FAQ

1. What is NUBI?

   NUBI was designed to be a replacement for the venerable badips.com after their website went offline in late 2020.
   
   NUBI catalogs reports from honeypot reporters and stores them as a list for public consumption.

2. What kinds of reports does NUBI store?

   NUBI currently stores reports for the following services:

   • dns
     • TCP/53, UDP/53
     • TCP/953
   • ftp
     • TCP/21
     • TCP/990, UDP/990
   • http
     • TCP/80, TCP/443
     • TCP/800, TCP/4443 (alternate ports)
     • TCP/3128
     • TCP/8000, TCP/8008, TCP/8080 (alternate ports)
     • TCP/81, TCP/811, TCP/8100, TCP/8181 (alternate ports)
   • imap
     • TCP/143, TCP/993
   • ldap
     • TCP/389, UDP/389
     • TCP/636, UDP/636
     • TCP/1389, TCP/1636 (alternate ports)
   • nosql
     • TCP/6379
     • TCP/27017, TCP/28017
   • pop3
     • TCP/110
     • TCP/995, UDP/995
   • print
     • TCP/515, UDP/515
     • TCP/631, UDP/631
     • TCP/9100
   • rdp
     • TCP/3389, UDP/3389
   • sip
     • TCP/5060, UDP/5060
     • TCP/5061, UDP/5061
   • smb
     • TCP/135, UDP/135
     • UDP/137, UDP/138
     • TCP/139
     • TCP/445
     • TCP/593
   • smtp
     • TCP/25
     • TCP/465
     • TCP/587
   • snmp
     • TCP/161, UDP/161
   • sql
     • TCP/1433, UDP/1433
     • TCP/1434, UDP/1434
     • TCP/3306
     • TCP/5432
   • ssh
     • TCP/22
     • TCP/222 (alternate port)
     • TCP/2222 (alternate port)
   • telnet
     • TCP/23
     • TCP/992, UDP/992
     • TCP/2323 (alternate port)
   • vnc
     • TCP/5900, UDP/5900
     • TCP/5901, UDP/5901
     • TCP/5902, UDP/5902
     • TCP/5903, UDP/5903

3. Is NUBI a direct drop-in replacement for BI?

   For the end-user downloading the list periodically, yes.
   
   However, the BI website had several features that we feel probably weren't used often, such as scoring. The web API is different as well, as BI had used JSON and we use HTTP replies.
   
   The list we provide should conform to BI's "any" category, level 0, with a max age of 1 day. eg: /get/list/any/0?age=1d

4. Can I use this list on my router/server/laptop/pc/etc as a blocklist?

   Of course! But this shouldn't be your only resource. Always use multiple sources.

5. How do I use this list on my router/server/laptop/pc/etc as a blocklist?

   This will vary from firewall to firewall, but we do have an example config file for firehol users.
   pfSense users may be intererested in pfBlocker-NG to download the list.

6. How often does the list get updated?

   The list file gets updated every 5 minutes, however to reduce server load it is recommended to only download the list every 15 minutes at a minimum.

7. How long do the reports get stored for?

   The list file contains reports from the past 24 hours, and the report database stores reports from the past 90 days.

8. How can I contribute? Can I host a reporter?

   In the future we may consider opening up the framework to allow external reporters, but at the current time this is not available.
   
   The best way you can contribute is to spread the word about the list and by donating. Your generous donations will be put towards setting up and maintaining the reporter servers.

9. How many reporters do you have and where are they located?

   Unfortunately due to security concerns, we cannot disclose the locations and specifications of our reporter servers.

10. Does NUBI support IPv6?

    At this present time, NUBI only supports IPv4 addresses. This may change in the future as IPv6 gains wider acceptance among ISP's.