Source evaluation
New sources are evaluated on:- Credibility of the maintaining organization or individual.
- Update frequency — checked via documentation, GitHub commit logs, or direct monitoring. Sources marked “active” with stale updates are flagged for review.
- Data type — IPs, domains, URLs, or file hashes.
Confidence scores
Confidence scores range from 0.1 to 0.9. Most newly added sources start around 0.2 until their track record justifies a higher score; scores are recalibrated against existing data as needed.Thresholds
Each source has a per-update threshold set slightly above its typical upload volume. For example, a source that consistently reports around 800 entries gets a threshold of 1000. When a source exceeds its threshold, the newest entries are retained and older ones are dropped, so updates reflect the latest data.Recent changes
About 40 sources were added. Database growth by risk category:
One notable addition, Anti Attacks, has contributed over 1.5 million unique IPs since being added.
Existing sources were also reviewed: confidence values were raised for sources with validated consistency, thresholds were applied across all sources, and some previously dormant sources were reactivated after confirming compatibility with current parsing logic.
Format support
Parsing logic was added for:- Compressed feeds —
.zipand.gzarchives are unpacked and processed automatically. - Domain feeds — a dedicated parser extracts and validates domain-based blocklists, cross-referenced with IP feeds to identify overlaps.
- File/hash feeds — a parser handles malicious file hashes (SHA256, MD5) and filenames from
.jsonand.txtsources, cross-referenced with IP and domain feeds.