Not Every Provider's "Malicious" Means the Same Thing

Counting votes is the wrong model

Query an indicator against twenty threat intelligence sources and you get twenty answers of wildly different quality. The naive aggregation — count how many said malicious, divide by how many answered — treats all twenty as equivalent witnesses. They are not.

A MalwareBazaar hit means a human submitted that exact binary to a malware corpus. A GreyNoise "malicious" classification means the address scans the internet indiscriminately, which describes a large amount of background noise alongside genuine attacker infrastructure. Both are useful. They are not the same claim, and a scoring model that cannot tell them apart will produce a confident verdict from a weak signal.

What we weight and why

IntelStack assigns each provider a weight, and those weights are visible in the source rather than buried in a model nobody can inspect. Multi-engine and curated-corpus sources outrank single-signal ones:

VirusTotal        30      Multi-engine aggregate
MalwareBazaar     30      Someone submitted the binary
Hybrid Analysis   28      Behavioural detonation result
AbuseIPDB         25      Curated abuse reports
URLhaus           25      Curated malware distribution URLs
ThreatFox         25      Curated IOC corpus
CrowdSec CTI      20      Community-observed attacks
urlscan.io        18      Observed page behaviour
Pulsedive         18      Aggregated risk assessment
AlienVault OTX    15      Community pulses, variable quality
GreyNoise         12      Internet-wide scanning behaviour
Shodan             8      Exposure surface, not reputation

The thresholds matter less than the ordering. What the table encodes is a claim about evidence strength that anyone can disagree with — and disagreeing with a number you can see is the point.

Enrichment is not corroboration

The subtler mistake is counting context as evidence. IPinfo tells you an address is in Frankfurt on a particular ASN. Shodan InternetDB tells you which ports answer. Neither is a reputation judgement, and neither should move a verdict in either direction.

Both used to return Clean in our scanner. That put a green badge next to a plain geolocation lookup — an interface asserting an indicator was assessed and found safe, when all that had happened was somebody looked up where it lived.

They now return Info: blue, unscored, and explicitly excluded from the coverage figure. If eight providers answered and two of them were enrichment, coverage is six, because coverage is what confidence means and enrichment does not corroborate anything.

Three greys, one meaning

Our verdict palette uses grey for three distinct non-findings, and they are deliberately not given separate colours:

Unlisted — the provider answered and holds no record. Unconfigured — we have no credential, so the provider was never asked. Unknown — the indicator has not been assessed.

They are distinguished by their label, not their hue, because none of them is a finding and none of them should draw the eye. The temptation to "improve" this by giving each one its own colour is the temptation to make absence look like information.

Coverage is a claim about us, not the indicator

Our catalogue lists 88 integrations. The scanner has twenty clients. Any provider we cannot actually scan with renders a "Not scanned" badge, so a connected integration can never imply coverage it does not provide.

That distinction sounds pedantic until you are the analyst deciding whether a clean result means the indicator is clean or means nobody looked.