Method and scope
This console visualises live, third-party observations of malicious internet infrastructure. It is an analyst aid — a lens on open data — not an authoritative blocklist and not a verdict on any network operator.
Ingest
Public abuse dumps from abuse.ch Feodo Tracker and URLhaus are pulled server-side on a five minute cache window. No credentials, no user data, no outbound telemetry.
Normalise
Heterogeneous CSV and JSON records collapse into a single indicator shape: type, classification, host, port, ASN, country, malware family, first and last seen.
Score
Severity is derived from classification, upstream status and malware family. Live botnet command-and-control scores critical; unresolved or aged records decay downward.
Interpret
Attribution is registry-level, not owner-level. A hot country or ASN reflects where infrastructure is hosted — not who operates it, and not who is responsible.
Known limits
- Coverage is partial. Only what the upstream feeds publish is visible. Absence of an indicator is not evidence of safety.
- Geography is hosting, not origin. Country is resolved from network registration, so operators using foreign hosting appear there.
- Timestamps are upstream. "Last seen" reflects the reporting feed's observation, not a live probe from this application.