Create Your Own Up-to-Date Threat Intelligence

Malware News
1

What Does This Script Do?

  • Fetches IP addresses with a high confidence score (≥ 80) from the AbuseIPDB blacklist endpoint.
  • Applies time-based filtering, focusing on IPs reported within the last 24 hours.
  • Retrieves detailed reports for each IP using the “/check” endpoint.
  • Supports both Global Mode and country-based analysis for IP evaluation.
  • Produces analyst-ready output in JSON and CSV formats, including interpretable fields such as: Mapped abuse categories, Recent report comments, Reporter count

Example of the Generated CSV Output:

The configuration file is separate and can be easily modified to fit specific needs.

# Filtering Configuration
MIN_CONFIDENCE_SCORE = 80
HOURS_BACK = 24  # Reported within the last 24 hours
TEST_LIMIT = 995  # Maximum number of IPs to fetch

# Reporter Country Filter
REPORTER_COUNTRY = None  # Country code (e.g., "DE", "US", "FR") or None for global
MIN_REPORTERS_COUNTRY = 2  # Minimum reporters from the specified country
REPORTS_TO_CHECK = 10  # Most recent 10 reports
MAX_COMMENTS = 5  # Get last 5 comments

(Since the AbuseIPDB free tier allows up to 1,000 IP checks per day, the test_limit is set to 995.)

As the data is continuously refreshed, the output is not a static blacklist but a living threat intelligence set that can be directly operationalized within security workflows.

The script includes example configurations, and it can be scheduled to run daily using tools such as crontab (Linux) or Windows Task Scheduler to automatically collect the generated outputs.

Threat Hunting

It can be leveraged as a seed list for threat hunting queries, especially when analyzing:

  • “Firewall Logs”
  • “Network Traffic”
  • “Authentication Logs”

Detection Rules (SIEM / XDR)

  • When used as an external intelligence lookup in SIEM correlation rules, abuse confidence scores and reporter counts allow for smarter threshold tuning and meaningful noise reduction.

Risk-Based Alerting (RBA)

IPs can be scored based on:

  • Abuse confidence score
  • Reporter count
  • Recency of activity

Alert severity can be increased dynamically based on the aggregated risk score. Example logic:

  • +15 → High confidence score
  • +10 → Multiple reporters from same country
  • +5 → Recent activity

Direct Blacklisting

IPs with high confidence scores and strong reporter signals can be automatically added to:

  • Firewall blocklists
  • Proxy blocklists
  • EDR / NDR blocklists

This is particularly effective against:

  • Short-lived attack infrastructure
  • Active scanning and brute-force sources

Source Code

The full script and configuration files are available on GitHub.

In case you missed it, here’s the link: [Link]

Thanks for reading.

Create Your Own Up-to-Date Threat Intelligence was originally published in Detect FYI on Medium, where people are continuing the conversation by highlighting and responding to this story.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Article Link: https://detect.fyi/create-your-own-up-to-date-threat-intelligence-9bc7cd8c7085?source=rss----d5fd8f494f6a---4