Community reporting

Report what you have seen

Submissions are treated as claims, not facts, until something independent supports them. You get a reference number, a timestamp and a status you can check — including "insufficient evidence", which is a real and permanent outcome rather than a quiet deletion.

The observation

IndicatorA domain, URL, IPv4 address or ASN.What did you observe?Behaviour, not adjectives. Minimum a sentence.

Where observedOptional. Resolver, sensor or sector — no client identities.Evidence referenceOptional. A sandbox, ticket or public analysis link.

Observed atLeave blank to timestamp as now (UTC).

Classification

CategorySuggested ATT&CK techniqueOptional. Only pick one if the behaviour you saw supports it.

Your confidence

Publication

Do not submit personal data, client identities or anything you are not permitted to share.