> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Threat Intelligence Sources

> How OneFirewall evaluates, scores, and maintains the threat intelligence sources feeding its blocklists.

## Source evaluation

New sources are evaluated on:

* **Credibility** of the maintaining organization or individual.
* **Update frequency** — checked via documentation, GitHub commit logs, or direct monitoring. Sources marked "active" with stale updates are flagged for review.
* **Data type** — IPs, domains, URLs, or file hashes.

Sources are cross-referenced against the existing database to avoid redundancy, and against other trusted feeds to validate consistency: higher overlap with trusted feeds increases confidence in a new source.

## Confidence scores

Confidence scores range from 0.1 to 0.9. Most newly added sources start around 0.2 until their track record justifies a higher score; scores are recalibrated against existing data as needed.

## Thresholds

Each source has a per-update threshold set slightly above its typical upload volume. For example, a source that consistently reports around 800 entries gets a threshold of 1000. When a source exceeds its threshold, the newest entries are retained and older ones are dropped, so updates reflect the latest data.

## Recent changes

About 40 sources were added. Database growth by risk category:

| Risk level | Growth |
| ---------- | ------ |
| Low        | +17%   |
| Medium     | +61%   |
| High       | +46%   |
| Critical   | +168%  |

One notable addition, **Anti Attacks**, has contributed over 1.5 million unique IPs since being added.

Existing sources were also reviewed: confidence values were raised for sources with validated consistency, thresholds were applied across all sources, and some previously dormant sources were reactivated after confirming compatibility with current parsing logic.

## Format support

Parsing logic was added for:

* **Compressed feeds** — `.zip` and `.gz` archives are unpacked and processed automatically.
* **Domain feeds** — a dedicated parser extracts and validates domain-based blocklists, cross-referenced with IP feeds to identify overlaps.
* **File/hash feeds** — a parser handles malicious file hashes (SHA256, MD5) and filenames from `.json` and `.txt` sources, cross-referenced with IP and domain feeds.

These additions extend coverage beyond IPv4 to domains and file-based indicators.