Overview
Dataplane.org is a 501(c)(3) nonprofit organization that operates a global network of passive Internet sensors. Our mission is to provide free, independent Internet observation data to operators, researchers, and the security community.
This document covers two distinct things: (1) how we handle information related to the operation of this website, and (2) the terms under which our publicly published signal feed data may be used by others.
We are not in the business of collecting personal information about website visitors, and we have no commercial interest in user data. This policy is intended to be straightforward - not a wall of legal text.
We observe Internet traffic passively, publish lists of IPs engaging in unsolicited behavior, collect minimal website analytics, and ask only that you attribute our data if you use it. We don't sell data, don't track visitors, and don't run ads.
What We Observe and Publish
Dataplane.org operates a network of passive Internet sensors distributed across 65+ metro areas globally. These sensors are configured to receive but not solicit incoming traffic - they listen, they do not reach out.
When unsolicited packets arrive at our sensors - whether DNS queries, SSH login attempts, SMTP probes, SIP scans, or other protocols - we record metadata about those packets: the source IP address, the protocol, and the observed behavior pattern. We do not record payload contents or personal communications.
What we record
- Source IP address of unsolicited inbound connections
- Protocol (DNS, SSH, SMTP, SIP, VNC, Telnet, NTP, IPv6, etc.)
- Observed behavior class (e.g., password authentication attempt, open resolver query, spoofed source)
- Timestamp of observation
What we do not record
- Packet payloads or communication content
- Passwords, usernames, or credentials (even when submitted to our sensors)
- Personal identifying information beyond IP address
- Geolocation or ASN data at collection time (this may be added during processing for published feeds)
Our data is observational. An IP address appearing in a feed means traffic was seen from that address toward our sensors. It does not imply intent, guilt, or that the device owner is responsible - the source may be spoofed, the device may be compromised, or it may be operating as expected for its role (e.g., a legitimate scanner or research host). We publish observation data, not determinations of malicious intent.
The published signal feeds are available at dataplane.org/signals as plain-text files. They are updated hourly and represent rolling windows of observed activity - older observations age out automatically.
Website Visitor Data
When you visit dataplane.org, minimal technical information is recorded by our web server in standard access logs: IP address, requested URL, browser user agent, and timestamp. This is standard HTTP server logging, retained for operational purposes (debugging, abuse prevention) and not used for marketing or profiling.
Analytics
We use privacy-respecting, aggregate analytics to understand how the site is used - which pages are visited, which feeds are downloaded most, and how users navigate. We do not use Google Analytics or any tracking pixels. We do not set third-party cookies.
Cookies
Dataplane.org does not use tracking cookies. If any cookies are set, they are strictly functional (e.g., session state for interactive tools) and contain no personally identifying information. No advertising cookies are ever used.
Forms and email
If you contact us via email, we retain that correspondence to respond to your inquiry. We do not add you to mailing lists without your explicit opt-in. If you subscribe to our newsletter via Substack, that subscription is governed by Substack's privacy policy.
Donations
Donation processing is handled by third-party payment processors. Dataplane.org does not store payment card information. Donor records are retained as required by nonprofit accounting and tax law.
Signal Feed Terms of Use
All standard signal feeds published at dataplane.org are free to access and use, subject to the following terms. By downloading or using any feed, you agree to these terms.
Permitted uses
- Security operations: integrating feeds into firewalls, SIEMs, blocklists, or threat intelligence platforms
- Academic and non-commercial research, including peer-reviewed publication (with attribution)
- Network operations and abuse mitigation
- Commercial products and services (see commercial use terms below)
- Teaching, training, and educational materials
Prohibited uses
- Using feed data to target, harass, or otherwise harm the individuals or organizations associated with listed IP addresses
- Reselling or redistributing the raw feed data as a standalone commercial product without a custom feed arrangement
- Claiming that listed IP addresses are definitively malicious, criminal, or operated by bad actors - the data is observational only
- Automated mass contact or abuse reporting campaigns directed at IP owners listed in our feeds without independent verification
Signal feeds are published as-is. Dataplane.org makes no warranty about the accuracy, completeness, or fitness for any particular purpose. Users are responsible for validating data before taking action on it. We are not liable for decisions made on the basis of our data.
Commercial Use
Commercial use of Dataplane.org signal feeds is permitted, provided that:
- You include attribution to Dataplane.org in any product, service, or documentation that incorporates our data (see Attribution section)
- You do not resell or redistribute the raw feed data as a standalone product without a custom feed arrangement with us
- Your use does not violate the prohibited uses listed above
Many commercial security platforms, threat intelligence services, and network products already incorporate our feeds. We support this and consider it consistent with our mission of making quality Internet observation data as widely available as possible.
If your organization requires higher refresh rates, private delivery, enriched metadata, or a protocol or geography not covered by our standard feeds, we offer custom feed arrangements. Revenue from custom feeds directly sustains the free public signals.
Attribution Requirements
We ask that anyone using Dataplane.org data in a product, publication, or service includes attribution. Attribution can be as simple as:
For academic publications, we suggest:
See the Analysis page for citation examples used in peer-reviewed work that has incorporated our data.
Attribution is not required for internal operational use (e.g., blocking IPs in your own firewall), but we appreciate a mention when it's practical. If you publish findings based on our data, a heads-up to lets us link to your work from our Analysis page.
IP Address Delisting
Our feeds are rolling windows. IP addresses that stop generating observable traffic toward our sensors will age out of the feeds automatically - typically within hours to days depending on the feed.
If you believe an IP address is listed in error, or if you represent the operator of a listed address and believe the listing is causing harm, you may contact us at with the subject line "IP Delisting Request." Please include:
- The IP address(es) in question
- The specific feed(s) where the address appears
- Your relationship to the address (operator, ISP, etc.)
- Why you believe the listing is in error
We will investigate and respond. Note that if the underlying activity continues, the address will continue to appear in feeds - delisting requires resolving the behavior that triggered observation.
If you believe a device under your control was compromised and generating the traffic that triggered a listing, we recommend remediation first. Once the activity stops, the IP will age out on its own. Contact us if you need the timeline expedited.
Data Retention
Published signal feeds are rolling windows and do not retain historical IP-level data indefinitely. The retention window varies by feed - most are between 24 hours and 30 days of observed activity. Once an IP address ages out of a feed, it is no longer included in the published file.
Third-Party Services
Dataplane.org uses a small number of third-party services to operate. We do not share data with these services beyond what is necessary for operation:
Substack
Our newsletter is hosted on Substack. Subscribers are subject to Substack's privacy policy. We do not share subscriber lists with third parties.
GitHub
We use GitHub for code and issue tracking. Interactions with our GitHub repositories are subject to GitHub's privacy policy.
Payment processors
Donations are processed by third-party payment processors. We do not receive or store payment card data. Donors interacting with payment processors are subject to those processors' privacy policies.
Hosting and infrastructure
Our sensors and servers are hosted with third-party infrastructure providers. We do not share signal data or visitor data with these providers beyond what is necessary for hosting.
Policy Changes
We may update this policy from time to time. Material changes will be noted in our newsletter and on this page with an updated "last modified" date. Continued use of our signals or website after a policy change constitutes acceptance of the revised terms.
We don't anticipate frequent changes - our approach to data is fundamentally simple and unlikely to change: observe passively, publish openly, protect what little personal data we touch, and let the community use the data freely with attribution.
Questions & Contact
If you have questions about this policy, concerns about data you believe we hold about you, or requests related to data subjects under applicable privacy law, please contact us:
This policy was written to be readable, not to obscure. If something is unclear or you believe we've missed something, please tell us.