{"service":"Zedmos CTI","generated_at":"2026-08-05T15:14:35.936Z","ship_tiers":{"what_this_is":"Three-tier classification of every IOC. Default firewall feed at /v1/feeds/<k>/<c>/{domains,ips}.txt = verified ∪ trusted only. Community is opt-in.","verified":240466,"trusted":846975,"community":10471357,"default_ship_total":1087441,"catalog_total":11584139,"verified_pct":2.08,"trusted_pct":7.31,"community_pct":90.39,"default_ship_pct":9.39,"criteria":{"verified":"≥2 distinct upstream sources, OR active enrichment (GreyNoise/AbuseIPDB/VirusTotal) classified as malicious, OR honeypot-confirmed, OR operator manually approved","trusted":"single-source from a strict T1 feed: USOM (TR-CERT), CERT.pl, Spamhaus DROP, abuse.ch Feodo Tracker (low-FP recommended variant)","community":"single-source from a T2-T5 feed — operationally useful as wide net but NOT independently corroborated; opt-in only at /v1/feeds/<k>/<c>/community-{domains,ips}.txt"},"by_category":[{"category":"adult_nsfw","verified":22302,"trusted":39976,"community":1151575},{"category":"adult_oisd","verified":43,"trusted":781,"community":5187},{"category":"anonymizer","verified":1863,"trusted":25976,"community":8772},{"category":"banking_trojan","verified":2299,"trusted":8371,"community":52},{"category":"botnet_cc","verified":15347,"trusted":40522,"community":29762},{"category":"bulletproof_hosting","verified":999,"trusted":625,"community":10917},{"category":"compromised","verified":2682,"trusted":247,"community":306},{"category":"cryptominer","verified":1623,"trusted":13453,"community":710},{"category":"ddos_amplifier","verified":2561,"trusted":257,"community":28},{"category":"dead","verified":112061,"trusted":504320,"community":5378740},{"category":"dynamic_dns","verified":11852,"trusted":1031,"community":20863},{"category":"exploit_kit","verified":132,"trusted":67,"community":189},{"category":"file_sha256_malware","verified":32804,"trusted":0,"community":9956},{"category":"first_seen","verified":12442,"trusted":0,"community":7063},{"category":"gambling","verified":62192,"trusted":16294,"community":507497},{"category":"hacking","verified":45504,"trusted":369668,"community":651352},{"category":"info_stealer","verified":3833,"trusted":2091,"community":3641},{"category":"iot_botnet","verified":9434,"trusted":111,"community":3257},{"category":"ja3","verified":0,"trusted":97,"community":0},{"category":"keyloggers","verified":3784,"trusted":417,"community":1624},{"category":"malware_virus","verified":108182,"trusted":555371,"community":782919},{"category":"manual","verified":0,"trusted":0,"community":2},{"category":"newly_recovered","verified":7162,"trusted":10749,"community":1486244},{"category":"newly_registered","verified":106953,"trusted":106850,"community":7702878},{"category":"parked","verified":0,"trusted":0,"community":8},{"category":"phishing","verified":63633,"trusted":623751,"community":285792},{"category":"piracy","verified":4195,"trusted":893,"community":35645},{"category":"potentially_dangerous","verified":2274,"trusted":211962,"community":12399},{"category":"ransomware","verified":13597,"trusted":12829,"community":8403},{"category":"recent_outbreaks","verified":11508,"trusted":25722,"community":4937},{"category":"scanner","verified":36359,"trusted":6251,"community":666541},{"category":"spam","verified":21,"trusted":0,"community":7},{"category":"spyware_adware","verified":374,"trusted":226,"community":251},{"category":"turkish_usom","verified":4096,"trusted":347566,"community":1154}]},"summary":{"fps_caught_total":25226504,"fps_caught_last_24h":1342,"fps_caught_last_7d":8069,"operator_rejected_as_fp":0,"operator_confirmed_block":18495},"breakdown_by_reason_total":[{"reason":"root_domain_protected","count":20880969,"what_it_means":"Indicator is a 2-label or PSL-effective registrable root (e.g. example.com itself, not a subdomain). Held back to prevent over-block."},{"reason":"allowlist_match","count":3681647,"what_it_means":"Indicator matched a manually-curated allowlist entry (Tranco top domains, Umbrella top domains, or seed list)."},{"reason":"cloud_provider_asn","count":245218,"what_it_means":"(no description)"},{"reason":"feed_pending_audit_no_bypass","count":183826,"what_it_means":"(no description)"},{"reason":"cloud_provider_range","count":108605,"what_it_means":"IP/CIDR sits inside a published AWS/GCP/Cloudflare/GitHub range — blocking would break shared cloud infra for every customer."},{"reason":"warninglist_strong_cat_review_needed","count":44312,"what_it_means":"(no description)"},{"reason":"allowlist_match_strong_cat_historic","count":19644,"what_it_means":"(no description)"},{"reason":"auto_benign_single_provider","count":8819,"what_it_means":"(no description)"},{"reason":"bogon_address","count":7557,"what_it_means":"(no description)"},{"reason":"tripwire_popular_domain","count":81,"what_it_means":"(no description)"},{"reason":"warninglist:tld-gov","count":62,"what_it_means":"(no description)"},{"reason":"tripwire_popular_root","count":32,"what_it_means":"(no description)"},{"reason":"warninglist:tld-edu","count":23,"what_it_means":"(no description)"},{"reason":"warninglist:apple-services-cidr","count":6,"what_it_means":"(no description)"},{"reason":"warninglist:public-dns-resolvers","count":2,"what_it_means":"(no description)"},{"reason":"public_infra","count":2,"what_it_means":"(no description)"},{"reason":"warninglist:canonical-ubuntu","count":1,"what_it_means":"(no description)"},{"reason":"warninglist:vendor-os-update","count":1,"what_it_means":"(no description)"}],"breakdown_by_reason_last_24h":[{"reason":"root_domain_protected","count":18},{"reason":"tripwire_popular_root","count":10},{"reason":"tripwire_popular_domain","count":10},{"reason":"cloud_provider_asn","count":733},{"reason":"cloud_provider_range","count":90},{"reason":"bogon_address","count":22},{"reason":"warninglist_strong_cat_review_needed","count":31},{"reason":"auto_benign_single_provider","count":386},{"reason":"allowlist_match","count":42}],"breakdown_by_reason_last_7d":[{"reason":"auto_benign_single_provider","count":1772},{"reason":"tripwire_popular_domain","count":81},{"reason":"cloud_provider_range","count":719},{"reason":"cloud_provider_asn","count":4580},{"reason":"tripwire_popular_root","count":32},{"reason":"warninglist_strong_cat_review_needed","count":164},{"reason":"root_domain_protected","count":132},{"reason":"allowlist_match","count":448},{"reason":"bogon_address","count":141}],"allowlist_anchors":{"cloud_provider_cidrs":15339,"tranco_top_domains":111688,"umbrella_top_domains":25090,"seed_curated":12},"cloud_range_index":{"intervals_in_memory":15339,"last_rebuilt_age_ms":1099005,"last_rebuilt_at":"2026-08-05T14:57:19.452Z","rebuild_ttl_minutes":5,"refresh_schedule":"daily via tihub-maint queue (cloud-ranges-refresh)","providers":["aws","gcp","cloudflare","github"]},"cross_validation":{"what_this_is":"Random sample of shipped IOCs proving each meets its tier criteria. Verified IOCs must show ≥2 distinct sources OR enrichment-confirmation OR honeypot-confirmation. Trusted IOCs must show single-source from a strict T1 feed (USOM, CERT.pl, Spamhaus DROP, abuse.ch Feodo low-FP).","cadence":"daily via tihub-maint queue (xvalidate)","last_run":{"ran_at":"2026-08-05T10:59:06.201Z","total_sampled":700,"total_pass":550,"total_fail":150,"pass_rate_pct":78.57,"per_tier":{"verified":{"sampled":400,"pass":400,"fail":0},"trusted":{"sampled":300,"pass":150,"fail":150}},"fail_examples":[{"tier":"trusted","type":"domain","value":"www.handanzhize.info","reason":"not_t1_single_source","sources":["cybercrime_tracker"]},{"tier":"trusted","type":"domain","value":"73j9vrmx.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"tunq.info","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"n9d8d2xp.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"05-xbox.info","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"proxxy.ga","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"1bird5v7.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"officeealestates.tk","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"tablys.tk","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"5ofnm6xp.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"rjx.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"gpt-plus.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"c9npl6v8.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"sgqhz.w26.100dns.com","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"pawz.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"123browse.info","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"okcaql03.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"creurd39.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"seatrue.tk","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"zhoz9t4t.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"pjkq59xv.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"badboyproxy.com","reason":"not_t1_single_source","sources":["utc_redirector"]},{"tier":"trusted","type":"domain","value":"mcyhdi-tw.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]},{"tier":"trusted","type":"domain","value":"chzashakbgds.com","reason":"not_t1_single_source","sources":["utc_cryptojacking"]},{"tier":"trusted","type":"domain","value":"lf3gs9xa.lol","reason":"not_t1_single_source","sources":["hagezi_nrd"]}],"duration_ms":11109}},"known_good_smoke_test":{"size":54,"cadence":"every 6h via tihub-maint queue (known-good-smoke)","what_it_does":"Asserts that none of a hand-curated list of must-never-block indicators (hyperscaler consoles, OS update channels, banks, e-gov, payment, CDN, package registries) ever leaks into a shipped IOC snapshot.","last_run":{"ran_at":"2026-08-05T14:23:32.593Z","total_checked":54,"leaked":0,"duration_ms":39,"leaks":[]}},"audit_trail":{"every_decision_recorded":true,"review_collection":"ReviewQueue","retention":"indefinite — no automatic deletion","anyone_can_query":"operator console at /admin (Bearer-protected)"},"notable_fp_corpora":{"2026-04-29_cloud_provider_sweep":{"finding":"8,663 IPs in our IP catalog (4.27% of 202,787) sat inside published AWS/GCP/Cloudflare/GitHub CIDR ranges.","action":"Moved to ReviewQueue with fp_reason=cloud_provider_range. Snapshot rebuild dropped them from /v1/feeds/* downloads.","reason":"Cloud IPs are mostly transient attacker VMs; permanent block of underlying range would break legitimate services.","providers_affected":{"aws":2619,"gcp":3137,"github":2904,"cloudflare":3}}}}