{"service":"Zedmos CTI","generated_at":"2026-11-03T03:29:33.818Z","ship_tiers":{"what_this_is":"Three-tier classification of every IOC. Default firewall feed at /v1/feeds/<k>/<c>/{domains,ips}.txt = verified ∪ trusted only. Community is opt-in.","verified":0,"trusted":0,"community":0,"default_ship_total":0,"catalog_total":0,"verified_pct":0,"trusted_pct":0,"community_pct":0,"default_ship_pct":0,"criteria":{"verified":"≥2 distinct upstream sources, OR active enrichment (GreyNoise/AbuseIPDB/VirusTotal) classified as malicious, OR honeypot-confirmed, OR operator manually approved","trusted":"single-source from a strict T1 feed: USOM (TR-CERT), CERT.pl, Spamhaus DROP, abuse.ch Feodo Tracker (low-FP recommended variant)","community":"single-source from a T2-T5 feed — operationally useful as wide net but NOT independently corroborated; opt-in only at /v1/feeds/<k>/<c>/community-{domains,ips}.txt"},"by_category":[]},"summary":{"fps_caught_total":3941762,"fps_caught_last_24h":21069,"fps_caught_last_7d":21069,"operator_rejected_as_fp":0,"operator_confirmed_block":0},"breakdown_by_reason_total":[{"reason":"allowlist_match","count":3583159,"what_it_means":"Indicator matched a manually-curated allowlist entry (Tranco top domains, Umbrella top domains, or seed list)."},{"reason":"feed_pending_audit_no_bypass","count":221187,"what_it_means":"(no description)"},{"reason":"cloud_provider_asn","count":44991,"what_it_means":"(no description)"},{"reason":"warninglist_strong_cat_review_needed","count":14683,"what_it_means":"(no description)"},{"reason":"tripwire_popular_root","count":14586,"what_it_means":"(no description)"},{"reason":"cloud_provider_range","count":14502,"what_it_means":"IP/CIDR sits inside a published AWS/GCP/Cloudflare/GitHub range — blocking would break shared cloud infra for every customer."},{"reason":"auto_benign_single_provider","count":9297,"what_it_means":"(no description)"},{"reason":"root_domain_protected","count":6788,"what_it_means":"Indicator is a 2-label or PSL-effective registrable root (e.g. example.com itself, not a subdomain). Held back to prevent over-block."},{"reason":"bogon_address","count":1191,"what_it_means":"(no description)"},{"reason":"tripwire_popular_domain","count":65,"what_it_means":"(no description)"},{"reason":"warninglist:tld-edu","count":7,"what_it_means":"(no description)"},{"reason":"warninglist:tld-gov","count":2,"what_it_means":"(no description)"},{"reason":"warninglist:canonical-ubuntu","count":1,"what_it_means":"(no description)"},{"reason":"warninglist:vendor-os-update","count":1,"what_it_means":"(no description)"}],"breakdown_by_reason_last_24h":[{"reason":"cloud_provider_range","count":594},{"reason":"auto_benign_single_provider","count":601},{"reason":"feed_pending_audit_no_bypass","count":7803},{"reason":"root_domain_protected","count":1003},{"reason":"tripwire_popular_root","count":2879},{"reason":"allowlist_match","count":5599},{"reason":"warninglist_strong_cat_review_needed","count":630},{"reason":"tripwire_popular_domain","count":65},{"reason":"cloud_provider_asn","count":1856},{"reason":"bogon_address","count":39}],"breakdown_by_reason_last_7d":[{"reason":"bogon_address","count":39},{"reason":"auto_benign_single_provider","count":601},{"reason":"feed_pending_audit_no_bypass","count":7803},{"reason":"cloud_provider_range","count":594},{"reason":"cloud_provider_asn","count":1856},{"reason":"root_domain_protected","count":1003},{"reason":"warninglist_strong_cat_review_needed","count":630},{"reason":"tripwire_popular_domain","count":65},{"reason":"allowlist_match","count":5599},{"reason":"tripwire_popular_root","count":2879}],"allowlist_anchors":{"cloud_provider_cidrs":16695,"tranco_top_domains":135506,"umbrella_top_domains":33595,"seed_curated":12},"cloud_range_index":{"intervals_in_memory":16695,"last_rebuilt_age_ms":280961,"last_rebuilt_at":"2026-11-03T03:25:01.467Z","rebuild_ttl_minutes":5,"refresh_schedule":"daily via tihub-maint queue (cloud-ranges-refresh)","providers":["aws","gcp","cloudflare","github"]},"cross_validation":{"what_this_is":"Random sample of shipped IOCs proving each meets its tier criteria. Verified IOCs must show ≥2 distinct sources OR enrichment-confirmation OR honeypot-confirmation. Trusted IOCs must show single-source from a strict T1 feed (USOM, CERT.pl, Spamhaus DROP, abuse.ch Feodo low-FP).","cadence":"daily via tihub-maint queue (xvalidate)","last_run":{"status":"no_run_yet"}},"known_good_smoke_test":{"size":54,"cadence":"every 6h via tihub-maint queue (known-good-smoke)","what_it_does":"Asserts that none of a hand-curated list of must-never-block indicators (hyperscaler consoles, OS update channels, banks, e-gov, payment, CDN, package registries) ever leaks into a shipped IOC snapshot.","last_run":{"ran_at":"2026-11-03T03:23:07.857Z","total_checked":54,"leaked":0,"duration_ms":42,"leaks":[]}},"audit_trail":{"every_decision_recorded":true,"review_collection":"ReviewQueue","retention":"indefinite — no automatic deletion","anyone_can_query":"operator console at /admin (Bearer-protected)"},"notable_fp_corpora":{"2026-04-29_cloud_provider_sweep":{"finding":"8,663 IPs in our IP catalog (4.27% of 202,787) sat inside published AWS/GCP/Cloudflare/GitHub CIDR ranges.","action":"Moved to ReviewQueue with fp_reason=cloud_provider_range. Snapshot rebuild dropped them from /v1/feeds/* downloads.","reason":"Cloud IPs are mostly transient attacker VMs; permanent block of underlying range would break legitimate services.","providers_affected":{"aws":2619,"gcp":3137,"github":2904,"cloudflare":3}}}}