I would also scrub all the sinkholes and captured botnet C&C ip addresses as hitting those will lower the reputation your netblock. List we use at meanpath is: http://mirror1.malwaredomains.com/files/domains.txt https://zeustracker.abuse.ch/blocklist.php?download=domainbl... https://zeustracker.abuse.ch/blocklist.php?download=ipblockl... http://malc0de.com/bl/IP_Blacklist.txt http://hosts-file.net/download/hosts.txt http://www.joewein.net/dl/bl/dom-bl-base.txt http://www.dshield.org/feeds/suspiciousdomains_High.txt http://www.malware.com.br/cgi/submit?action=list https://spyeyetracker.abuse.ch/blocklist.php?download=domain... https://spyeyetracker.abuse.ch/blocklist.php?download=ipbloc...