xfeeds: an independence-aware public threat intelligence feed

Abstract

xfeeds is a self-updating, open threat intelligence pipeline that collects, normalizes, enriches, scores, filters, and publishes malicious-IP indicators in CSV, JSON, STIX 2.1, MISP, and firewall rule sets. A GitHub Actions pipeline targets six-hour refreshes and publishes a dashboard through GitHub Pages; scheduling is best-effort. Most public blocklists mirror or re-derive one another. xfeeds models that dependency explicitly: Independence classes. Only the strongest contribution within each source family counts, so mirrored lists cannot vote twice. Freshness gating. Successful fetches do not establish evidence freshness. Stale evidence cannot admit records; expired or dormant evidence casts no vote. Redistribution-aware tiering. Restricted sources may corroborate already-admitted records without exposing restricted source identities in public records. Primary, noncommercial, and clean-provenance tiers preserve distinct redistribution terms. Conservative admission. Publication normally requires two fresh redistributable classes. Configured, verified Spamhaus DROP sources have a single-source promotion exception. Benign-scanner evidence caps confidence rather than deleting records. This deposit archives software, not a feed dataset. Generated feeds, the legacy dataset, and recorded upstream-response fixture payloads are excluded. The MIT licence covers the software. For the complete fixture-based test suite, use the corresponding GitHub tag. Design decisions, source methodology, and licence research are recorded under docs/.