Threat-intelligence feed
General BlacklistsLast verified Page fetched
ET Compromised IPs is a general blacklists threat-intelligence feed tracked by WhisperGraph as a FEED_SOURCE node. The Whisper Internet Directory publishes this page so security analysts and LLM agents can link to it as a stable record for ET Compromised IPs.
ET Compromised IPs is the Emerging Threats compromised-host feed maintained by Proofpoint as part of the public ET Open ruleset. It enumerates IP addresses observed by Proofpoint's sensor network, customer telemetry, and partner exchanges as currently hosting malware, serving exploit kits, or acting as command-and-control endpoints. Entries roll off the list when observations stop arriving. The feed has been a fixture of Suricata and Snort rule-bundle deployments for over a decade and is widely cited in incident-response documentation. It is indexed here as a stable record because Emerging Threats is one of the most-deployed open IDS rule sources globally.
FEED_SOURCE node not currently in WhisperGraph. The editorial entry for ET Compromised IPsis committed to the directory but the corresponding graph node is missing — typically a transient state during the threat-feed import pipeline's between-runs window. The page will reconcile on the next revalidation.
Indicators: Computing — check back later. The precompute pipeline is building this feed's indicator sample from the host corpus and will populate the count and representative addresses on an upcoming run.
Look up which threat feeds list a given IP — the indicator-anchored query that powers the threat card:
MATCH (ip:IPV4 {name: $ip})-[:LISTED_IN]->(f:FEED_SOURCE)
WHERE f.name = "ET Compromised IPs"
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.name AS feed, c.name AS categoryVerify the feed's graph-side identity directly:
MATCH (f:FEED_SOURCE {name: "ET Compromised IPs"})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS id, f.name AS name, c.name AS categoryOr query Whisper from your own LLM workflow via the Whisper MCP server.
Pivot from ET Compromised IPs into adjacent entities.