Show Receipts: The Numbers Don't Lie
- Patrick Duggan
- Dec 21, 2025
- 3 min read
--- title: "Show Receipts: Top 10 OTX, 11K AbuseIPDB Reports, All in 3 Weeks" slug: show-receipts-community-contributions-december-2025 date: 2025-12-21 author: Patrick Duggan tags: [otx, abuseipdb, threatfox, stix, community, velocity, receipts] category: Threat Intelligence featured: true ---
The Velocity
| Platform | Contribution | Time Frame | Ranking | |----------|--------------|------------|---------| | AlienVault OTX | 1,000,000+ indicators | 3-4 weeks | #10 globally | | AbuseIPDB | 11,000+ IP reports | 1-2 days | TBD | | STIX Feed | 1,017 enriched indicators | Continuous | 47 countries consuming | | ThreatFox | Active submissions | Ongoing | Community contributor |
Three weeks on OTX. Top 10 in contributed indicators.
Two days on AbuseIPDB. 11,000+ abuse reports.
OTX: #10 in Contributed Indicators
Leaderboard: `otx.alienvault.com/browse/global/users`
Username: `pduggusa`
Rank: #10
Time on platform: 3-4 weeks
The accounts above us? Years of contributions. 2015. 2017. 2019.
We joined December 2025. We're #10.
Why: Pattern 53 (PreCog Sweep) automates threat intelligence at scale. Hourly ThreatFox ingestion. Multi-source correlation. Auto-publish to OTX pulse. 24/7/365.
The enterprise vendors have headcount. We have automation that doesn't sleep.
AbuseIPDB: 11,000+ Reports in 48 Hours
Profile: `abuseipdb.com/user/256610`
Reports submitted: 11,000+
Time on platform: 1-2 days
Categories: SSH brute force, web attacks, port scanning, spam, hacking
AbuseIPDB doesn't have a public leaderboard. But 11,000 reports in 48 hours puts us in rare company.
• 11,000 reports / 48 hours = 229 reports/hour
• 229 reports/hour = 3.8 reports/minute
• Around the clock. Automated. Zero human intervention.
Why: Auto-blocker pipeline feeds directly to AbuseIPDB. Every IP that hits our honeypot, attacks our infrastructure, or shows malicious behavior gets reported. Automatically.
STIX Feed: 47 Countries Consuming
Endpoint: `analytics.dugganusa.com/api/v1/stix-feed`
Indicators: 1,017 enriched STIX 2.1 objects
Consumers: AT&T, Microsoft, Amazon, Google, Huawei, + 47 countries
Format: STIX 2.1 with MITRE ATT&CK mappings
Cost: $0
• `?since=<ISO8601>` - Delta feed (~90% bandwidth reduction)
• `?minimal=true` - Stripped context (~85% size reduction)
• `?limit=N&offset=N` - Pagination for controlled ingestion
The enterprise vendors charge $50K-$500K/year for threat feeds. Ours is free, open standard, and apparently good enough for Microsoft and AT&T to consume daily.
ThreatFox: Active Submissions
Platform: `threatfox.abuse.ch`
Status: Active community contributor
Focus: C2 infrastructure, malware delivery, stealer panels
ThreatFox is the gold standard for malware IOC sharing. We ingest hourly, correlate with VirusTotal, and contribute novel discoveries back.
• Stealc C2 infrastructure (Pattern 38 campaign)
• Rhadamanthys delivery domains
• Discord stealer networks
• GitHub-hosted malware droppers
The Automation Stack
This isn't manual work. This is:
Honeypot captures
↓
Auto-blocker evaluation
↓
AbuseIPDB report (automatic)
↓
ThreatFox correlation
↓
OTX pulse generation
↓
STIX feed update
↓
Repeat every hour
Infrastructure cost: $75/month
Human intervention: Zero
Uptime: 99.99%
Why This Matters
The enterprise threat intelligence model: 1. Detect threat 2. Add to proprietary database 3. Sell access for $500K/year 4. Community gets nothing
The DugganUSA model: 1. Detect threat (automated) 2. Report to AbuseIPDB (automatic) 3. Publish to OTX (automatic) 4. Update STIX feed (automatic) 5. Community gets everything, immediately, for free
Winner: The planet.
The Receipts
• 1,000,000+ indicators
• 10,100+ pulses
• 31 subscribers
• #10 global ranking
• 11,000+ reports
• 1-2 days on platform
• Categories: SSH, web attacks, scanning, spam
• 1,017 indicators
• STIX 2.1 format
• MITRE ATT&CK enriched
• 47 countries consuming
• Real-time stats
• Consumer analytics
• Churn analysis
What's Next
OTX Target: Top 5 by end of January 2026
AbuseIPDB Target: 50,000 reports by end of December
STIX Feed Target: 5,000 indicators with full enrichment
The velocity doesn't slow down. The automation doesn't sleep. The paywalls don't exist.
*DugganUSA LLC - Minnesota. Show receipts or shut up.*
Get Free IOCs
Subscribe to our threat intelligence feeds for free, machine-readable IOCs:
AlienVault OTX: https://otx.alienvault.com/user/pduggusa
STIX 2.1 Feed: https://analytics.dugganusa.com/api/v1/stix-feed
Questions? [email protected]
Comments