Lab52 (S2 Grupo)

https://lab52.io/blog/

Spanish CTI team (S2 Grupo), strong on APT-C / state-aligned tracking and Iberian-region targeting (added 2026-05-08). 2026-05-08 audit: WebFetch returned 5 dated articles Feb 8 - May 6 2026. Candidate; promote to active after 3 runs. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → rss: python3 tools/fetch_source.py feed https://lab52.io/blog/feed/ 5 (then webfetch the /blog/<slug>/ URL for body). AVOID: Both WebFetch AND bridge-url on /blog/ return HTTP 500 (and 5xx on the article HTML too), do NOT use webfetch/bridge-url; the RSS feed is the only reliable entry. /feed/ (root) is not well-formed XML; use /blog/feed/.. | 2026-07-05 admiralty audit: B, original APT/state-aligned research lab, first-hand IR/SIGINT. Reliability HIGH->B, status stays active. RSS at /blog/feed/ is the reliable entry (site HTML 5xxs). | 2026-09-29: rss_url set to the documented /blog/feed/ (the record had none, so the health check read the 5xx-prone HTML). Posts 2026-02-26, 03-13, 05-06, 05-14, 06-17, 07-03, then nothing: the 88-day gap on 2026-09-29 is the longest observed, so max_staleness_days 120 with a re-check at the next audit rather than a higher limit that would hide a going-dark source (2026-09-29T2134Z-audit) | 2026-10-22 (main): 2026-10-22: TLS connection reset on lab52.io from the container (curl and the feed recipe), the reader returned no items; recheck next fire before any demotion. | 2026-10-23 (main): TLS EOF on lab52.io from the container (feed and homepage) on 2026-10-22 and 2026-10-23; `extract https://lab52.io/blog/` is served by the reader and lists current posts, so fetch_method is pinned to jina (metered); recheck the direct transport at the next audit. | 2026-10-25 (S2): the feed https://lab52.io/blog/feed/ fetched DIRECT (6 items, newest 2026-10-05, no reader); the pin to the jina reader may be relaxed if the direct transport holds. | 2026-10-30 (2026-10-30T0255Z-intel, S2): the feed failed with SSL_UNEXPECTED_EOF twice on the direct transport and the reader listing is undated, contradicting the 2026-10-25 note that the feed works direct. | 2026-11-01: the feed fails with SSL EOF and WebFetch returns 503; `jina https://lab52.io/blog/ html` returns the listing with hrefs and dates (newest post 2026-10-05).