Web3 Threat Tracker v2026.07.09

Daily release of Web3 threat intelligence data.

Lookup-feed assets for SIEM ingestion (CrowdStrike NG-SIEM / Splunk):

• malicious_only.csv — all MALICIOUS-severity domains (the standard block/alert feed)
• high_confidence.csv — only entries corroborated by 2+ sources (confidence = HIGH, lowest false positives)
• all_domains.csv — full dataset; filter on severity/confidence in-query
• web3_tracker.db — SQLite (indexed on domain) for local enrichment lookups

domain is the first column in every CSV. See stats.json for the dataset summary.

Web3 Threat Tracker v2026.07.08

Daily release of Web3 threat intelligence data.

Lookup-feed assets for SIEM ingestion (CrowdStrike NG-SIEM / Splunk):

• malicious_only.csv — all MALICIOUS-severity domains (the standard block/alert feed)
• high_confidence.csv — only entries corroborated by 2+ sources (confidence = HIGH, lowest false positives)
• all_domains.csv — full dataset; filter on severity/confidence in-query
• web3_tracker.db — SQLite (indexed on domain) for local enrichment lookups

domain is the first column in every CSV. See stats.json for the dataset summary.

Web3 Threat Tracker v2026.07.07

Daily release of Web3 threat intelligence data.

Lookup-feed assets for SIEM ingestion (CrowdStrike NG-SIEM / Splunk):

• malicious_only.csv — all MALICIOUS-severity domains (the standard block/alert feed)
• high_confidence.csv — only entries corroborated by 2+ sources (confidence = HIGH, lowest false positives)
• all_domains.csv — full dataset; filter on severity/confidence in-query
• web3_tracker.db — SQLite (indexed on domain) for local enrichment lookups

domain is the first column in every CSV. See stats.json for the dataset summary.

Web3 Threat Tracker v2026.07.06

Daily release of Web3 threat intelligence data.

Lookup-feed assets for SIEM ingestion (CrowdStrike NG-SIEM / Splunk):

• malicious_only.csv — all MALICIOUS-severity domains (the standard block/alert feed)
• high_confidence.csv — only entries corroborated by 2+ sources (confidence = HIGH, lowest false positives)
• all_domains.csv — full dataset; filter on severity/confidence in-query
• web3_tracker.db — SQLite (indexed on domain) for local enrichment lookups

domain is the first column in every CSV. See stats.json for the dataset summary.

Web3 Threat Tracker v2026.07.05

Daily release of Web3 threat intelligence data.

Lookup-feed assets for SIEM ingestion (CrowdStrike NG-SIEM / Splunk):

• malicious_only.csv — all MALICIOUS-severity domains (the standard block/alert feed)
• high_confidence.csv — only entries corroborated by 2+ sources (confidence = HIGH, lowest false positives)
• all_domains.csv — full dataset; filter on severity/confidence in-query
• web3_tracker.db — SQLite (indexed on domain) for local enrichment lookups

domain is the first column in every CSV. See stats.json for the dataset summary.

Web3 Threat Tracker v2026.07.04

Daily release of Web3 threat intelligence data.

Lookup-feed assets for SIEM ingestion (CrowdStrike NG-SIEM / Splunk):

• malicious_only.csv — all MALICIOUS-severity domains (the standard block/alert feed)
• high_confidence.csv — only entries corroborated by 2+ sources (confidence = HIGH, lowest false positives)
• all_domains.csv — full dataset; filter on severity/confidence in-query
• web3_tracker.db — SQLite (indexed on domain) for local enrichment lookups

domain is the first column in every CSV. See stats.json for the dataset summary.

Web3 Threat Tracker v2026.07.03

Daily release of Web3 threat intelligence data.

Lookup-feed assets for SIEM ingestion (CrowdStrike NG-SIEM / Splunk):

• malicious_only.csv — all MALICIOUS-severity domains (the standard block/alert feed)
• high_confidence.csv — only entries corroborated by 2+ sources (confidence = HIGH, lowest false positives)
• all_domains.csv — full dataset; filter on severity/confidence in-query
• web3_tracker.db — SQLite (indexed on domain) for local enrichment lookups

domain is the first column in every CSV. See stats.json for the dataset summary.

Web3 Threat Tracker v2026.07.02

Daily release of Web3 threat intelligence data.

Lookup-feed assets for SIEM ingestion (CrowdStrike NG-SIEM / Splunk):

• malicious_only.csv — all MALICIOUS-severity domains (the standard block/alert feed)
• high_confidence.csv — only entries corroborated by 2+ sources (confidence = HIGH, lowest false positives)
• all_domains.csv — full dataset; filter on severity/confidence in-query
• web3_tracker.db — SQLite (indexed on domain) for local enrichment lookups

domain is the first column in every CSV. See stats.json for the dataset summary.

Web3 Threat Tracker v2026.07.01

Daily release of Web3 threat intelligence data.

Lookup-feed assets for SIEM ingestion (CrowdStrike NG-SIEM / Splunk):

• malicious_only.csv — all MALICIOUS-severity domains (the standard block/alert feed)
• high_confidence.csv — only entries corroborated by 2+ sources (confidence = HIGH, lowest false positives)
• all_domains.csv — full dataset; filter on severity/confidence in-query
• web3_tracker.db — SQLite (indexed on domain) for local enrichment lookups

domain is the first column in every CSV. See stats.json for the dataset summary.

Web3 Threat Tracker v2026.06.30

Daily release of Web3 threat intelligence data.

Lookup-feed assets for SIEM ingestion (CrowdStrike NG-SIEM / Splunk):

• malicious_only.csv — all MALICIOUS-severity domains (the standard block/alert feed)
• high_confidence.csv — only entries corroborated by 2+ sources (confidence = HIGH, lowest false positives)
• all_domains.csv — full dataset; filter on severity/confidence in-query
• web3_tracker.db — SQLite (indexed on domain) for local enrichment lookups

domain is the first column in every CSV. See stats.json for the dataset summary.