IPsum

IPsum is a threat intelligence feed based on 30+ different publicly available lists of suspicious and/or malicious IP addresses. All lists are automatically retrieved and parsed on a daily basis. The feed provides IP addresses together with a total number of blacklist occurrences — the greater the number, the lesser the chance of false positive detection.

This connector fetches malicious IP addresses from the IPsum feed and imports them into OpenCTI as IPv4-Addr observables and STIX 2.1 Indicators. It supports configurable threat levels (1-8), custom scoring, and TLP markings.