new: [ipapi-is-ip] ipapi.is IP intelligence object template

README.md

@@ -312,6 +312,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID
 - [objects/iot-firmware](https://github.com/MISP/misp-objects/blob/main/objects/iot-firmware/definition.json) - A firmware for an IoT device.
 - [objects/ip-api-address](https://github.com/MISP/misp-objects/blob/main/objects/ip-api-address/definition.json) - IP Address information. Useful if you are pulling your ip information from ip-api.com.
 - [objects/ip-port](https://github.com/MISP/misp-objects/blob/main/objects/ip-port/definition.json) - An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.
+- [objects/ipapi-is-ip](https://github.com/MISP/misp-objects/blob/main/objects/ipapi-is-ip/definition.json) - IP address intelligence from ipapi.is: VPN (with the provider), proxy, Tor, datacenter, abuser, crawler, mobile, satellite and anycast detection, the organisation the address is registered to with its abuser score, and the abuse contact.
 - [objects/ipgeolocation-ip](https://github.com/MISP/misp-objects/blob/main/objects/ipgeolocation-ip/definition.json) - IP address intelligence from IPGeolocation.io: threat score, anonymisation signals (VPN, proxy, Tor, relay), bot, spam and attacker flags, hosting provider, company and abuse contact.
 - [objects/irc](https://github.com/MISP/misp-objects/blob/main/objects/irc/definition.json) - An IRC object to describe an IRC server and the associated channels.
 - [objects/ja3](https://github.com/MISP/misp-objects/blob/main/objects/ja3/definition.json) - JA3 is a new technique for creating SSL client fingerprints that are easy to produce and can be easily shared for threat intelligence. Fingerprints are composed of Client Hello packet; SSL Version, Accepted Ciphers, List of Extensions, Elliptic Curves, and Elliptic Curve Formats. https://github.com/salesforce/ja3.

objects/ipapi-is-ip/definition.json

@@ -0,0 +1,161 @@
+{
+  "attributes": {
+    "abuse-address": {
+      "description": "Postal address of the abuse contact for the network the IP address belongs to",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 0
+    },
+    "abuse-email": {
+      "description": "Email address of the abuse contact",
+      "disable_correlation": true,
+      "misp-attribute": "email",
+      "ui-priority": 1
+    },
+    "abuse-name": {
+      "description": "Name of the abuse contact",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 0
+    },
+    "abuse-phone": {
+      "description": "Phone number of the abuse contact",
+      "disable_correlation": true,
+      "misp-attribute": "phone-number",
+      "ui-priority": 0
+    },
+    "asn-abuser-score": {
+      "description": "Abuser score of the autonomous system announcing the IP address, over all its IPv4 routes: the share of its addresses seen in abuse, followed by a label from Very Low to Very High, such as 0.0327 (High)",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 0
+    },
+    "company-abuser-score": {
+      "description": "Abuser score of the network the IP address is registered in: the share of its addresses seen in abuse, followed by a label from Very Low to Very High, such as 0.3086 (Very High)",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 1
+    },
+    "company-domain": {
+      "description": "Domain of the organisation the IP address is registered to",
+      "disable_correlation": true,
+      "misp-attribute": "domain",
+      "ui-priority": 0
+    },
+    "company-name": {
+      "description": "Name of the organisation the IP address is registered to, from WHOIS",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 1
+    },
+    "company-type": {
+      "description": "Type of the organisation the IP address is registered to: hosting, isp, education, government, banking or business",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 0
+    },
+    "crawler": {
+      "description": "Name of the crawler or bot operating from the IP address, such as GoogleBot",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 1
+    },
+    "datacenter": {
+      "description": "Name of the hosting, cloud or CDN provider the IP address belongs to",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 1
+    },
+    "ip": {
+      "description": "IP address the information refers to",
+      "misp-attribute": "ip-src",
+      "ui-priority": 1
+    },
+    "is-abuser": {
+      "description": "The IP address was recently seen in abuse (attacks, spam, scanning) by blocklists or honeypots",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
+      "ui-priority": 1
+    },
+    "is-anycast": {
+      "description": "The IP address is anycast: it is announced from many sites and answers from the nearest one",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
+      "ui-priority": 1
+    },
+    "is-crawler": {
+      "description": "The IP address is used by a crawler or bot, such as a search engine, SEO or AI crawler or an uptime monitor",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
+      "ui-priority": 1
+    },
+    "is-datacenter": {
+      "description": "The IP address belongs to a hosting, cloud or CDN provider",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
+      "ui-priority": 1
+    },
+    "is-mobile": {
+      "description": "The IP address belongs to a mobile carrier",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
+      "ui-priority": 1
+    },
+    "is-proxy": {
+      "description": "The IP address is a known open proxy (HTTP, SOCKS4, SOCKS5)",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
+      "ui-priority": 1
+    },
+    "is-satellite": {
+      "description": "The IP address belongs to a satellite ISP, such as Starlink or Viasat",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
+      "ui-priority": 1
+    },
+    "is-tor": {
+      "description": "The IP address is a Tor exit node",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
+      "ui-priority": 1
+    },
+    "is-vpn": {
+      "description": "The IP address is a VPN exit node or server",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
+      "ui-priority": 1
+    },
+    "rir": {
+      "description": "Registry the WHOIS record of the IP address comes from, such as RIPE, ARIN or JPNIC",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 0
+    },
+    "vpn-last-seen": {
+      "description": "Last time the IP address was seen as a VPN exit node or server",
+      "disable_correlation": true,
+      "misp-attribute": "datetime",
+      "ui-priority": 0
+    },
+    "vpn-service": {
+      "description": "Name of the VPN provider; several providers sharing a range are joined with +",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 1
+    },
+    "vpn-type": {
+      "description": "exit_node when VPN traffic was seen leaving from the IP address, vpn_server when the VPN provider lists it as one of its servers",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 0
+    }
+  },
+  "description": "IP address intelligence from ipapi.is: VPN (with the provider), proxy, Tor, datacenter, abuser, crawler, mobile, satellite and anycast detection, the organisation the address is registered to with its abuser score, and the abuse contact.",
+  "meta-category": "network",
+  "name": "ipapi-is-ip",
+  "required": [
+    "ip"
+  ],
+  "uuid": "2961a5dc-0c3c-4e68-8d65-1565c118c723",
+  "version": 1
+}