Daily malicious IP threat brief for your security team
Every weekday morning, get a short brief of the internet's most-reported malicious IPs, double-checked against a second source and posted straight to your security Slack channel.
AbuseIPDB
VirusTotal
Slack BotEngineeringOperationsResearch & MonitoringAI ReportsDaily DigestsEvery weekday at 8:00am, produce a short, plain-language threat brief on the internet's most-reported malicious IP addresses for our security team, with every standout corroborated across two independent reputation sources. Run this on a cron schedule (Monday through Friday at 8am), because AbuseIPDB is an on-demand lookup source rather than a webhook or poll feed.
Start by calling AbuseIPDB's Download Blacklist operation to pull the current list of highest-confidence malicious IPs. Each entry carries an abuseConfidenceScore from 0 to 100 where higher means more likely malicious, so sort by that score and keep only the worst offenders. To respect both services' daily quotas, cap the deeper analysis at roughly the top 10 to 15 IPs rather than the entire blacklist.
For each of those top offenders, call VirusTotal's Get an IP Address Report operation and read the engine verdicts (the malicious and suspicious counts under last_analysis_stats). Treat an IP as corroborated when AbuseIPDB rates it high-confidence AND VirusTotal's engines also flag it as malicious. Record how many VirusTotal engines flagged each one so the brief can convey the strength of the agreement.
AbuseIPDB reports abuse categories as integer IDs, so translate them into words in the brief (for example 18 = Brute-Force, 22 = SSH, 14 = Port Scan, 4 = DDoS, 10 = Email Spam). Group the standouts by abuse category and by country so the team can see the dominant attack types and origins at a glance, and explicitly call out the IPs where both AbuseIPDB and VirusTotal agree.
Post the finished brief to our security Slack channel using Slack Bot's Send a Message operation. Keep it short and skimmable: lead with the handful of worst IPs, each with its confidence score, its abuse categories in plain words, its country, and the corroboration verdict (both sources agree, or AbuseIPDB only). Follow with a quick by-category and by-country roll-up. Do not paste the raw blacklist or a dump of every IP; this is an analyst brief, not a data export.
Example output
Additional information
What does this prompt do?
- Pulls the current list of the internet's highest-confidence malicious IP addresses every weekday morning.
- Double-checks the worst offenders against a second threat-intelligence source, so you focus on the IPs both sources agree are dangerous.
- Groups the standouts by what they are doing (brute force, SSH attacks, port scanning, spam) and where they are coming from.
- Posts a short, skimmable brief to your security Slack channel instead of a raw data dump.
What do I need to use this?
- An AbuseIPDB account, the source of the most-reported malicious IP list.
- A VirusTotal account, used to corroborate each IP against dozens of security engines.
- A Slack workspace with a channel where your security team wants the brief.
How can I customize it?
- Change the schedule, for example run at 7am or include weekends.
- Set how many of the top offenders get the deeper second-source check.
- Point the brief at a different Slack channel or highlight the abuse categories you care about most.
Frequently asked questions
How does it decide which IPs are the worst?
Why check every IP against a second source?
Will this flood my Slack channel?
Do I need paid AbuseIPDB or VirusTotal plans?
Can I run it more or less often?
Related templates
Give your security team a head start every morning
Turn two threat-intelligence sources into one short, corroborated brief that lands in Slack before the team's first coffee.