Skip to content
Install MCP

Threat feed

AlienVault Reputation

Last fetched

Reputation · refreshed hourly · last verified

AlienVault Reputation is a Reputation threat-intelligence feed, refreshed hourly, indexed by WhisperGraph.

Live data for this page is temporarily unavailable.

The graph returned an error for this lookup. Refresh in a moment to retry — fresh data is fetched on the next visit.

What is AlienVault Reputation

AlienVault Reputation is a community-driven IP reputation feed published by AT&T Cybersecurity (formerly Open Threat Exchange). It aggregates indicators from honeypots, security researchers, and OTX pulse contributors into a single deny-list of IPs observed engaging in scanning, brute-force authentication attempts, and other low-level abuse. Each address carries a confidence score derived from the number of independent sightings; entries fall off the list when reports stop arriving. Network defenders use it as a low-false-positive overlay for outbound proxy filtering and SIEM enrichment; threat hunters use it as a starting point for pivoting on observed scanners.

Source
https://otx.alienvault.com/
Refresh cadence
hourly

Indicators currently listed

Related pages

Pivot from AlienVault Reputation into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.