AbuseIPDB IP BlackList
Automatic deploy
Supported by Filigran
Infrastructure & Attack Surface Visibility
Overview
Imports the most reported malicious IP addresses from the AbuseIPDB blacklist API into OpenCTI as IPv4/IPv6 observables and optional STIX indicators, with TLP markings and source attribution.
AbuseIPDB is a community-driven project dedicated to fighting hackers, spammers, and abusive activity on the internet. Its API provides access to a comprehensive database of IP addresses reported for malicious activity.
This connector fetches the AbuseIPDB blacklist and imports the most reported malicious IP addresses into OpenCTI as IPv4/IPv6 observables, with optional STIX Indicator creation. Each object is attributed to an AbuseIPDB identity, linked to an external reference, and annotated with configurable TLP markings. Relationship creation between indicators and other STIX objects is also supported.