According to an evaluation of 700,000, Recorded Future Web sources resulted in 67,563 IP addresses connected addresses that were connected with at least two kinds of malware. dangerous IP with at least one kind of malware — and 1,521 especially

Of these addresses, 91 percent didn’t show up on present blacklists, and of the smaller list and 98 percent of the bigger list were new to security researchers.

One important difference between the brand new list and conventional lists is the higher percent of “outbound” malicious addresses.

For inbound action, 99 percent of the addresses are on conventional blacklists, he said.

On the new list of Recorded Future, half of the addresses are for outbound action.

By way of example, Recorded Future identified 476 IP addresses connected with the Upatre malware families as well as the Dyreza — just 41 of which were understood to present blacklists.

Because the bad guys want to remain concealed another reason why conventional discovery systems might be losing these new addresses are, said Recorded Future’s CEO Christopher Ahlberg.

“But we can get back to the heart of the evil.”

Ahlberg stressed that Recorded Future is not proposing that conventional blacklists are replaced by the new list, but can be used as a source of complementary information.

“Or you can do more research on topic and determine what the issue is.”

As an example, this type of investigation could result in the discovery of common infrastructure between distinct malware groups.

Truve said that Recorded Future will soon be incorporating the new information into its risk intelligence platform.

“And the following step is incorporating our system with SIEM systems, in order to automate it, have them block these addresses automatically,” he said.

The organization has not determined yet how it’ll share the new lists with the people.

“We print a free daily e-mail, the Recorded Future Cyber Daily, which now lists the top performers and top malware,” he said. “So it is likely that we’ll be enriching that info with at least a subset of these addresses.”