About ThreatTrove

What it is

24 sources are compiled in, 9 of them answer without any key, and 20 are active on this instance. Engine panels, sample feeds, blocklists and enrichment services each get their own row with a status, a note and — where the provider reports one — an engine ratio. The source catalogue lists what each one contributes; status shows what answered the last time the canary asked.

How a verdict is reached

Corroboration decides, not a sum of vendor points. Two independent authorities that say malicious convict; a single feed hit is reported as a lead, because a lone list entry is frequently a stale sample or an over-broad signature. Confidence grades agreement rather than adding points — 45% for one source, 75% for two, 88% for three, 93% for four — with a small bonus when an engine panel agrees, capped at 98.

Two rules keep noise out. Direct evidence: a feed records where a copy was served from, so only a source that examined the file (a sample repository, an engine scan, a sandbox, your own corpus) can convict on its own. Engine clearance: when every engine that ran reports zero detections over at least two slots, heuristic-only suspicion is demoted to CLEAN and the sources still flagging it are named. Sources in the intel category — DNS, RDAP, Certificate Transparency, reverse IP — enrich a report and never move the verdict.

Every result page carries a What decided this panel: the weight each evidence class contributed, what the verdict would have been if a source had missed or joined, and the structural caveats. Those counterfactuals are produced by re-running the real verdict rules, not written by hand, so they cannot drift away from the code.

Your own corpus

A label you add at /local — or a blocklist you import — is a decision about that exact indicator by the person running this instance, so it outranks every upstream feed and is shown first. That is also why it is public: entries are listed for anyone who asks. Imported feeds (MalwareBazaar's recent additions, the Feodo Tracker C2 list) land in the same table on a timer and keep their first-seen date.

What it does not do

It never uploads a file: hashing happens locally and only the digest leaves the machine. Keyless sources are free and shallow, so a miss there is no data, never safe — an unresolved indicator reads UNKNOWN on purpose. There are no accounts and no cookies.

Source code: github.com/threattrove/threattrove (MIT). API: /api. What is stored and what leaves the box: /privacy.