An attack-source list names single IP addresses that were seen attacking in the last few days — scanning ports, brute-forcing logins, tripping honeypots and intrusion sensors run by the list's publisher. It is a different kind of evidence from a threat blocklist: a blocklist such as Spamhaus DROP names whole netblocks hijacked or leased by cybercrime operations, changes slowly and is a judgement about an operator; an attack-source list names individual hosts, many of them compromised machines on ordinary networks, and turns over daily as infections are cleaned and new ones appear.
What Spaw answers
is_attack_source is true when one of the three lists synced hourly names the address — the Emerging Threats compromised-hosts list, the CINS Army list, or blocklist.de — and attack_source names the first list that does. The signal weighs +50, between a report by your own account (+60) and a datacenter range (+40), and it is kept apart from is_blocklisted, which weighs +80: a host seen attacking yesterday is evidence, a netblock run by criminals is a verdict. A monitored list flags an address the day it appears on one, with the list named in the alert.
What it does not mean
A listed host is often somebody's infected computer or a rented box that has since been wiped; the weight is sized for that. The lists are also incomplete by nature — they see what their sensors see — so a false answer means "not on these lists today", never "clean".