{"service":"Zedmos CTI","generated_at":"2026-09-20T11:00:38.324Z","ship_tiers":{"what_this_is":"Three-tier classification of every IOC. Default firewall feed at /v1/feeds/<k>/<c>/{domains,ips}.txt = verified ∪ trusted only. Community is opt-in.","verified":314181,"trusted":880735,"community":12479779,"default_ship_total":1194916,"catalog_total":13632282,"verified_pct":2.3,"trusted_pct":6.46,"community_pct":91.55,"default_ship_pct":8.77,"criteria":{"verified":"≥2 distinct upstream sources, OR active enrichment (GreyNoise/AbuseIPDB/VirusTotal) classified as malicious, OR honeypot-confirmed, OR operator manually approved","trusted":"single-source from a strict T1 feed: USOM (TR-CERT), CERT.pl, Spamhaus DROP, abuse.ch Feodo Tracker (low-FP recommended variant)","community":"single-source from a T2-T5 feed — operationally useful as wide net but NOT independently corroborated; opt-in only at /v1/feeds/<k>/<c>/community-{domains,ips}.txt"},"by_category":[{"category":"adult_nsfw","verified":22937,"trusted":51174,"community":2862338},{"category":"adult_oisd","verified":315,"trusted":837,"community":4817},{"category":"anonymizer","verified":2355,"trusted":26181,"community":9139},{"category":"banking_trojan","verified":2287,"trusted":8393,"community":204},{"category":"botnet_cc","verified":14826,"trusted":44481,"community":33374},{"category":"bulletproof_hosting","verified":1612,"trusted":685,"community":10273},{"category":"compromised","verified":3290,"trusted":303,"community":349},{"category":"cryptominer","verified":1971,"trusted":13801,"community":319},{"category":"ddos_amplifier","verified":2582,"trusted":257,"community":166},{"category":"dead","verified":163359,"trusted":548594,"community":3924138},{"category":"dynamic_dns","verified":10178,"trusted":1027,"community":22534},{"category":"exploit_kit","verified":219,"trusted":84,"community":187},{"category":"file_sha256_malware","verified":51405,"trusted":0,"community":12549},{"category":"first_seen","verified":12442,"trusted":0,"community":7063},{"category":"gambling","verified":84845,"trusted":248,"community":752371},{"category":"hacking","verified":66312,"trusted":364049,"community":710554},{"category":"info_stealer","verified":5813,"trusted":3344,"community":4399},{"category":"iot_botnet","verified":15020,"trusted":125,"community":4647},{"category":"ja3","verified":0,"trusted":97,"community":0},{"category":"keyloggers","verified":5377,"trusted":681,"community":2047},{"category":"malware_virus","verified":138604,"trusted":586799,"community":876344},{"category":"manual","verified":4,"trusted":0,"community":0},{"category":"newly_recovered","verified":22275,"trusted":17208,"community":1594422},{"category":"newly_registered","verified":108091,"trusted":106836,"community":7701359},{"category":"parked","verified":0,"trusted":0,"community":8},{"category":"phishing","verified":70353,"trusted":652487,"community":293709},{"category":"piracy","verified":5086,"trusted":56,"community":49118},{"category":"potentially_dangerous","verified":2426,"trusted":211891,"community":16661},{"category":"ransomware","verified":12495,"trusted":18276,"community":28409},{"category":"recent_outbreaks","verified":14774,"trusted":27930,"community":6473},{"category":"scanner","verified":56744,"trusted":564,"community":675221},{"category":"spam","verified":21,"trusted":0,"community":7},{"category":"spyware_adware","verified":595,"trusted":240,"community":246},{"category":"turkish_usom","verified":4131,"trusted":347526,"community":1154}]},"summary":{"fps_caught_total":3802463,"fps_caught_last_24h":4498,"fps_caught_last_7d":1459646,"operator_rejected_as_fp":0,"operator_confirmed_block":0},"breakdown_by_reason_total":[{"reason":"allowlist_match","count":3553519,"what_it_means":"Indicator matched a manually-curated allowlist entry (Tranco top domains, Umbrella top domains, or seed list)."},{"reason":"feed_pending_audit_no_bypass","count":162692,"what_it_means":"(no description)"},{"reason":"cloud_provider_asn","count":36349,"what_it_means":"(no description)"},{"reason":"cloud_provider_range","count":17573,"what_it_means":"IP/CIDR sits inside a published AWS/GCP/Cloudflare/GitHub range — blocking would break shared cloud infra for every customer."},{"reason":"warninglist_strong_cat_review_needed","count":11466,"what_it_means":"(no description)"},{"reason":"auto_benign_single_provider","count":8503,"what_it_means":"(no description)"},{"reason":"root_domain_protected","count":5769,"what_it_means":"Indicator is a 2-label or PSL-effective registrable root (e.g. example.com itself, not a subdomain). Held back to prevent over-block."},{"reason":"bogon_address","count":1280,"what_it_means":"(no description)"},{"reason":"tripwire_popular_domain","count":1246,"what_it_means":"(no description)"},{"reason":"tripwire_popular_root","count":1084,"what_it_means":"(no description)"},{"reason":"tripwire_popular_ip","count":4,"what_it_means":"(no description)"},{"reason":"warninglist:tld-edu","count":4,"what_it_means":"(no description)"},{"reason":"warninglist:tld-gov","count":3,"what_it_means":"(no description)"},{"reason":"warninglist:vendor-os-update","count":1,"what_it_means":"(no description)"},{"reason":"warninglist:canonical-ubuntu","count":1,"what_it_means":"(no description)"}],"breakdown_by_reason_last_24h":[{"reason":"cloud_provider_asn","count":1065},{"reason":"root_domain_protected","count":1483},{"reason":"warninglist:tld-edu","count":1},{"reason":"tripwire_popular_domain","count":15},{"reason":"cloud_provider_range","count":314},{"reason":"allowlist_match","count":95},{"reason":"auto_benign_single_provider","count":235},{"reason":"feed_pending_audit_no_bypass","count":853},{"reason":"warninglist_strong_cat_review_needed","count":338},{"reason":"tripwire_popular_root","count":75},{"reason":"bogon_address","count":24}],"breakdown_by_reason_last_7d":[{"reason":"cloud_provider_range","count":9484},{"reason":"warninglist_strong_cat_review_needed","count":3632},{"reason":"auto_benign_single_provider","count":1550},{"reason":"allowlist_match","count":1341939},{"reason":"warninglist:tld-edu","count":1},{"reason":"tripwire_popular_ip","count":4},{"reason":"tripwire_popular_domain","count":1246},{"reason":"cloud_provider_asn","count":11635},{"reason":"bogon_address","count":390},{"reason":"root_domain_protected","count":2274},{"reason":"feed_pending_audit_no_bypass","count":86408},{"reason":"tripwire_popular_root","count":1083}],"allowlist_anchors":{"cloud_provider_cidrs":15645,"tranco_top_domains":124376,"umbrella_top_domains":29790,"seed_curated":12},"cloud_range_index":{"intervals_in_memory":15645,"last_rebuilt_age_ms":395409,"last_rebuilt_at":"2026-09-20T10:54:10.376Z","rebuild_ttl_minutes":5,"refresh_schedule":"daily via tihub-maint queue (cloud-ranges-refresh)","providers":["aws","gcp","cloudflare","github"]},"cross_validation":{"what_this_is":"Random sample of shipped IOCs proving each meets its tier criteria. Verified IOCs must show ≥2 distinct sources OR enrichment-confirmation OR honeypot-confirmation. Trusted IOCs must show single-source from a strict T1 feed (USOM, CERT.pl, Spamhaus DROP, abuse.ch Feodo low-FP).","cadence":"daily via tihub-maint queue (xvalidate)","last_run":{"ran_at":"2026-09-19T10:58:04.283Z","total_sampled":700,"total_pass":554,"total_fail":146,"pass_rate_pct":79.14,"per_tier":{"verified":{"sampled":400,"pass":400,"fail":0},"trusted":{"sampled":300,"pass":154,"fail":146}},"fail_examples":[{"tier":"trusted","type":"domain","value":"61fap.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"mcuhtf-tw.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"ab1lbfcl.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"80sdy.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"shhproxy.com","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"schooltimequiz.com","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"spnzriii.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"warmup.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"uberminer.org","reason":"not_t1_single_source","sources":["utc_cryptojacking"]},{"tier":"trusted","type":"domain","value":"sfilter.info","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"a191.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"onepercent.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"examplurlfree.tk","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"b578.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"mcyhhq-tw.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"qx1ls0ir.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"gtmk1540.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"hide2browser.asia","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"unblockfree.cf","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"freeunblockip-9webproxyvpns.tk","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"skipallproxy.co.uk","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"22n.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"5xmcnv22.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"outworld.cf","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"miaoy56.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]}],"duration_ms":9900}},"known_good_smoke_test":{"size":54,"cadence":"every 6h via tihub-maint queue (known-good-smoke)","what_it_does":"Asserts that none of a hand-curated list of must-never-block indicators (hyperscaler consoles, OS update channels, banks, e-gov, payment, CDN, package registries) ever leaks into a shipped IOC snapshot.","last_run":{"ran_at":"2026-09-20T09:22:52.445Z","total_checked":54,"leaked":0,"duration_ms":40,"leaks":[]}},"audit_trail":{"every_decision_recorded":true,"review_collection":"ReviewQueue","retention":"indefinite — no automatic deletion","anyone_can_query":"operator console at /admin (Bearer-protected)"},"notable_fp_corpora":{"2026-04-29_cloud_provider_sweep":{"finding":"8,663 IPs in our IP catalog (4.27% of 202,787) sat inside published AWS/GCP/Cloudflare/GitHub CIDR ranges.","action":"Moved to ReviewQueue with fp_reason=cloud_provider_range. Snapshot rebuild dropped them from /v1/feeds/* downloads.","reason":"Cloud IPs are mostly transient attacker VMs; permanent block of underlying range would break legitimate services.","providers_affected":{"aws":2619,"gcp":3137,"github":2904,"cloudflare":3}}}}