Maltego
Integration

Integration details

• Suitable users

  Any Maltego customer, accessible via the Cyber Threat Intelligence module with Maltego Data Pass access. The data is relevant for:

  • Threat Intelligence Teams
  • Incident Response Teams
  • Cyber and Digital Forensics Teams
  • Trust and Safety
  • Penetration Testers
  • CERTs
  • SOCs

• Accessing the integration

  Setup is quick and easy, managed via Maltego. Spamhaus Intelligence transforms can be accessed via Maltego Data Pass, connecting directly to the Spamhaus Intelligence API.

  A Maltego Data Pass is available on purchase with all Maltego Plans. For more information, visit the Maltego website and select the plan most relevant for your needs.

• How the integration works

  The Maltego–Spamhaus integration allows users to query Spamhaus’ IP and domain threat intelligence via API directly within the Maltego interface, without the hassle of managing individual contracts, API keys, or integrations.

  With the integration, run Spamhaus Intelligence transforms (modular queries) in Maltego. Run transforms on Spamhaus’ IP data to provide signal on both malicious, and compromised IP’s, showing indication of:

  • Malware
  • Worm infections
  • Botnet command and controllers
  • Devices controlled by botnets command and controllers
  • Third party exploits
  • Spam
  • Phishing

  Run transforms on Spamhaus’ domain data to provide signal on every domain Spamhaus observes.

  Requests are sent securely to the Spamhaus Intelligence API, returning structured threat intelligence data.

• Included datasets

  The following datasets are included via the integration:

  • Botnet C2 IPs (Botnet Controller List)

  Botnet command and controller (C2) servers. The status of these single IPv4 addresses is re-evaluated several times a day to identify active botnet controllers only. Utilize for protection or threat intelligence requirements.

  • Compromised IPs (Exploits Blocklist)

  IP addresses exhibiting signs of compromise, which can include downloaded malware, security vulnerabilities allowing unauthorized access, etc. Designed to protect networks from malware and spam by preventing connections from these IPs. Available in binary and contextual format.

  • Domain Intel (Domain Blocklist (Context))

  Contextual metadata on every domain observed and analyzed by our researchers. This includes reputation areas to strengthen, domain contexts, senders data, nameserver reputation, A Record reputation, correlated related domains, listed Hostnames, and malware.

  • Email Spam IPs (Combined Spam Sources Blocklist)

  Spam-emitting IPs that are direct snowshoe spam sources or senders posing a risk. This includes emails showing indications of an unsolicited nature, sending malicious emails due to a compromise, and other indicators of low reputation or abuse.

  • Zero reputation domains (Zero Reputation Domains)

  Newly registered or newly observed domains. These domains are included in this dataset for 24 hours; newly created domains are rarely used for legitimate purposes within 24 hours of registration, which provides a strong indicator of potential malicious behavior.

  
  

  Why does the data have two labels?

  We are moving to more transparent naming conventions. However, some organizations have been consuming these datasets for decades. To save any confusion, for old or new users, we’re currently documenting both names.