED: 449 (3%), Other: 8886 (59%)
Cross-check with PARC feeds (excluding blacklists) as of 2026-06-26
Of the 15,000 CINS IPs, 4,679 (31.2%) are covered by our IP feeds in the Internet Scanners category.
Scanner share of the CINS list by feed
Stretchoid: 1782 (38%), Cortex Xpanse: 858 (18%), Infrawatch: 581 (12%), BitSight: 358 (8%), Alpha Strike: 322 (7%), others: 778 (17%)