Figures updated at every sync · 8 November 2026

What goes in, what comes out

The collector extracts anything that looks like an indicator from the articles of 339 sources. Most of these candidates are not threats: links to well-known sites, version numbers, Windows object names. CTI Forecast keeps only a small share.

By indicator type

Type	Candidates	Kept	Retention
CVEs	100,006	100,006	100.0%
SHA-256	54,657	59,225	108.4%
SHA-1	98,361	50,642	51.5%
MD5	43,439	32,832	75.6%
IP addresses	54,282	12,408	22.9%
Domains	558,608	3,892	0.7%
URLs	0	192	0%

Filtering rules

• Domains: removed when they belong to a crawled source, to a major service (Google, Microsoft, GitHub, CDNs…), to an institution (.gov, .edu, .gouv.fr), or when their "extension" is actually a file name (config.json, setup.exe).
• Shared platforms (workers.dev, ngrok, duckdns…): the bare domain is removed but a specific subdomain is kept, because that is the indicator.
• Windows objects mistaken for domains (ADODB.Stream, WScript.Shell): removed.

• IPs: scored by source, network operator (ASN) and corroboration. Private and reserved ranges, public DNS resolvers, CDN and big-tech addresses, cloud addresses seen only in sandbox reports, and version numbers that look like IPs are never published.
• Hashes: length and format checked, repetitive values removed.
• Sources without threat intelligence (encyclopedias, social networks, general news): ignored, except for CVEs.
• Decay: IP and URL confidence halves every 30 days without a new sighting, domains every 90 days.

Types never distributed

This data is not sold: too noisy, or personal data (email addresses).

Type	Candidates excluded
organization	200,302
email	48,624
filepath	31,291
file_executable	22,880
file_library	7,215
file_script	4,207
registry_key	4,183
ipv6	2,998
btc	2,927
file_driver	1,313