Threat feed
ET Compromised IPs
Last fetched
General Blacklists · refreshed every 6 hours · last verified
ET Compromised IPs is a General Blacklists threat-intelligence feed, refreshed every 6 hours, indexed by WhisperGraph.
Live data for this page is temporarily unavailable.
The graph returned an error for this lookup. Refresh in a moment to retry — fresh data is fetched on the next visit.
What is ET Compromised IPs
ET Compromised IPs is the Emerging Threats compromised-host feed maintained by Proofpoint as part of the public ET Open ruleset. It enumerates IP addresses observed by Proofpoint's sensor network, customer telemetry, and partner exchanges as currently hosting malware, serving exploit kits, or acting as command-and-control endpoints. Entries roll off the list when observations stop arriving. The feed has been a fixture of Suricata and Snort rule-bundle deployments for over a decade and is widely cited in incident-response documentation. It is indexed here as a stable record because Emerging Threats is one of the most-deployed open IDS rule sources globally.
- Refresh cadence
- every 6 hours
Indicators currently listed
Related pages
Pivot from ET Compromised IPs into the indicators it lists.
Queries
Resolves the feed's categories.
MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categoriesThe indicator-kind rollup and sample listed above.
MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESCOr query Whisper from your own LLM workflow via the Whisper MCP server.