Privacy notice

Mirage Feed and feeds.offseq.com. Last updated 2026-10-24.

Controller

SEQ SIA, registration no. 40203410806, Lastādijas iela 12 k-3, Riga, LV-1050, Latvia, trading as OffSeq. Contact for data protection matters: support@offseq.com. Listing and removal requests: abuse@offseq.com.

What the feed publishes

Attacker IP addresses (IPv6 as /64 prefixes) with their network (ASN and its registered name), country, first and last sighting truncated to the hour, and tags.
Payload and command-and-control URLs, domains, and SHA-256 hashes of delivered files.
Tool fingerprints (HASSH and JA4H).
The most common attacker user agents and request paths.
The 100 most attempted passwords, without usernames.
Aggregate statistics: counts by network, country, service and ATT&CK technique.

An IP address can be personal data when it can be linked to a person, so we treat every listed address as personal data. The feed does not publish usernames, session contents or captured credential pairs.

Purpose and legal basis

The purpose is network and information security: helping operators block addresses that are actively attacking systems. The legal basis is our legitimate interest and that of the feed's users under Article 6(1)(f) GDPR. Recital 49 names ensuring network and information security, including stopping attacks and damage to systems, as a legitimate interest.

To keep the impact on address holders low, an address is listed only after a completed TCP handshake, seen by several sensors in different networks, at least 24 hours after first sighting, and it drops out 7 days after its last activity. See how an IP gets listed.

Retention

Lists are rebuilt every day. An address leaves the 1-day and 7-day lists 7 days after its last observed activity, and the 30-day list 30 days after it.

The published data branch is force-pushed on every build, so its git history is not kept. Two places hold older data: the MISP feed carries up to 7 previous daily events, and weekly release archives keep statistics and indicators other than IP addresses. Copies already downloaded by third parties are outside our control.

Recipients

The feed is public under CC BY 4.0, so anyone can receive it. It is stored on GitHub (offseq/mirage-feed) and served through Cloudflare. GitHub and Cloudflare are US companies; transfers to them rely on the European Commission adequacy decision for the EU-US Data Privacy Framework, with Standard Contractual Clauses as the fallback.

This website

No cookies, no tracking scripts, no third-party fonts. The removal form alone loads Cloudflare Turnstile to block automated submissions. When a feed file is downloaded we count the download in aggregate: file path, network (ASN), country and client type such as curl or a firewall product. The IP address and full user agent are not stored. Cloudflare processes requests as our hosting provider.

The address lookup at /ip answers from the published lists only. The addresses you look up are not logged; we keep only aggregate counts of lookups and whether the result was listed. Lookups are rate-limited per client address, which is held in memory for at most a minute and not stored.

/status.json and the badges under /badge/ publish build freshness and list sizes only, no personal data.

Removal requests

The removal form collects the IP address to remove, your email and a reason, and passes on the IP address you send the form from so we can limit abuse. We use them only to handle the request and reply, and keep them for 12 months after the request is closed.

Your rights

You can ask for access to, rectification or erasure of data about you, restriction of processing, and you can object to processing based on legitimate interest under Article 21 GDPR. The quickest route for a listed address is the removal form.

You can complain to the Latvian supervisory authority, Datu valsts inspekcija, at dvi.gov.lv, or to the authority where you live or work.