Choosing Open IP Threat Intelligence—The Best Stack for July 2026 and Its Measured Cut Line

1 What to connect now: SOSEC's default public-intelligence stack

The answer: a new IP-intelligence program should start with Spamhaus DROP/DROPv6 and the last three days of ThreatFox botnet_cc. DROP owns malicious network ranges at the perimeter. ThreatFox owns precise outbound C2 decisions by IP:port and domain. Keep Feodo recommended connected while treating its current effective-rule count as zero. Add DataPlane only for protocols actually exposed on an Internet-facing service, use DShield Top 20 for observation and throttling, and reserve GreyNoise Community for analyst lookups. MISP can manage the evidence. Aggregate mega-lists receive no default blocking authority. The offline replay compiled 1,760 DROP prefix objects and 3,204 high-confidence recent ThreatFox objects; the old Feodo row, DataPlane, DShield, FireHOL, and IPsum received zero unconditional deny rules.

The stack is intentionally thin. Each source performs the job supported by its strongest evidence. DROP covers network space under malicious operational control. ThreatFox carries malware family, IOC type, confidence, and time into an outbound rule. Feodo waits for a valid protocol response from a C2 before a rule becomes active. DataPlane and DShield describe inbound activity. GreyNoise helps an analyst identify broad scanning and known business services. Clear ownership gives every address a clock, a decision maker, and a removal path.

The required layer has two active data lines. DROP/DROPv6 is the strongest freely obtainable network-range product for direct router and firewall enforcement in this market. ThreatFox is the most useful broad public-community source for current malicious infrastructure. Production use should narrow its official API or export to recent botnet_cc records while preserving port, domain, confidence, first_seen, last_seen, and is_compromised. Flattening the six-month export into a permanent IP list discards the structure that makes the product useful.

Feodo is the third line: connected and currently issuing no rules. Its design is unusually strong. An address enters the recommended list only after it returns a valid botnet C2 response; files are generated every five minutes; the data is CC0. The official FAQ currently says law-enforcement takedowns have left the datasets empty. SOSEC's July 25 07:00 UTC pin of the recommended text still contained one address last updated on March 4. A production system should accept a format-valid empty set, quarantine that stale state-conflicting record, and resume automatically when the official status and endpoint agree again.

Inbound attack-source feeds get lighter actions. A raw DataPlane file describes itself as “informational” and “not a block list,” then warns about NAT, source spoofing, and research measurement. It fits alerting, connection throttling, or challenges on a matching exposed service such as SSH or SIP. DShield block.txt contains the 20 most active /24 networks over three days. Fourteen of the 20 in our snapshot intersected the scanner control set, and the list directly included Google Cloud, Internet-measurement, and security-scanning organizations. The feed quickly shows where volume is coming from. An Internet-wide, all-protocol hard block assigns far more force than the observation supports.

1.2 Three deployment profiles

A small team's minimum stack is DROP/DROPv6, ThreatFox recent botnet C2, and Feodo recommended on standby. Connect the official ThreatFox interface when its terms cover the present use. If commercial use requires the enhanced API, buy the appropriate access or benchmark a commercial C2 product. Relabeling a community mirror as a permanent free substitute loses license clarity, structured fields, and service accountability.

An Internet-service operator adds one DataPlane or blocklist.de signal that matches an exposed service, runs it in shadow for seven days, and then decides whether throttling or challenge is justified. DShield Top 20 highlights large scanning concentrations; GreyNoise samples the identities behind them. Web registration, forum, and account abuse may also use StopForumSpam, AbuseIPDB, or HTTP:BL as application-level scores and challenge inputs.

A mature SOC uses MISP to preserve events, attributes, tags, source, decay, and sharing scope. Enforcement devices still subscribe only to narrow sets that passed the action gate. FireHOL, IPsum, Bitwire, Data-Shield, malicious-ip, and historical C2 products stay in hunting and source-research collections. MISP is this study's preferred open-source management platform; feed quality remains an editorial and operational decision.

2 Why this stack wins: match products to actions before comparing coverage

“Best” needs an assigned job. Spamhaus DROP/DROPv6 wins for network-range enforcement at the edge. ThreatFox recent is the first choice for current, broad public-community malicious infrastructure. Feodo recommended wins among free C2 products that validate protocol response, with zero current coverage. DataPlane is the clearest protocol-specific Internet-edge observation product. GreyNoise wins for scanner-context lookup. MISP is the open-source intelligence-management choice. FireHOL is the strongest public aggregate catalog. A single league table would erase the uses that make each winner valuable.

DROP wins on action semantics and removal. Spamhaus defines the objects as network space controlled by professional spam or cybercrime operations, advises dropping all traffic, and ties records to removable SBL entries. The pinned snapshot's 1,669 distinct IPv4 prefixes cover about 14.9 million addresses, a manageable footprint, and the publisher reviews the product daily. This is an edited network-range decision with a clear operational owner.

ThreatFox wins on breadth and structure for current public C2. Among 3,332 botnet C2 records in the pinned recent CSV, 2,400 preserve IP and port and 3,032 carry last_seen. Consolidation before the confidence gate yields 1,741 distinct IPv4 addresses, including 169 inside DROP ranges. The production compiler then applies confidence_level >= 75 and the 72-hour clock, yielding 1,686 distinct IPv4 addresses: 167 inside DROP and 1,519 outside it. Roughly nine out of ten extend coverage beyond DROP's host population. The low overlap follows the jobs: one line assesses whole-network control; the other describes a specific malware communication endpoint.

Feodo wins on validation design and currently provides no active coverage. It tracks a defined group of botnet families and requires a valid C2 response from an address. Successful takedowns should therefore produce an empty list. Organizations that need broad, verified live C2 still have a procurement gap. Feodo's FAQ points readers to Spamhaus BCL, a commercial or partner-distributed product. Today's public free market has no single C2 IP file combining broad coverage, active validation, unrestricted commercial consumption, complete removal, and anonymous access.

Inbound attack data wins an observation and traffic-management role. DataPlane spans more than 300 nodes, 65 metropolitan areas, and six continents, with separate files for SSH, SIP, DNS, and other behavior; it also warns consumers about the interpretation boundary. DShield compresses worldwide reports into an operational Top 20 /24. That convenience can carry cloud, research scanning, and hostile traffic together. Both products help defend the services that generated the observation. Cross-protocol permanent blocking exceeds their evidence.

2.1 Five admission questions turn reputation into executable evidence

A source earns a place in the default stack by answering five questions in order: what behavior did it see; where did it see it; when was the record last valid; who removes an error; and what action will a hit trigger? DROP, ThreatFox, and Feodo answer most of these within their narrow scopes. DataPlane and DShield perform well on behavior and time, so their action stops at observation, throttling, or challenge. GreyNoise Community provides per-IP query capacity and belongs at the analyst desk.

License and redistribution rights are admission criteria. Spamhaus DROP is free across organization sizes and business types under attribution and product-marketing restrictions. Feodo uses CC0. DShield's general feed documentation permits commercial use with attribution and no resale, while the current block.txt header cites CC BY-NC-SA 2.5; commercial deployment requires written clarification. ThreatFox Community is free under fair-use conditions, while commercial use may require a paid API. DataPlane raw signals are free only for noncommercial use. “Publicly downloadable” describes access; the current terms determine production rights.

2.2 Four hits on the same day should produce four different decisions

Start with a high-confidence ThreatFox record. An employee endpoint is connecting to a botnet_cc IP:port that was still active forty minutes ago. The network control rejects only that outbound destination and port, EDR isolates the originating endpoint, and the SOC follows the domain, process, DNS, and related traffic. The rule expires automatically after 72 hours and leaves immediately if the publisher withdraws it sooner. The hit connects directly to malware communication, with direction, port, time, and affected asset all known, so it can support a strong action.

At the same time, an Internet-facing service receives probes from a DShield Top 20 /24, and DataPlane has observed that source against the matching protocol. The service raises the cost only where the scanning occurs: throttle SSH, challenge a login, or temporarily block the individual source IP while preserving the session. If the /24 collides with a known research scanner, the analyst checks GreyNoise, the scanner's official identity, and the local request. Agreement between two feeds strengthens the finding of scanning activity; it leaves the rest of the /24, other protocols, and outbound traffic outside the action.

A third hit falls inside a DROP prefix. The edge rejects the network range bidirectionally and records the product version plus the SBL-linked withdrawal path. If pre-deployment negative controls show that a real customer path traverses the range, the change pauses while the network team confirms CDN, proxy, or partner routing. DROP's editorial semantics support the strong action, and the negative control exposes this organization's exceptional cost. Hit count has no role in that decision.

The fourth update comes from Feodo: identity, format, and time checks pass, and the product delivers an empty set. The system publishes zero rules, records a successful update, and declines to restore the old March address. Operations can see that takedown feedback has reached the control plane. All four decisions use the same rule: identify the object and behavior carried by the evidence, then assign a proportionate action. Source count adds confidence only when behavior, direction, and time also agree.

2.3 From frozen snapshot to deployable policy: offline compilation and fault replay

This experiment answers an engineering question: what reaches the enforcement plane after a frozen delivery passes identity, format, clock, action, and control-set gates? The inputs are eight product artifacts, ten official public-network controls, and one commit-pinned scanner control. Each artifact first passes byte-count and SHA-256 verification, then compiles into the direction, protocol, action, and TTL proposed by this report. Public-cloud, service-range, crawler, and scanner collisions indicate deployment risk. Threat-detection precision, recall, and business false-positive rate require independent local traffic and adjudicated labels, so this replay leaves those measures open.

The replay anchor is the timestamp published in the ThreatFox artifact: 2026-07-25 07:30:48 UTC. DROP validation checks every JSON object, cidr, sblid, and the metadata record count. ThreatFox requires 15 fields per row before the botnet_cc, confidence 75, and max(first_seen,last_seen) 72-hour gates. Feodo, DataPlane, DShield, FireHOL, and IPsum are normalized through their pinned formats. “Compiled output” in the table records the objects granted policy authority; raw list size remains in the input column.

The collisions explain why repeated appearance across lists cannot automatically strengthen an action. ThreatFox contributes 1,519 enforcement-layer IPv4 addresses outside DROP, while 167 are already inside it, giving the source a clear marginal role. IPsum's 13,061 scanner-control collisions and DShield's 66.43% coverage collision show that both products carry substantial scanner semantics suited to inbound context and traffic management. Addresses in Cloudflare, AWS, Google, or GitHub ranges may host a malicious tenant or legitimate service. Session, port, asset, and adjudicated outcome determine the final label.

The fault replay executed six input cases and passed all six. A changed pinned hash, an HTTP 200 HTML body, truncated DROP NDJSON, ThreatFox field drift, and timestamp regression were rejected; none of those five candidates changed the active generation. A current, valid empty set was accepted and compiled to zero rules. Four lifecycle checks then passed: a DROP candidate that cleared format and hash gates became active before an injected deployment-health failure restored the previous generation; one hour after a ThreatFox refresh failure, 3,204 rules remained active, and advancing beyond every object's 72-hour deadline reduced the set to zero; DROP switched from automatic retention to operator decision at hour 48; and the March Feodo row could not replace the accepted empty generation. Retrieval, parsing, compilation, expiry, and rollback now form an executed closed path.

This extension establishes a reproducible cross-sectional measurement and deployment-gate replay. Blocklist Babel used six months of repeated collection to study record survival, overlap evolution, and propagation, showing why a one-day union cannot carry those longitudinal claims. A publishable effectiveness study still needs a preregistered 90-to-180-day experiment: fixed collection cadence and missing-sample handling; the same candidates at an ISP, an ordinary enterprise, and a cloud-hosting operator; event labels stratified by asset class and action; time to first correct hit, unique correct incidents per million connections, legitimate impact, removal survival, and analyst labor; and paired bootstrap confidence intervals over shared events. Longitudinal truth would support conditional precision, recall, and operating-cost comparisons. The current table supplies the frozen inputs, compilation rules, negative controls, failure model, and evidence boundary required to run that study.

3 What the census covered: 503 catalog records narrowed to 105 parseable datasets

The census began by merging MISP default feeds, the FireHOL catalog, Maltrail configuration, the Bert-JanP catalog, and manual additions, producing 503 candidate records. Consolidating aliases of the same file, format copies, and explicit mirrors left a delivery surface of 332 endpoints or files, including 318 HTTP URLs. Candidates cover routing governance, current C2, attack sources, honeypots, community reports, anonymity networks, scanners, cloud and service ranges, aggregators, legacy projects, and adjacent products centered on domains, URLs, certificates, or samples.

The fixed measurement selected 130 distinct network URLs, made 133 requests across initial retrieval, URL correction, and retries, and read six commit-pinned local repository files. Network requests returned HTTP 200 on 109 attempts; authentication, 404, rate limit, transport, or other failures ended 24. Three successful responses delivered a login page, terms page, or redirect HTML. The 99 parseable network IP datasets plus six local files produced 105 experimental datasets.

The cohort intentionally includes direct products, format mirrors, aggregators, control sets, dead endpoints, and the long tail, so it can answer how market data is copied, ages, and collides with policy. It is a purposive sample of the 318 URLs. Retrieval success describes this queue on this date. Selection rules, request receipts, hashes, and research time bind the result.

3.1 Eight address classes carry eight meanings

Routing-level malicious ranges describe network control. Current C2 describes destinations used by infected hosts. Service attack sources describe time-bounded behavior against a protocol. Community reports describe submissions and scoring. Aggregators describe a composition of upstreams. Tor, VPN, and proxies describe anonymity. Scanners and crawlers describe identity and measurement behavior. Cloud, CDN, public DNS, and bogon data describe infrastructure or routing context. The class determines direction, port, TTL, and action.

Mirrors, format conversions, and time-window files retain delivery value, while evidence votes are counted at the root observer. Feodo CSV, JSON, and text are one product. Official ThreatFox data and a GitHub mirror share a root. FireHOL levels combine several lists. An IPsum threshold may consume aggregated upstreams again. Preserving lineage tells the consumer whether five hits represent five observers or one observation copied five times.

4 The real structure of mega-lists: one-third duplicated membership and four-fifths single-source addresses

After per-source deduplication, 99 datasets containing exact IPv4 produced 8,433,954 membership observations and a union of 5,702,621 addresses. The 2,731,333 memberships beyond the union create a 32.38 percent duplicate rate. Within the union, 4,695,398 addresses appear in one dataset, or 82.34 percent, while the maximum frequency is 37. Concatenation spends rules and analyst time on copies; a two-list vote discards most unique observations.

Purpose-specific cohorts tell more. Nineteen current aggregate datasets contain 1,286,587 memberships and an 806,156-address union, for 37.34 percent duplicates. Eight current C2 datasets show only 12.53 percent duplicates and 88.59 percent singletons. The attack-source cohort has a 38.44 percent duplicate rate; current outbound aggregates reach 50.89 percent. A rare C2 address may be new or may come from one weak source. High consensus in an aggregate cohort often reflects shared upstreams.

IPInsights' 651,035 exact addresses completely contain IPsum L1, L2, and L3; IPsum L3 and OpenDBL IPsum are identical in the snapshot. Of 173,859 exact IPv4 addresses in Bitwire outbound, 158,817 also occur in inbound, a 91.35 percent containment. Product names, direction labels, and download URLs can make the independent information look much larger than it is.

4.1 Popular projects that leave the default blocking path

FireHOL is the best public list catalog and aggregate-research entrance. Level 1 combines fullbogons, Spamhaus DROP, DShield, Feodo, and other sets with different meanings, which makes a useful lab starting point. Among 149 pinned child lists, 50 source files were more than a year old and 14 declared that the upstream could no longer be retrieved. Production work should recover the child sources. The FireHOL composite belongs in research and compatibility.

IPsum is useful for investigation ranking. It turns the number of input appearances into L1 through L7 thresholds and is transparent, active, and easy to automate. Counts grow when the same root data travels through multiple aggregators. In this snapshot, 32.24 percent of L2 and 37.79 percent of L3 intersected the scanner control set. A higher level frequently means “many lists saw scanning,” which remains separate from all-protocol maliciousness.

Bitwire, Data-Shield, and large malicious-ip collections are shadow-evaluation material. Bitwire inbound contains 3.82 million exact addresses; 12.59 percent fall inside published AWS ranges, and 99.986 percent of the scanner control set is touched. Data-Shield's critical/full containment direction runs against the intuitive names. malicious-ip preserves source mapping, which improves engineering transparency. These products can generate hunting clues and throttle candidates. Their complete output stays disconnected from default deny.

Recent C2, PacketsDatabase, and cumulative historical sets move to quarantine or hunting. Of Recent C2's 15,355 addresses, 42.54 percent fall in AWS ranges, and its thirty-day Git difference showed additions without removals. PacketsDatabase claims half-hourly updates while the pinned data file had gone about 158.6 days without a change and still contained public DNS. Feodo aggressive, Fox-IT historical Cobalt Strike, permanent append-only sets, and 90/365-day abuse collections retain retrospective value. A product name containing “recent” or “C2” cannot supply missing lifecycle evidence.

5 Freshness has four clocks: observation, last seen, publication, and local activation

An IP's risk changes across four clocks. Event time records when behavior occurred. last_seen records when the publisher most recently confirmed it. Publication time records when the file or API delivered it. Local activation records when the rule actually began enforcement. A new Git commit advances the third clock and leaves an old observation old.

Eight projects with readable Git history show the difference. At 2026-07-25 07:39:33 UTC, the most recent data change in ShadowWhisperer Threats was about 0.66 hours old, Data-Shield 1.56 hours, the ThreatFox mirror 1.81, Bitwire 2.68, ReportedIP 3.01, ziyad 3.18, and Recent C2 18.65. PacketsDatabase reached 3,806.52 hours. Commit cadence finds abandonment; content additions and removals show whether the list still breathes.

Churn exposes lifecycle quality. In one day the ThreatFox mirror added 56 and removed 248; over 90 days it added 6,739 and removed 15,639. Data-Shield added 1,860 and removed 1,766 in one day. Recent C2 added 334 and removed zero over thirty days. Regular removal shows that remediation, takedown, and reassignment can reach the published product. A set that only grows naturally becomes history.

5.1 TTL follows the object, and a valid empty set is a successful delivery

DROP prefixes follow the publisher's daily review and leave local policy with the official record. ThreatFox IP:port and domain records stay for 72 hours after recent activity. Feodo recommended consumes current active objects. DataPlane inbound observations live for one to seven days. Community reports and registration abuse begin with a seven-to-thirty-day shadow window. Historical samples remain available in the hunting store. A single 30-day TTL would keep short-lived cloud addresses too long and delete routing-governance records too early.

An empty list, a failed retrieval, and a failed parse have different outcomes. An identity-, format-, time-, and count-valid empty list publishes zero rules. A 404, login HTML, truncation, or a parser that suddenly accepts zero rows enters quarantine. Feodo's current state adds a status/content conflict: retain the receipt, quarantine the old address, and wait for agreement between the service status and endpoint.

6 False positives happen at the action: the same observation can carry radically different cost

“This address scanned SSH” can be accurate. Turning that observation into a permanent bidirectional all-protocol block creates a policy error. DShield narrowed its snapshot to the 20 most active /24 networks, yet 14 intersected the third-party scanner control set. Before threat-type, confidence, and time filtering, ThreatFox official recent contained 1,924 exact IPv4 addresses; 38 fell in AWS ranges, 18 in GitHub service ranges, and 14 in Google Cloud ranges. The production compiler reduces those figures to 1,686, 35, 16, and 14. These addresses can host a real malicious tenant or a compromised machine. Exact ports and short TTLs reduce the blast radius.

Large aggregators amplify these collisions. Across all exact-address datasets, the experiment counted 738,407 cloud-range memberships, 173,403 known-service memberships, 89,223 shared-service memberships, 242,090 scanner-control memberships, and 810 crawler memberships. IPInsights and the stale PacketsDatabase exactly included 1.1.1.1, 1.0.0.1, 8.8.8.8, and 8.8.4.4; a yearly TweetFeed range covered 9.9.9.9. A public-DNS hit vetoes default blocking. Cloud and scanner hits require tenant, port, and local-session context.

6.1 Five action tiers turn a list hit into a business decision

Direct block accepts governed ranges such as DROP and validated outbound C2 still inside its validity, with direction, port, and asset group narrowed wherever possible. Throttle or challenge accepts inbound attack sources, registration abuse, anonymity exits, and high-risk community signals. Alert or enrich accepts historical C2, shared-cloud addresses, new single-source observations, and aggregates. Context only retains Tor, VPN, scanner, crawler, cloud, ASN, and geography identity. Quarantine catches unclear licenses, HTML masquerading as data, abandoned sources, format breaks, unknown lineage, and abnormal control collisions.

Run every new source in shadow for seven to thirty days. Record hits per million connections, asset and port, session result, confirmed incident, legitimate subject, analyst minutes, removal latency, and rule cost. A source leaves production after thirty days without a unique correct event, with only duplicate alerts, or with continuously rising exceptions. Blocking value is measured against resolved events and net business harm.

7 Choosing institutions and platforms: assign responsibility for observation, validation, removal, and delivery

An institution's value begins with visibility and is realized by the work that follows. Direct observers operate honeypots, sinkholes, scanners, sandboxes, mail traps, or endpoint telemetry. Specialists validate malware family and infrastructure. Distributors maintain APIs, formats, and withdrawal. Coordinators send findings to network owners. Platforms preserve relationships, access, and decay. Commercial services add private telemetry, SLAs, and support. Procurement should confirm each responsibility explicitly; brand size provides context only.

The preferred public professional-infrastructure pairing is Spamhaus plus abuse.ch. Spamhaus takes editorial responsibility for network ownership, routing-level malicious ranges, and removal. abuse.ch connects community submissions, samples, C2, and takedown state through ThreatFox, Feodo, URLhaus, and MalwareBazaar. They cover different vantage points with relatively clear interfaces, terms, and product boundaries. SANS ISC/DShield and DataPlane contribute Internet-edge observation. Shadowserver's distinguishing value is large-scale measurement, reporting to network owners, and remediation feedback.

MISP is this study's preferred open-source TIP. It stores events, attributes, tags, root source, sharing scope, warninglists, and decay models, and it can carry the action and TTL fields used here. A small team with two or three enforcement lines can use a lightweight database and versioned sets. Multi-community sharing, analyst collaboration, event relationships, and access control justify MISP. Its default-feed catalog is a discovery entrance, with upstream quality decided separately.

GreyNoise is the preferred scanner-context analysis service. The Community API can review individual high-value hits; its free quota is too small for bulk enrichment. Shodan, Censys, Rapid7 Sonar, and other measurement organizations should enter the control set through their official scanner identities, reverse DNS, and opt-out material. A scanner address may also host a compromised instance, so the current behavior still governs the action.

7.1 Commercial procurement fills the gaps the public market actually leaves

The public stack leaves three clear gaps: broad and continuously validated live C2, private DNS/endpoint/email telemetry across regions, and dependable bulk delivery with support. A commercial product is sensible when the program needs these capabilities. Feodo's official FAQ recommends Spamhaus BCL for broader active C2. Other commercial providers can enter the candidate pool and face the same blind benchmark.

Give every candidate the same historical traffic and adjudicated incidents, hide the brand, and compare time to first correct hit, unique correct events, duplicate noise, shared-infrastructure harm, publication latency, removal time, analyst labor, and cost per useful incident. Then review data rights, regional coverage, privacy, SLA, exit export, and incident notification. Address count and claims of global visibility describe capacity; the benchmark decides value.

8 A thirty-day release: let each source earn stronger action

The production chain can stay short: quarantined retrieval, schema checks, lineage consolidation, clock calculation, control collision, shadow operation, action-specific publication, and continuous withdrawal. Every stage emits a version, count, and reason code. An operator can trace a hit to its root observation and download artifact, or disable every downstream rule from one source.

1. Days 1–3: register official DROP, ThreatFox, and Feodo endpoints, terms, formats, cadence, and owners. Build negative controls for owned addresses, critical SaaS, partners, cloud, authorized scanning, and public DNS. Prepare two known-good versions and a per-source circuit breaker.
2. Days 4–10: verify DROP prefix additions, removals, and rollback on a pre-production gateway. Send ThreatFox, Feodo, DShield, and one service-specific signal to logs only. Confirm that valid C2 test traffic hits and that essential business paths, health checks, and authorized scanners remain available.
3. Days 11–20: activate DROP at the edge; issue 72-hour rules for high-confidence ThreatFox IP:port and domain records; promote inbound signals only to throttling or challenge. Review new rules, withdrawals, business exceptions, update failures, and unique source contribution each day.
4. Days 21–30: use resolved incidents and real traffic to calculate hits per million connections, correct and unique incidents, legitimate impact, analyst minutes, and withdrawal latency. Remove sources with no contribution or growing harm, then schedule the next quarterly retest.

8.1 A one-page decision ledger beats a decorative total score

Keep three layers of evidence for each source. Observation records sensor, behavior, direction, port, validation, first_seen, and last_seen. Distribution records root source, mirror, conversion, license, format, publication delay, and removal. Decision records local asset, action, hit, exception, rollback, and owner. License, action semantics, and time integrity are hard gates; a missing gate holds the source in enrichment or quarantine.

After the gates, score evidence strength from zero through four: missing, publisher assertion, pinned sample, historical measurement, and sustained local result. Compare scores only among candidates for the same job. Control collision, rights, and the business owner retain veto power. Dashboards should lead with unique correct incidents, publication delay, removal delay, legitimate impact, and investigation cost. Address count is a capacity measure.

9 Evidence boundary and final answer

The intersection and union analysis covers 99 datasets with exact IPv4; CIDR coverage is measured separately, and IPv6 lacks a comparable experiment. Control collisions reveal policy risk and can include a truly malicious cloud tenant, a compromised service, legitimate measurement, or copied upstream data. Each organization needs session evidence, asset context, adjudicated incidents, and remediation outcomes for a real false-positive rate. Git measurements pin file-publication history and cannot reconstruct every record's sensor time.

The public research ledger (JSON) pins the census boundary, retrieval result, set analysis, control collisions, freshness observations, product choices, policy compilation, fault injection, and exit logic. Its SHA-256 is ACDC5CDA52D55101F50075C572C28AED3BB387BC2362A74A12B17BC389D03D29. The ledger publishes sanitized aggregate evidence only; potentially malicious addresses, downloaded bodies, credentials, raw responses, and private traffic remain in ignored research storage.

The highest-value next study is a 90-to-180-day repeated pull of the same endpoints with local truth from an Internet service provider, an ordinary enterprise, and a cloud-hosting operator. It should extend IPv6, DNS resolution chains, and certificate relationships. A source that consistently discovers more unique correct incidents sooner, removes records faster, and produces less legitimate impact can challenge the category winners named here.

9.1 Closing: the current best stack is ready for a change ticket

As of 2026-07-25, SOSEC's recommendation is explicit: Spamhaus DROP/DROPv6 blocks malicious network ranges at the perimeter; high-confidence botnet_cc from ThreatFox recent controls outbound IP:port and domain for 72 hours; Feodo recommended stays connected and currently publishes zero rules; DataPlane and DShield drive alert, throttle, and challenge on matching inbound services; GreyNoise Community supports selected analyst lookups; MISP becomes the open-source management platform when collaboration requires it.

FireHOL is an excellent catalog, IPsum a useful consensus signal, Bitwire and Data-Shield high-coverage research material, and Recent C2 plus cumulative history useful for hunting. They stay outside default deny. Organizations that need broad verified live C2, private telemetry, or delivery guarantees should spend budget on a commercially licensed product that wins a local blind benchmark. This gives a reader the sources to choose, actions to write, TTLs to set, shadow period to run, and popular list classes to keep away from enforcement.