Hi Rodrigo,
I had the same feeling when I first looked at my intel.log file.
The thing is that “matched” and “sources” are two different fields.
What you are seeing is correct, with Intel::ADDR in “matched” and
Bad Reputation Domain in “sources” field.
-Fatema.
P.S: Here is the description of the intel record: