# Daily malicious IP threat brief for your security team

> Every weekday morning, get a short brief of the internet's most-reported malicious IPs, double-checked against a second source and posted straight to your security Slack channel.

- Workflow type: agent
- Services: AbuseIPDB, VirusTotal, Slack Bot
- Categories: Engineering, Operations
- Published: 2026-07-17

## What it does

- Pulls the current list of the internet's highest-confidence malicious IP addresses every weekday morning.
- Double-checks the worst offenders against a second threat-intelligence source, so you focus on the IPs both sources agree are dangerous.
- Groups the standouts by what they are doing (brute force, SSH attacks, port scanning, spam) and where they are coming from.
- Posts a short, skimmable brief to your security Slack channel instead of a raw data dump.

## What you'll need

- An AbuseIPDB account, the source of the most-reported malicious IP list.
- A VirusTotal account, used to corroborate each IP against dozens of security engines.
- A Slack workspace with a channel where your security team wants the brief.

## Prompt

Every weekday at 8:00am, produce a short, plain-language threat brief on the internet's most-reported malicious IP addresses for our security team, with every standout corroborated across two independent reputation sources. Run this on a cron schedule (Monday through Friday at 8am), because AbuseIPDB is an on-demand lookup source rather than a webhook or poll feed.

Start by calling AbuseIPDB's Download Blacklist operation to pull the current list of highest-confidence malicious IPs. Each entry carries an abuseConfidenceScore from 0 to 100 where higher means more likely malicious, so sort by that score and keep only the worst offenders. To respect both services' daily quotas, cap the deeper analysis at roughly the top 10 to 15 IPs rather than the entire blacklist.

For each of those top offenders, call VirusTotal's Get an IP Address Report operation and read the engine verdicts (the malicious and suspicious counts under last_analysis_stats). Treat an IP as corroborated when AbuseIPDB rates it high-confidence AND VirusTotal's engines also flag it as malicious. Record how many VirusTotal engines flagged each one so the brief can convey the strength of the agreement.

AbuseIPDB reports abuse categories as integer IDs, so translate them into words in the brief (for example 18 = Brute-Force, 22 = SSH, 14 = Port Scan, 4 = DDoS, 10 = Email Spam). Group the standouts by abuse category and by country so the team can see the dominant attack types and origins at a glance, and explicitly call out the IPs where both AbuseIPDB and VirusTotal agree.

Post the finished brief to our security Slack channel using Slack Bot's Send a Message operation. Keep it short and skimmable: lead with the handful of worst IPs, each with its confidence score, its abuse categories in plain words, its country, and the corroboration verdict (both sources agree, or AbuseIPDB only). Follow with a quick by-category and by-country roll-up. Do not paste the raw blacklist or a dump of every IP; this is an analyst brief, not a data export.

## How to customize

- Change the schedule, for example run at 7am or include weekends.
- Set how many of the top offenders get the deeper second-source check.
- Point the brief at a different Slack channel or highlight the abuse categories you care about most.

## Example output

Daily Malicious IP Brief for Wed, Jul 17

3 IPs flagged by BOTH AbuseIPDB and VirusTotal:
- 45.134.xx.xx (Netherlands), confidence 100, categories Brute-Force and SSH, VirusTotal 12 engines malicious
- 193.201.xx.xx (Russia), confidence 100, categories Port Scan and DDoS, VirusTotal 9 engines malicious
- 218.92.xx.xx (China), confidence 98, categories SSH and Brute-Force, VirusTotal 8 engines malicious

By category: Brute-Force and SSH dominate (2 of 3), plus one DDoS source.
By country: Russia, China, Netherlands.

Reviewed the top 15 IPs from today's blacklist. Only the corroborated standouts are shown above.

## FAQ

### How does it decide which IPs are the worst?

Each IP on the list carries a confidence score from 0 to 100, where higher means more likely to be malicious. The brief sorts by that score and focuses on the highest-confidence offenders.

### Why check every IP against a second source?

One source can produce false positives. By cross-checking the top offenders against a second threat-intelligence service and calling out the IPs both sources flag, you get corroborated results you can act on with more confidence.

### Will this flood my Slack channel?

No. It runs once each weekday and posts a single short brief covering only a handful of the worst IPs, never the full raw list.

### Do I need paid AbuseIPDB or VirusTotal plans?

Free accounts work for a modest daily brief. Both services have daily usage limits, so the workflow only runs the deeper check on the top offenders to stay comfortably within them.

### Can I run it more or less often?

Yes. You can change the schedule to run earlier, later, or on weekends, and adjust how many IPs get the second-source check.

Use this prompt in General Input: https://www.generalinput.com/prompts/daily-malicious-ip-threat-brief-for-your-security-team