{
  "as_of": "2026-09-28T09:07:26.898Z",
  "scope": "Listings the scanner withdrew because its evidence did not support them as published — either the detection matched other software, or it identified the software correctly without evidence of malicious use — as recorded against this archive and in effect. Aggregates only: no address, port, certificate or host name of a withdrawn listing is published, and no free text: the basis of each withdrawal is a key of `bases`, or null where it has not been classified. An episode is one address and port, from its first sighting. withdrawn_share is withdrawn episodes over every episode this archive has held under that family label, for either kind of withdrawal; it is not a rate of misidentification.",
  "tlp": "CLEAR",
  "page": "https://publicmosaic.com/corrections",
  "methodology": "https://publicmosaic.com/methodology",
  "bases": {
    "echo": {
      "kind": "other-software",
      "label": "echo taken for an answer",
      "text": "The probe accepted a reply that only repeated its own request, so services that echo whatever they are sent were listed."
    },
    "embedded": {
      "kind": "other-software",
      "label": "embedded in other software",
      "text": "Other software builds in the same component and answered the probe exactly as the named software would."
    },
    "shared-structure": {
      "kind": "other-software",
      "label": "structure shared with other software",
      "text": "The certificate or message structure the detection keyed on is shared by other, ordinary software."
    },
    "other-software": {
      "kind": "other-software",
      "label": "matched other software",
      "text": "The detection matched software other than the one it named."
    },
    "identity-only": {
      "kind": "identity-only",
      "label": "tool identified, not evidence of misuse",
      "text": "The software was identified correctly, but it is also used legitimately, and identifying it is not evidence of malicious use."
    }
  },
  "totals": {
    "episodes": 1186,
    "hosts": 1172,
    "families": 3,
    "not_applied": 0,
    "by_kind": {
      "other-software": 1056,
      "identity-only": 130,
      "not_classified": 0
    }
  },
  "range": {
    "first_withdrawn_day": "2026-08-31",
    "last_withdrawn_day": "2026-09-26"
  },
  "families": [
    {
      "family": "chisel",
      "withdrawn_episodes": 1059,
      "withdrawn_hosts": 1059,
      "all_time_episodes": 1069,
      "withdrawn_share": 0.9906,
      "published_episodes": 10,
      "hub": "/c2/chisel"
    },
    {
      "family": "ligolo",
      "withdrawn_episodes": 108,
      "withdrawn_hosts": 99,
      "all_time_episodes": 119,
      "withdrawn_share": 0.9076,
      "published_episodes": 11,
      "hub": "/c2/ligolo"
    },
    {
      "family": "nanocore",
      "withdrawn_episodes": 19,
      "withdrawn_hosts": 16,
      "all_time_episodes": 19,
      "withdrawn_share": 1,
      "published_episodes": 0,
      "hub": null
    }
  ],
  "groups": [
    {
      "withdrawn_day": "2026-09-26",
      "recorded_day": "2026-09-27",
      "family": "ligolo",
      "basis": "identity-only",
      "kind": "identity-only",
      "episodes": 108,
      "hosts": 99
    },
    {
      "withdrawn_day": "2026-09-26",
      "recorded_day": "2026-09-27",
      "family": "chisel",
      "basis": "identity-only",
      "kind": "identity-only",
      "episodes": 2,
      "hosts": 2
    },
    {
      "withdrawn_day": "2026-09-25",
      "recorded_day": "2026-09-27",
      "family": "chisel",
      "basis": "embedded",
      "kind": "other-software",
      "episodes": 1026,
      "hosts": 1026
    },
    {
      "withdrawn_day": "2026-09-25",
      "recorded_day": "2026-09-27",
      "family": "chisel",
      "basis": "identity-only",
      "kind": "identity-only",
      "episodes": 20,
      "hosts": 20
    },
    {
      "withdrawn_day": "2026-08-31",
      "recorded_day": "2026-09-26",
      "family": "nanocore",
      "basis": "echo",
      "kind": "other-software",
      "episodes": 19,
      "hosts": 16
    },
    {
      "withdrawn_day": "2026-08-31",
      "recorded_day": "2026-09-27",
      "family": "chisel",
      "basis": "echo",
      "kind": "other-software",
      "episodes": 11,
      "hosts": 11
    }
  ]
}