IPsum
Automatic deploy
Supported by Filigran
Infrastructure & Attack Surface Visibility
Overview
IPsum connector imports malicious IP addresses from 30+ aggregated blacklists into OpenCTI as indicators, with confidence scoring based on cross-list occurrence count.
IPsum is a threat intelligence feed based on 30+ different publicly available lists of suspicious and/or malicious IP addresses. All lists are automatically retrieved and parsed on a daily basis. The feed provides IP addresses together with a total number of blacklist occurrences — the greater the number, the lesser the chance of false positive detection.
This connector fetches malicious IP addresses from the IPsum feed and imports them into OpenCTI as IPv4-Addr observables and STIX 2.1 Indicators. It supports configurable threat levels (1-8), custom scoring, and TLP markings.