Opt-out

Who this is for

Operators of address space: network owners, hosting and transit providers, universities, and anyone with administrative responsibility for a range rather than a single machine. To contest one listing instead, use abuse & takedown: it is faster, and it does not need the verification described below.

How to ask

support@publicmosaic.com, with Opt-out in the subject line. Include:

The ranges, in CIDR notation, and the autonomous system number they are announced from.
How we can verify you control them. The simplest route is to write from the abuse or technical contact published for the range in the regional registry's whois. If that address is not available to you, we will agree another proof, typically a DNS TXT record we nominate, placed under a zone the range's reverse DNS delegates to.
Whether the request is permanent or time-boxed, for example for the duration of an incident-response engagement.

Why we verify

An opt-out that took effect on the strength of an email would let anyone running command-and-control infrastructure remove it from a defensive feed simply by asking, and would make the feed worth less to everyone who relies on it. So we confirm that the person asking controls the range before we exclude it. That is why this page is separate from abuse & takedown, which needs no verification: contesting a single listing only ever triggers a re-scan.

What exclusion does

Once applied, we stop probing the range, and its listings are withdrawn, now and in future. The pages here for addresses in it answer 410 Gone within about a minute, and indicators already published from it leave the feed at its next update, within about fifteen minutes. The exclusion lasts until you tell us otherwise; you do not need to renew it.

When we will say no

Two cases, and we will tell you which one applies rather than simply declining:

Current, evidenced malicious use. If, when you ask, the range is serving command-and-control infrastructure we have determinatively confirmed, we will not withdraw it on request. We will share what we observed so you can act on it, and reconsider once it stops.
Unverifiable control. If we cannot establish that the requester controls the range. This is usually solvable: write back and we will find a proof that works.

What it does not mean

Opting out is not a finding that a listing was wrong, and we do not treat it as one. If you believe a listing was mistaken, say so and we will correct it on the merits. Opting out does not reach other publishers either: the feed is TLP:CLEAR and may already have been copied, so exclusion stops us publishing but cannot recall copies other people hold. It binds us, and only us; it does not stop anyone else scanning the range.