Download & API
CyberGreen provides publicly observable measurements of internet infrastructure exposure and amplification risk. The public dashboard shows six-month country-level trends and public country-level API access.
The data reflects observed internet-exposed systems and estimated risk indicators. It should be interpreted as infrastructure exposure measurement, not as attribution of malicious activity.
Need full historical data, ASN-level observations, archived datasets, or bulk exports?
View Subscription OptionsAPI
The public API examples below are limited to country-level, six-month time series access.
Public API Examples
| Use case | Example |
|---|---|
| Country-level time series | /api/v1/count_by_country?country=US&risk=1&start=2026-01-01&end=2026-06-30 |
| Country rankings | /api/v1/rankings?risk=100&date=2026-06-22 |
| Risk reference data | /api/v1/risk |
| Country reference data | /api/v1/country |
CSV output is available by adding format=csv to supported public queries.
The interactive API reference below is limited to public-facing endpoints.
Risk ID Reference
API queries use numeric risk IDs. The current scanned risk indicators are IDs
1, 2, 4, 5, and 7. ID 100 is the calculated DDoS potential derived
from the scanned indicators.
| ID | Slug | Name | Notes |
|---|---|---|---|
| 1 | openrecursivedns |
Open DNS | Current scanned indicator |
| 2 | openntp |
Open NTP | Current scanned indicator |
| 4 | opensnmp |
Open SNMP | Current scanned indicator |
| 5 | openssdp |
Open SSDP | Current scanned indicator |
| 7 | chargen |
Open CHARGEN | Current scanned indicator |
| 100 | ddos |
DDoS | Calculated amplification potential |
The canonical risk reference data is available in
risk.csv.
You can also query the API reference endpoint at /api/v1/risk.
Limitations
API requests are limited to 50,000 results per page. This limit helps avoid
timeout errors, since some queries may return large result sets. To page
through public API results, change the page attribute in the query string to
get the next 50,000 results. The API will respond with an empty list of
results if page exceeds the total number of pages.
Full historical data, ASN-level observations, archived datasets, and bulk exports are described on the Subscribe page.