Show Receipts: The Numbers Don't Lie
- Patrick Duggan
- Dec 21, 2025
- 3 min read
Updated: Aug 11
--- title: "Show Receipts: Top 10 OTX, 11K AbuseIPDB Reports, All in 3 Weeks" slug: show-receipts-community-contributions-december-2025 date: 2025-12-21 author: Patrick Duggan tags: [otx, abuseipdb, threatfox, stix, community, velocity, receipts] category: Threat Intelligence featured: true ---
The Velocity
| Platform | Contribution | Time Frame | Ranking | |----------|--------------|------------|---------| | AlienVault OTX | 1,000,000+ indicators | 3-4 weeks | #10 globally | | AbuseIPDB | 11,000+ IP reports | 1-2 days | TBD | | STIX Feed | 1,017 enriched indicators | Continuous | 47 countries consuming | | ThreatFox | Active submissions | Ongoing | Community contributor |
Three weeks on OTX. Top 10 in contributed indicators.
Two days on AbuseIPDB. 11,000+ abuse reports.
OTX: #10 in Contributed Indicators
Leaderboard: `otx.alienvault.com/browse/global/users`
Username: `pduggusa`
Rank: #10
Time on platform: 3-4 weeks
The accounts above us? Years of contributions. 2015. 2017. 2019.
We joined December 2025. We're #10.
Why: Pattern 53 (PreCog Sweep) automates threat intelligence at scale. Hourly ThreatFox ingestion. Multi-source correlation. Auto-publish to OTX pulse. 24/7/365.
The enterprise vendors have headcount. We have automation that doesn't sleep.
AbuseIPDB: 11,000+ Reports in 48 Hours
Profile: `abuseipdb.com/user/256610`
Reports submitted: 11,000+
Time on platform: 1-2 days
Categories: SSH brute force, web attacks, port scanning, spam, hacking
AbuseIPDB doesn't have a public leaderboard. But 11,000 reports in 48 hours puts us in rare company.
• 11,000 reports / 48 hours = 229 reports/hour
• 229 reports/hour = 3.8 reports/minute
• Around the clock. Automated. Zero human intervention.
Why: Auto-blocker pipeline feeds directly to AbuseIPDB. Every IP that hits our honeypot, attacks our infrastructure, or shows malicious behavior gets reported. Automatically.
STIX Feed: 47 Countries Consuming
Endpoint: `analytics.dugganusa.com/api/v1/stix-feed`
Indicators: 1,017 enriched STIX 2.1 objects
Consumers: AT&T, Microsoft, Amazon, Google, Huawei, + 47 countries
Format: STIX 2.1 with MITRE ATT&CK mappings
Cost: $0
• `?since=<ISO8601>` - Delta feed (~90% bandwidth reduction)
• `?minimal=true` - Stripped context (~85% size reduction)
• `?limit=N&offset=N` - Pagination for controlled ingestion
The enterprise vendors charge $50K-$500K/year for threat feeds. Ours is free, open standard, and apparently good enough for Microsoft and AT&T to consume daily.
ThreatFox: Active Submissions
Platform: `threatfox.abuse.ch`
Status: Active community contributor
Focus: C2 infrastructure, malware delivery, stealer panels
ThreatFox is the gold standard for malware IOC sharing. We ingest hourly, correlate with VirusTotal, and contribute novel discoveries back.
• Stealc C2 infrastructure (Pattern 38 campaign)
• Rhadamanthys delivery domains
• Discord stealer networks
• GitHub-hosted malware droppers
The Automation Stack
This isn't manual work. This is:
Honeypot captures
↓
Auto-blocker evaluation
↓
AbuseIPDB report (automatic)
↓
ThreatFox correlation
↓
OTX pulse generation
↓
STIX feed update
↓
Repeat every hour
Infrastructure cost: $75/month
Human intervention: Zero
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
Uptime: 99.99%
Why This Matters
The enterprise threat intelligence model: 1. Detect threat 2. Add to proprietary database 3. Sell access for $500K/year 4. Community gets nothing
The DugganUSA model: 1. Detect threat (automated) 2. Report to AbuseIPDB (automatic) 3. Publish to OTX (automatic) 4. Update STIX feed (automatic) 5. Community gets everything, immediately, for free
Winner: The planet.
The Receipts
• 1,000,000+ indicators
• 10,100+ pulses
• 31 subscribers
• #10 global ranking
• 11,000+ reports
• 1-2 days on platform
• Categories: SSH, web attacks, scanning, spam
• 1,017 indicators
• STIX 2.1 format
• MITRE ATT&CK enriched
• 47 countries consuming
• Real-time stats
• Consumer analytics
• Churn analysis
What's Next
OTX Target: Top 5 by end of January 2026
AbuseIPDB Target: 50,000 reports by end of December
STIX Feed Target: 5,000 indicators with full enrichment
The velocity doesn't slow down. The automation doesn't sleep. The paywalls don't exist.
*DugganUSA LLC - Minnesota. Show receipts or shut up.*
Get Free IOCs
Subscribe to our threat intelligence feeds for free, machine-readable IOCs:
AlienVault OTX: https://otx.alienvault.com/user/pduggusa
STIX 2.1 Feed: https://analytics.dugganusa.com/api/v1/stix-feed
Questions? [email protected]
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=show-receipts-the-numbers-don-t-lie-1
Comments