The Outlaws 2017 Qartulad

This site aggregates, analyzes, compares and documents publicly available IP Feeds, with a focus on attacks and abuse. It is automatically generated and maintained using open source software (check the wiki), that can be installed and run on your systems too, to download all IP lists directly from their maintainers, process them and re-generate the site and its data.

Special care has been given to make this analysis as scientific and objective as possible, respecting the hard work of the security teams, security companies and security professionals who offer these IP lists to the rest of us.

Of course, security is achieved with a lot more than IP lists. And not all IP lists included here should be used for blocking traffic at a firewall or border router. Many of them, should be used, for example, to influence the way applications handle clients, or help in the development of further threat analysis.

Unfortunately, the InfoSec industry still considers as a standard industry practice the trade of Threat Intelligence for money.

This is disappointing.
Why?

Threat Intelligence requires knowledge, skills and sophisticated tools to be effective. Instead of selling these skills and tools, security firms selling threat intel state clearly they have valid information that identifies criminals. But they want money to reveal it.

This is contradictory to what we consider acceptable, if it was about criminal activity other than cyber.

So, I have concluded that either the InfoSec industry has a severe cultural fault, or they have nothing. The super duper feeds they advertise are just a marketing tool to attract customers. They sell an illusion...

Many will argue that collecting threat intel is expensive.

Of course it is!
Then, you will also accept it if someone opens an online shop to sell information about a gang that breaks houses in your neighbor, as long as it cost them enough to acquire this information. Yes?

To my understanding Threat Intelligence cannot be effective when it is treated as Intellectual Property.
Hopefully, many security companies and professionals agree and openly distribute the result of their hard work.