Source independence groups

Source independence groups

Corroboration — how many sources agree — is the triage signal for a corpus of 8.6 million indicators. It only means something if the sources are independent.

They are not. FireHOL’s levels are nested by construction: level1 ⊂ level2 ⊂ level3 ⊂ level4. An address in level2 is necessarily in the other three, so counting distinct sources reports one publisher as four confirmations. Your top-sources table shows 7.4M, 1.2M and 952K rows from exactly those lists. Blocklist.de’s per-service lists and the Phishing.Database variants have the same property.

Both numbers are kept: source_count answers “how many lists carry this”, group_count answers “how many independent publishers assert it”. Only the second is evidence.

Grouping preview

38 of 285 sources fall into a shared-provenance group. Everything else counts as its own independent publisher — the correct default, requiring no rule.

GroupSourcesMembers
spamhaus 5 FireHOL: spamhaus_drop.netset · FireHOL: spamhaus_edrop.netset · FireHOL: et_spamhaus.netset · Spamhaus DROP · Spamhaus EDROP
abuse_ch 21 URLhaus Recent · URLhaus Online · ThreatFox Recent · Feodo IP Blocklist · Feodo Aggressive …
emerging_threats 4 ET Compromised · ET Block IPs · ET Compromised IPs · ET FWIP rules
phishing_database 3 Phishing.Database Domains · Phishing.Database ACTIVE domains · Phishing.Database NEW today domains
sans_isc 4 SANS ISC · SANS DShield Top Attackers · DShield Block List · DShield Block
cinsscore 1 CINSscore Bad Guys

Reset cursor 






Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports
🤖 AI Copilot
⚡ AI Skills
All SkillsResolveEnrichCorrelateSummarize
🔍 Lookup & Enrich
EnrichmentsPivotLink Analysis
📚 Docs & Reports
DocumentationGenerate ReportAPIPlatforms Hub
💡 Recommendations
⚙ Automation
Operations Center
Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php
📜 Playbook
Open Response Playbook
🔗 Related Tools
Mission CommandAdvanced SearchOperations Center