Probes and path scans
Repeated requests for admin paths, known vulnerable files and scanner signatures are abuse signals, not ordinary traffic.
Pattern, not one URLAbuse database
Abuse signals kept as cases, not as stray lines.
The abuse database is the part of CTIAD that holds scans, floods, credential stuffing and other protocol abuse so they can be correlated and reported.
Cases
What belongs in the abuse database.
Logins and form floods
A source that hammers a login or a form is stored as a flood, with the count and the window, not as an endless row of identical lines.
Count and windowProtocol abuse
Malformed requests, spoofed patterns and abusive connection behaviour are in scope when a protection system has already observed them.
Observed, then storedCorrelation
The same source across several signals becomes one case. That case is what scoring and later reports use.
One case, many signalsUse
Reports, not a public dump.
The abuse database exists so operators and protection systems can read a case. It is not a promise that every stored event is published on the internet.
- For CDPGuardCDPGuard detects and protects. A stored abuse case is material that protection can use.
- For reviewAn operator should be able to see source, reason and time without reconstructing them from raw logs.
- Separate from the blacklistNot every abuse case is a blacklist entry. Publication is the blacklist module’s job, after scoring.
Publication is a module.
The blacklist is how evaluated indicators are published. It does not replace this database.