AbuseIPDB

AbuseIPDB Transforms for Maltego

AbuseIPDB is a project dedicated to helping combat the spread of hackers, spammers, and abusive activity on the internet. It crowdsources IP addresses that have been associated with malicious activity online and provides a central blacklist for webmasters, system administrators, and other interested parties. There are thousands of reports generated daily from users who detect suspicious traffic and report it to AbuseIPDB. 

They offer a free API for both reporting malicious IP addresses detected on your systems, and checking IP addresses for reported malicious activity.

Any illegal, abusive or inappropriate activity detected from an IP address is considered to be malicious, such as attempted DDoS, any type of spam, fraudulent orders, hacking attempts, phishing, spoofing, SQL injection, etc.

With AbuseIPDB Transforms, get information about IPv4 and IPv6 Addresses, such as abuse score, IP usage type, hostname associated with the IP, Country, and ISP Details. 

Benefits of the integration:

• Check if an IP address has been reported for abuse, and what those reports say specifically
• Report an IP address associated with malicious activity themselves, directly from Maltego 
• Obtain additional information on an IP such as usage type, country, ISP, etc.
• Reduce the time taken to confirm if a particular IP address is malicious and see if anyone else has reported malicious activities from that IP

Typical users of this data:

• Threat Intelligence
• CERT
• SOC
• Cyber Analysts