The Synonym Problem — When 'Malicious' Has Two Names

TI-2026-068C · Series: 🧭 Ground Truth · TLP:WHITE · 2026-07-09

The graph's second-largest conflict class is 12,561 malware domains that every source agrees are dangerous. So what are they fighting about? A word. And that word quietly breaks blocklists.

📋 The Short Version

068A opened the conflict layer and used the threat disagreements as its worked example — reading them as kill-chain ambiguity: the same infrastructure seen as C2, dropper, and payload host depending on when you looked. Having now measured the whole class, I owe that framing a correction (§6): it's mostly not that. It's a vocabulary gap.

All 12,561 threat conflicts are on domains. And 99.6% of them come down to a single pair of labels:

• Our honeypot and URLhaus call these domains malware_download.
• ThreatFox calls the identical domains payload_delivery.

Neither is wrong. They are the same fact — a domain that serves a malicious payload — described by two feeds with two ontologies. The "disagreement" is a synonym. And a defender who keys on one feed's word silently loses everything the other feed filed under the other word.

Confidence: HIGH — direct measurement of the conflict store and the per-source label vectors.

1. Everyone Agrees It's Bad

The threat-label vocabulary in the entire graph is effectively three tokens:

Every one of the 12,561 conflicted domains is flagged malicious by every source that saw it. There is no dispute about danger. The dispute is entirely about category.

2. The Split Is Perfectly Systematic

If this were genuine analytic disagreement, you would expect it to vary case by case — some domains look more like C2, others more like droppers. It doesn't. Each feed applies its own fixed word to all of them:

This is not two analysts reaching different conclusions. It is two dictionaries. URLhaus and our honeypot describe by observed artifact — "a malware download happened here." ThreatFox describes by kill-chain phase — "this is where a payload is delivered." Point both at the same domain and you get two words for one thing.

The confusion matrix confirms it: malware_download ⟷ payload_delivery accounts for 12,504 of 12,561 conflicts (99.6%).

3. Why This Breaks Blocklists

The synonym is not harmless, because label strings get wired into automation. Consider a defender who ingests a single feed and writes the obvious rule:

block all domains where threat_label == "payload_delivery"

If they took that from ThreatFox, they now block 12,504 domains — and miss nothing. But if their SIEM enriches from URLhaus, where the same 12,504 domains are filed as malware_download, the rule matches zero of them. The feeds agree the domains are malicious; the literal string mismatch manufactures a phantom coverage gap out of pure vocabulary.

The graph's design is the fix: it stores both labels with provenance instead of picking a winner. The synonymy stays visible and mappable. A single-label database would have hidden the equivalence — and hidden the gap.

The rule that follows: correlate threat feeds by mapped ontology, never by literal label string. A feed's category is a dialect, not a fact.

4. The Real Signal Is the 1.3% Tail

Strip out the vocabulary artifact and something genuine remains. 108 domains (1.3%) carry botnet_cc — a label ThreatFox and the LLM assert against the malware_download consensus, marking an actual role distinction: a command-and-control host, not merely a payload host.

Examples: bestwebchlen.cyou, framesavecloudjs.beer, ethercdnns.beer, blatnoitovar.xyz ("blatnoi tovar" — Russian criminal slang for contraband), krempie.xyz, kuilfgfd.cc. One — 176.65.149.124.ptr.pfcloud.network — resolves to Pfcloud, the bulletproof transit hub of dossier 024F.

This is where the disagreement is about the world, not the words. Filter the synonym noise and the residue is the useful alert: the small set of domains a feed believes is C2 rather than delivery.

5. What the Domains Actually Are

The contested population is a single recognizable thing: commodity malware-delivery / stealer infrastructure. DGA-style names on cheap and novelty TLDs —

— with algorithmic subdomains like star.magicflowpoint.lat, ocul-xq7.raxen-tech.in.net, 9wk4ykk.woodfor.lat, test1-api.pestte1ex.in.net. All were observed as malware sources in our own honeypot, which is exactly why the honeypot source votes malware_download on all 12,561. The scale and naming are the fingerprint of automated loader/stealer campaigns, not bespoke targeting — and the sheer size (12k+ domains) is what turns a harmless vocabulary quirk into a large apparent coverage gap.

6. Correcting 068A, In the Open

068A's Section 6 read this conflict class as kill-chain-role ambiguity: "Depending on when in the kill chain you looked, it is all three… the same infrastructure seen at different moments."

The complete data does not support that as the general explanation. That reading is correct only for the ~1.3% botnet_cc tail. The 99.6% bulk is feed-vocabulary non-alignment — two ontologies, one fact — with no temporal role-shifting required to explain it.

I am refining that statement here rather than letting it stand. It is the same discipline this series applies to its sources in 068A: when the fuller data adjudicates, the conflict is recorded and the earlier value is corrected in the open — including when the earlier value was ours.

7. What This Means

• For attribution. "Threat category" is the least portable field in the intel stack. Treat every feed's label as a dialect and map it to a shared ontology before you compare — or you will read synonyms as contradictions and contradictions as synonyms.
• For detection. Never gate a block/alert rule on a single feed's raw label string. Normalize first. The 12,504-domain phantom gap in §3 is what happens when you don't.
• For honesty. The graph's willingness to keep both labels — and this dossier's willingness to correct 068A — are the same mechanism: record the disagreement, then resolve it in daylight.

Investigation Metadata

Cross-references: TI-2026-068A (The Authority — the conflict census, corrected here) · TI-2026-068B (The Deed and the Tenant — sibling conflict layer) · TI-2026-024F (The Pfcloud Transit Hub — a botnet_cc-tail host) · TI-2026-052 (The Malware Graph — the honeypot download corpus these domains served).