How ThreatMap works — and how it stays safe

Overview

ThreatMap CTI is a defensive threat-intelligence service. It collects phishing, malware and ransomware reports from public OSINT feeds, verifies the reported URLs with an isolated scanner, maps the hosting infrastructure and curates a private antivirus signature database for BastionGuard AV.

A report is a claim made by a source, not a proof. ThreatMap separates what the source says from what the scanner observed, and should never be the only criterion used to block a site.

Data sources

Feeds are refreshed every 12 hours. Every response is size-capped while it is being received, parsed as data only, and invalid entries (private addresses, unusual ports, credentials in URLs, malformed hashes) are discarded. API keys are never shown in the interface, the API or the logs.

Active verification

Each reported URL is visited by a dedicated scanner the way a careful analyst would — and nothing more:

• No JavaScript is executed and no form is ever submitted; no cookies are kept.
• No file is downloaded: binary or attachment responses are recognised from their headers and never read.
• HTML is limited to 1 MB, analysed with a non-executing parser, with a 15-second budget and at most 5 redirects per URL.
• Observed: HTTP status, redirect chain, TLS certificate validity, issuer and age, page title, password fields, forms that send data to another domain, login wording, meta-refresh redirects and download attempts.
• Live or suspicious URLs are re-checked every 72 hours, so take-downs are reflected.

Scanner isolation

Visiting hostile sites must never expose the server, its network or anyone else. The scanner is contained by three independent layers:

1. In the code. The host name is resolved once, every returned address must be public, and the connection is pinned to that verified address — so DNS tricks cannot redirect it to internal systems. Every redirect is re-validated; only ports 80 and 443 are allowed.
2. In the network. The scanner runs in its own container network. The host firewall lets it reach only public Internet addresses on web ports; local networks, the server itself, cloud metadata services and every other port are blocked.
3. Fail closed. Every 60 seconds the scanner probes forbidden destinations at network level. If any of them is reachable it refuses to scan until the protection is restored, and no URL is marked as checked.

The scanner has no access to the database, no public port, runs as an unprivileged user with a read-only file system and no Linux capabilities, and answers only the dashboard, authenticated with a shared secret.

Verdicts & confidence

The confidence score is a heuristic built from the source and the observed signals (password form, cross-domain form, login wording, redirects, recently issued or invalid TLS certificate). It is not a probability.

Geolocation

Points on the map show the approximate location of the server hosting the content, derived from its IP address. They do not represent the location of the attacker, who often uses rented or compromised infrastructure.

AV signature review

1. Candidate. MalwareBazaar metadata (SHA-256, exact size, family) enters a review queue. Nothing is published automatically.
2. Analyst review. An analyst checks each hash from the server terminal, with direct references to MalwareBazaar and VirusTotal. There is no web interface for approvals.
3. Decision. Approve or revoke, with a reason. Every decision is recorded in an append-only audit log that cannot be edited or deleted.
4. Signature. Approved hashes become ClamAV hash signatures (SHA-256 + exact file size): a detection requires an exact file match, which keeps false positives to a minimum.

Private distribution

The signature database is not downloadable. It is written only to a private folder on the server (bastionguard-av), from which BastionGuard AV loads it:

• No HTTP endpoint serves it; the web server additionally refuses any request for signature or database files.
• Every approval or revocation rewrites it atomically, so the antivirus never reads a half-written file.
• A manifest with version number and SHA-256 checksum accompanies each release.

Data retention

Crawler data — indicators, scan results, geolocation cache and the review queue — is limited to 3 GB. When the limit is reached the crawler store is reset and collection starts again.

Approved and revoked signatures live in a separate, persistent store that is never reset: decisions are merged into it before every reset, so the antivirus database only grows with new approvals and never loses existing ones.

Public pages and exports show only the host of each URL, never paths or query strings, so tokens or personal identifiers contained in phishing links are not republished.

Platform hardening

• The public site is read-only: only GET and HEAD requests are accepted; there is no login and no administrative web function.
• HTTPS with a Let's Encrypt certificate, HSTS and strict security headers; a Content Security Policy that allows no inline or third-party scripts.
• Data from feeds and scanned pages is always rendered as plain text, never as HTML.
• Containers run as unprivileged users with read-only file systems, no Linux capabilities and resource limits; internal services sit on networks with no Internet access.
• Dependencies are pinned and verified by cryptographic hash at build time and audited for known vulnerabilities.

Privacy

The dashboard sets no cookies and uses no analytics. Map tiles are loaded by your browser from OpenStreetMap, which therefore receives your IP address. The web server keeps standard access logs for security purposes.

Limitations

• Phishing kits that build the page only with JavaScript show fewer signals, because scripts are never executed.
• Sources can be wrong: a reported URL may be legitimate or already cleaned.
• Hash signatures detect only exact copies of a file, not modified variants.
• Geolocation is approximate and refers to the hosting server.