Threat Intelligence Glossary

Plain-language definitions of the terms behind a threat report — what each risk is, how it works, how to check for it and how to fix it.

IP Reputation Check

IP reputation is a score that tells you how trustworthy an IP address is. Every IP has a reputation like credit score. B…

C2 server is brain of botnet. Malware phones home to C2 to get instructions. Works: infection, beacon every 60s, command…

Botnet is network of infected computers. Created via exploit phishing brute force. Does DDoS spam credential stuffing mi…

Threat Intelligence is evidence-based knowledge about threats. Types strategic tactical operational technical IOCs. Feed…

Blocklist is list of abusive IPs. Major Spamhaus Barracuda Sorbs Blocklist.de AbuseIPDB. Gets listed for spam brute forc…

AbuseIPDB is community DB where sysadmins report abusive IPs 100k daily. Abuse Confidence Score 0-100% based on reports …

Check if IP blacklisted via FindingThreat Risk Score + blacklists + fixes 8 sources, MXToolbox 100+ DNSBL, WhatIsMyIPAdd…

Breach data is leaked emails passwords IPs. HaveIBeenPwned 12B records. IP in breach with exposed RDP creds attacker can…

OSINT is intel from public sources. For IP: Shodan open ports VirusTotal malware AbuseIPDB Whois reverse DNS BGP. Workfl…

Shodan search engine for internet devices shows open ports banners vulns. Example 8.8.8.8 port 53 DNS. Risk open RDP 338…

VirusTotal aggregates 70+ antivirus. Check IP domain file URL. IP shows detection ratio 5/94 flagged suspicious, malware…

Brute force tries many passwords until works. Common SSH 22 RDP 3389 FTP 21. Detect many failed logins same IP short tim…

DDoS floods target with traffic from many bots. Types volumetric UDP amplification protocol SYN flood application HTTP f…

VPN hides real IP. Companies detect to prevent fraud multi-accounting geo bypass. Detect via ASN hosting vs residential …

Proxy forwards traffic Open proxy anyone can use often abused. Types HTTP SOCKS residential open misconfigured. Detectio…

Get a risk score, incident history and remediation steps for any IP or domain.