LH035 survey table
Built by python3 studies/LH035/scripts/build.py from studies/LH035/data/ (instruments.json, candidates.json, literature.json, fetchlog.csv); edit the data, not this file. Rows I01 to I40 were filled from the instrument's own pages fetched on 2 November 2026 with WebFetch, which returns a model-written extract of each page rather than the page itself; in them, quotation marks enclose the extract's quotation of the page. Rows I41 to I48 were filled on 5 November 2026 from raw pages fetched with curl and saved in data/reads-2026-11-05/, so their quotations were checked against the page itself, except where a row says it rests on a 2 November extract. On 6 November 2026 rows I01 to I40 were re-read raw (data/reads-2026-11-06/, with readlog.csv and the offline check scripts/reread_check.py), except I30, whose pages refused the research client (HTTP 403); their quotations were matched against the raw pages, and the fields the raw pages did not bear out were corrected (record version 0.3, Corrections). Each row says how and when it was read. "not stated" means the pages read did not give it. The last column but one, the characteristic blind spot, is Lighthouse's reading (interpretation), not the instrument's statement, and may be blank. Layer numbers are the brief's: 1 Physical and interconnection; 2 Routing; 3 Addresses and reachability; 4 Names; 5 Certificates; 6 Running services and their software; 7 Web content and technology; 8 Software supply; 9 Vulnerability and exploitation records; 10 Traffic.
Origin: a = an instrument Lighthouse's studies used; b = an LH003 row touching a layer here (re-read, not copied); c = the fixed search plan (search ids as in searchlog.md). Literature ids (L01 to L11) are in the table near the end; a paper's evaluation is cited beside the row it concerns.
Included: 48 instruments
| Id | Instrument and pages read | Layers (primary first) | What it counts | Vantage | Cadence | History | Access and licence | Page date; observation window; date read | What it says it cannot see | Blind spot (Lighthouse's reading, interpretation) | Origin | Literature |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| I01 | PeeringDB: https://docs.peeringdb.com/faq/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 1 | Records of networks, facilities, exchanges and carriers: a record "can be a carrier, a facility, an exchange, or a network" | Self-reported: users affiliate with organisations, approved by admins or PeeringDB Support; network and organisation records can be prefilled by RDAP lookups | not stated (the FAQ says only that its sync tool's later runs "incrementally update changed records") | not stated | "freely available"; "no membership fees"; API access now needs an API key (because of mandatory MFA); licence not stated | not stated; not stated (current records); read 2026-11-02 | not stated on the page read | Only what operators choose to declare: a declared presence at a facility or exchange, not whether traffic flows there or at what volume. | c (named in the summary of search L1b; documentation read directly) | Sermpezis et al. 2023 (L05) note as a limitation of their own inputs that "only 25% of ASNs have records in PeeringDB". |
| I02 | TeleGeography Submarine Cable Map: https://www.submarinecablemap.com/ (title only, no body text); https://www2.telegeography.com/submarine-cable-faqs-frequently-asked-questions (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 1 | Submarine cable systems with length in kilometres and ready-for-service date; the FAQ gives "more than 600 active and planned submarine cables" and "over 1.5 million kilometers" in service (as of 2026) | Operators' own accounts, for the paid research service's capacity figures: "We directly contact cable operators worldwide to obtain their current views on each system's capabilities"; also updates sent by the public; fault figures from the ICPC | "We continually update this free resource"; capacity metrics "annually" | not stated for the map; the fault dashboard covers "publicly-disclosed faults on subsea cables since 2017" | The map is a "free resource"; raw geocoded data needs "an annual license"; capacity data "only available as part of our subscription-based research services"; map images CC BY-SA 4.0 | not stated; counts given "As of 2026" and "As of early 2026"; current systems, active and planned; read 2026-11-02 | "The cable routes on our map are stylized and do not reflect the precise geolocation of systems." Capacity is not in the free map. | Land networks and what the cables carry: it is a register of systems as their owners describe them, with capacity behind a subscription. | c (TeleGeography named in the summary of search L1b; documentation read directly) | |
| I03 | Epoch AI, AI data centers: https://epoch.ai/data/data-centers (the extract names the page epoch.ai/data/ai-data-centers) (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 1 | 96 AI data centres, each with "a timeline of total IT power capacity, compute capacity, and capital cost", location, owner and users | Estimates from "high-resolution satellite imagery, permits, and public documents" and company statements; compute derived from power | files marked "Updated Nov. 1, 2026" when read on 2 November and "Updated Nov. 5, 2026" on 6 November; schedule not stated | timeline axis Q1 2023 to Q1 2030 (later quarters are projections); coverage limited "to data centers that become operational in 2024 or later, with some exceptions" | free CSV and ZIP; "free to use, distribute, and reproduce provided the source and authors are credited" (CC BY) | updated 1 November 2026 (2 November read); "Updated Nov. 5, 2026" (6 November read); 2023 to 2030 as estimated timelines; read 2026-11-02 | "we estimate this database's coverage of global deployed AI computing capacity to be 45%" (90% interval 30% to 78%); power estimates within a factor of 1.4 "80% of the time"; "we are uncertain about these affiliations, especially the data center users"; coverage being expanded in "Asia, Europe and the Middle East" | Every data centre that is not built for AI, and most of the internet's ordinary facilities. | b (LH003's Epoch AI row; included under the brief's exception for AI-subject sources that observe a layer) | |
| I04 | Interconnection Measurement Project (CableLabs): https://interconnection.cs.uchicago.edu/ (301 to imp.cablelabs.com); https://imp.cablelabs.com/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 1, 10 | "the total amount of ingress data (in bytes) on each interconnect over a 5 minute period" and each interconnect's capacity; published as utilisation distributions and monthly peaks | Four ISPs' own interconnects: Comcast, Charter, Cox and Mediacom, whose footprint "covers >75%" of the US population | collected every 5 minutes; published as monthly peaks and yearly distributions | reporting period January 2018 to December 2024 | aggregated, normalised charts on the page; whether raw data can be had is not stated | not stated; January 2018 to December 2024; read 2026-11-02 | "a 95% utilization does not necessarily indicate a poor user experience"; "the percentage of interconnects at the various utilization thresholds is not weighted by capacity"; "the largest interconnections for ISPs are typically application specific" | Every network but four US cable ISPs, and any single link: only aggregates are public, and the period read ends in 2024. | c (search L1a results 5 and 7 named it; the result's site opened at its root) | |
| I05 | RouteViews: https://www.routeviews.org/routeviews/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 2 | BGP routing information bases (RIBs) and updates | Route collectors at "Internet Exchange Points (IXPs) and partner networks worldwide", by direct or multi-hop peering; "over a thousand peers" | no publication schedule stated; the page says the archive documents routing "second by second" and is "continuously growing", and offers "Real-time BGP Data Access" | "from the 1990s to today" | free download from archive.routeviews.org; CC BY 4.0; commercial terms for selling derivative products | not stated (newest news item shown as "1 week ago" on 6 November 2026); 1990s to the read date; read 2026-11-02 | not stated on the page read | The routes of networks that do not peer with a collector, which the literature puts at most networks. | c (named in the summary of search L2b; page read directly) | Alfroy et al. 2024 (L06): "A tiny fraction (1.3%) of the 74k ASes" host a RIS or RouteViews vantage point; a private collector (bgp.tools) saw 192k AS links no RIS or RouteViews point saw. Sermpezis et al. 2023 (L05): average bias score 0.15 for RouteViews, against 0.00 to 0.01 for a random sample. |
| I06 | RIPE RIS (Routing Information Service): https://ris.ripe.net/docs/ (index only); https://ris.ripe.net/docs/route-collectors/; https://ris.ripe.net/docs/mrt/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 2 | BGP routing data in MRT files: "Dump files store the state of the routing system at a given time", and update files the changes | BGP peering sessions with RIS: "We receive this data via BGP peering sessions, where RIPE RIS uses AS12654"; "Most route collectors collect data from peers at IXP peering LANs"; RRC00, RRC24 and RRC25 are multi-hop collectors | "dumps are created every 8 hours, and updates are created every 5 minutes" | not stated on the pages read | raw data linked from data.ris.ripe.net; licence and terms not stated on the pages read | route collectors page last updated 13 October 2026; MRT page 29 March 2024; not stated; read 2026-11-02 | "Deprecated RRCs will not have new data but their data will be accessible." No coverage limit stated. | As RouteViews: networks without a peering session, and a placement weighted towards exchange points. | c (named in the summaries of searches L2a and L4a; documentation read directly) | Alfroy et al. 2024 (L06): RIS had 1,526 vantage points in May 2023, RouteViews 1,071; about 32% full feeders. Sermpezis et al. 2023 (L05): "RIPE RIS is heavily biased towards larger networks and IXPs" (average bias 0.16). |
| I07 | Packet Clearing House BGP routing data: https://www.pch.net/resources/BGP_Routing_Data (302); https://downloads.pch.net/BGP_Routing_Data (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 2 | not stated; the listing names "Daily Routing Snapshots" and "MRT Routing Updates" | not stated on the page read | not stated | not stated | the page says "This work is licensed under a Creative Commons Attribution ShareAlike 4.0 License" while its link points to CC BY-NC-SA 4.0 | not stated; not stated; read 2026-11-02 | not stated | (blank) | c (search L2a result 6, opened) | |
| I08 | CAIDA AS Relationships: https://www.caida.org/catalog/datasets/as-relationships/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 2 | Inferred customer-to-provider and peer-to-peer links between ASes ("The AS relationships available are customer-provider (and provider-customer in the opposite direction), and peer-to-peer"; the page's background also describes sibling-to-sibling relationships, which that list does not include); customer cones in ASes, prefixes or addresses | Derived from "RouteViews and RIPE RIS BGP table snapshots"; serial-2 adds IX looking-glass communities and Ark traceroutes | "one file created per month" | serial-1 "available from 1998 to present"; serial-2 from October 2015 | publicly available through a download or request form under CAIDA's Acceptable Use Agreement; publications must be reported | published 6 November 2013; last modified 27 April 2020; 1998 to present; read 2026-11-02 | "A truly accurate picture of the Internet topology would require collection of data from every AS"; "AS relationships are more complex than allowed for in our approach" | Inherits the collectors' blind spots, since it is inferred from them. | c (named in the summary of search L4a) | Alfroy et al. 2024 (L06) report about 15% more AS relationships inferred when vantage points are chosen for low redundancy, at the same data volume. |
| I09 | Cloudflare Radar: https://developers.cloudflare.com/radar/; https://developers.cloudflare.com/radar/glossary/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 10, 2, 4, 5 | Shares of HTTP requests, DNS queries to 1.1.1.1, domain rankings by "estimated number of unique users that access a domain", BGP messages and announced space in /24s and /48s, route leaks and hijacks, certificates in monitored CT logs, outages as an "algorithmically-observed anomalous drop in traffic", attacks in bytes or mitigated requests | "Cloudflare's global network" and "aggregated and anonymized data from Cloudflare's 1.1.1.1 public DNS resolver"; routing from "MRT data from RouteViews and RIPE RIS" plus RIS Live and RouteViews' Kafka stream; CT logs "currently monitored by Cloudflare"; speed tests run by users | not stated overall; "the aggregation resolution for the ratio data is based on the length of the selected timeframe" | not stated overall (speed tests "aggregated over the previous 90 days"; IPv6 share computed differently before 23 January 2023) | "Available on all plans"; free API; API data under CC BY-NC 4.0 | main page last updated 21 May 2026; not stated; read 2026-11-02 | "only countries where users run speed tests with sufficient regularity are included"; IQI gaps "do not indicate outages"; geolocation from "a third-party database" whose accuracy mobile networks, VPNs and proxies affect; robots.txt view: "we only include AI-focused user agents" | Traffic that never touches Cloudflare's network or resolver; its routing view inherits the public collectors'. | b (LH003 row) and c (search L10b result 16 is a variant of the page read) | |
| I10 | RIPE Atlas: https://atlas.ripe.net/about/ (302); https://www.ripe.net/analyse/internet-measurements/ripe-atlas/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 3 | measurements of connectivity by "a global network of devices, called probes and anchors, that actively measure Internet connectivity"; unit not stated | Volunteer-hosted probes ("over 14,000") and anchors | not stated ("real time") | not stated | "The vast majority of data that RIPE Atlas collects is freely available to anyone to browse, download or use"; custom measurements cost credits | not shown; not stated; read 2026-11-02 | not stated on the page read | Places where no volunteer hosts a probe. | c (named in the summaries of searches L3a and L3b; page read directly) | Sermpezis et al. 2023 (L05): Atlas "substantially less biased" than RIS and RouteViews (average 0.06); its default probe selection is "almost two times higher" in bias than random selection. |
| I11 | CAIDA Ark IPv4 Routed /24 Topology: https://www.caida.org/catalog/datasets/ipv4_routed_24_topology_dataset/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 3, 2 | traceroute path records in warts format (probe and response fields per hop) | "a globally distributed set of Ark monitors" | "a random address in each prefix is probed approximately every 24 hours" | "collected continuously since September 13, 2007" | data older than one year public on request; recent data for academic researchers and US government agencies, companies through membership; CAIDA Acceptable Use Agreement | published 1 February 2008; last modified 8 July 2020; September 2007 to present; read 2026-11-02 | "Measurements to consistent IPv4 addresses are not available in this dataset"; prefixes "are not probed by the same set of monitors consistently over time" | IPv6 is outside this dataset by its definition; the newest year is not public. | c (named in the summary of search L4a) | |
| I12 | Censys (platform and the public PHP2Shell tracker): https://docs.censys.com/docs/platform-datasets; https://censys.com/pricing; https://php2shell.censys.com/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 6, 3, 5 | hosts ("public IPv4 and IPv6 hosts"), web properties ("a hostname and a port"), certificates ("over 15 billion records"); the tracker counts "PHP responses Censys scanners receive per minute, by the version they report" and services per branch | Censys's "internet scanning processes"; the tracker reads the version each PHP response reports | certificates grow "daily"; the tracker is "Updated hourly" | not stated in the documentation; plan history from "1+ month" (Core) to "12+ months" (Security Operations); the tracker shows the last 24 hours and one bar per UTC day | free account for "basic visibility into standard ports and services" (limits not stated); paid plans "Contact sales"; the tracker's terms not stated | documentation updated 12 March 2026; not stated; read 2026-11-02 | not stated in the documentation read; the tracker's "Notes & limitations" heading had no text under it | Services that do not answer its scanners or that report no version; a reported version is not a patch state. | a (LH033) and c (search L5b results 3, 7, 9, 10; L6b result 1) | Durumeric et al. 2025 (L01, Censys's own authors): Censys sees an estimated "98% of IPv4-based services on the top 10 ports, 97% of the top 100 ports, and 62% of services across all 65K ports"; "we do not conduct comprehensive IPv6 scans"; it restricts "data that is ripe for abuse". Bennett et al. 2021 (L02): Censys and Shodan made all planted test tokens visible within 24 hours, from five cloud machines. |
| I13 | CAIDA UCSD Network Telescope: https://www.caida.org/catalog/datasets/telescope-near-real-time-data/ (404); https://www.caida.org/projects/network_telescope/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 9, 10, 3 | unsolicited one-way traffic (background radiation) to unused addresses; packets and "flowtuples" | a routed but lightly used /9 and /10, "approximately 1/256th of all IPv4 addresses" | "a continuous view"; exclusion filters updated twice daily since November 2023 | datasets back to Code Red (August 2001); aggregated flows from November 2003 | free for US and vetted foreign academic researchers; paying industry partners; sensitive data only on a VM platform; "Several historical datasets are available for download, either publicly or upon request" | published 12 June 2012; last modified 29 January 2025; 2001 to present; read 2026-11-02 | "System resource limitations sometimes cause packets to be dropped, or failure to generate flowtuples"; "The telescope instrumentation is in need of an overhaul to keep up with traffic growth" | Traffic aimed at addresses that are in use, and scanners that avoid dark space. | c (named in the summary of search L10b) | Degen et al. 2026 (L09): after excluding assigned subnets the UCSD telescope monitors 10.9 million addresses; larger telescopes "detect many attacks missed by smaller ones"; 37.0% of sources targeted a /16 block in each of three telescopes within an hour. |
| I14 | Tranco: https://tranco-list.eu/methodology (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 4 | domains ranked by averaging ranks "over the past 30 days" | combines provider lists: CrUX, Cloudflare Radar, Farsight, Majestic and Cisco Umbrella (the page also says "all four providers", an inconsistency on the page) | not stated for Tranco; sources daily (Farsight, Majestic, Umbrella), weekly (Radar) and monthly (CrUX) | not stated | download section and source code offered; licence not stated | not stated (content refers to mid-2023 events); rolling 30 days; read 2026-11-02 | inherited per source: Majestic "only domains linked to from other websites are considered"; Umbrella "invalid domains are also included"; CrUX "Only websites are included." | Popularity, not existence: names nobody visits, links or resolves through the panels are absent. | c (named in the summary of search L7a) | Le Pochat et al. 2019 (L03): the four source lists then held about 2.82 million sites and agreed on about 70,000; all were manipulated in experiments; Tranco inherits their biases and lists "remain susceptible to manipulation" if all four are manipulated. |
| I15 | Chrome UX Report (CrUX): https://developer.chrome.com/docs/crux/methodology (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 7, 4 | "individual user experiences, which are aggregated into page-level and origin-level distributions" | Chrome users with usage-statistics reporting on, history sync on and no sync passphrase, on desktop and Android; not "Chrome on iOS", WebView apps or other Chromium browsers | not stated on the page read | not stated | Creative Commons Attribution 4.0 | "Last updated 2024-06-20 UTC"; not stated; read 2026-11-02 | the popularity threshold "is not disclosed"; pages must be "publicly discoverable"; "Chrome does not publish data about the proportions of users that meet these criteria" | Sites below an undisclosed popularity floor and people on other browsers. | c (named in the summary of search L7b as HTTP Archive's URL source) | |
| I16 | Certificate Transparency logs: https://certificate.transparency.dev/howctworks/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 5 | certificates and precertificates in "append-only ledgers of certificates" | "Anyone can submit a certificate to a log, but most of them are submitted by CAs" | maximum merge delay "usually 24 hours" | not stated | "anyone can query them" | not stated; not stated; read 2026-11-02 | not stated on the page read | Names that never receive a publicly trusted certificate. | c (search L5b result 6, an encyclopaedia page, not opened; the project's documentation read directly) | Sommese et al. 2023 (L07, preprint): CT logs from 2017 covered 52% of the names in 19 ccTLD zones in 2023; "Scraping CT logs does not provide an explicit and reliable indicator of the publication time of a certificate". Gustafsson et al. 2017 (L11): for almost all domains seen on a campus network to December 2015 at least one log held a valid DV certificate, when logging was still voluntary for most CAs. |
| I17 | The Shadowserver Foundation: https://www.shadowserver.org/what-we-do/network-reporting/; https://www.shadowserver.org/what-we-do/; https://dashboard.shadowserver.org/ (503 twice) (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 6, 9, 3 | remediation reports per exposure type: hosts with an accessible service, sinkholed connections, honeypot events; units vary by report | "daily Internet-wide scans, sinkholes, honeypot sensors, sandboxes, blocklists and many other sources" | most reports "Updated every 24 hours" | not stated | "offers all services free of charge, for public benefit. We don't sell data"; reports go to vetted subscribers ("more than 10000" on one page, "over 8,000" on the other); a public dashboard is linked but could not be read | not stated; not stated; read 2026-11-02 | no general statement; the DDoS report notes "traffic might also be spoofed" | A reader who is not a network owner sees only what the dashboard aggregates; the reports go to those who can fix things. | c (search L5b result 13 not opened; named in the summary of search L9b) | |
| I18 | urlscan.io: https://urlscan.io/about/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 7 | scans: a browser visit to a submitted URL, recording "everything that the page navigation creates"; "3M user-submitted scans per day" | submissions from "researchers, analysts and automated pipelines"; scanning location not stated | not stated as a schedule; "3M user-submitted scans per day" | since "Late 2016" | "a free service"; commercial API plans "alongside the free tier" | a footer stamp that changes with each fetch (2 November 2026 on the first read, 6 November on the second); late 2016 to the read date; read 2026-11-02 | "A single observation is often meaningless without the necessary context." | Only what someone thought worth submitting, which leans towards the suspicious. | c (search L5b result 4 not opened; about page read directly) | |
| I19 | HTTP Archive: https://httparchive.org/faq (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 7 | one landing page per URL, "millions of URLs" per crawl; technologies by Wappalyzer ("over 1,000 web technologies") | a private WebPageTest instance in "Google Cloud regions" in the US; URLs from the Chrome UX Report; desktop Chrome and emulated Android | monthly, on "the 2nd Tuesday of each month" | project started "in 2010"; first crawl date not stated | public BigQuery dataset; cost and licence not stated | not stated; not stated; read 2026-11-02 | "does not crawl the website's other pages"; "The landing page may not be representative of the overall site"; "Each URL is loaded only once"; tests "generated from various datacenters in the US" | Internal and logged-in pages, and the web as seen from outside the US. | c (search L7b result 2 not opened; FAQ read directly) | Aqeel et al. 2020 (L08): internal pages of 1,000 sites "differ substantially" from landing pages, and nearly two thirds of 119 web-performance studies would need revision to apply to them; their own sample is the top 2,000 or so sites. |
| I20 | W3Techs: https://w3techs.com/technologies; https://w3techs.com/disclaimer (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 7, 6 | technology usage per website, across "well over 20 million sites" | a sample of "the relevant web", ranked by CrUX and a customised Tranco list; crawler location not stated | "Our reports are updated daily." | not stated | statistics shown on the pages; terms of use and an API linked; payment not stated | not stated; current; read 2026-11-02 | "We investigate technologies of websites, not of individual web pages"; "We do not consider subdomains to be separate websites"; "our research does not cover all technologies"; "Some technologies may become visible only after user interaction"; results "may be incomplete and inaccurate" | Software that does not announce itself to a visitor. | a (LH033); LH003 excluded it as not AI-specific | |
| I21 | Common Crawl: https://commoncrawl.org/faq; https://commoncrawl.org/overview (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 7 | "raw web page data, metadata extracts, and text extracts"; "petabytes of data" | CCBot ("Nutch-based"), from dedicated IP ranges listed as of 11 August 2026; obeys robots.txt and nofollow | not stated on the pages read (crawls listed from CC-MAIN-2016-40 to CC-MAIN-2026-43) | "Regularly collected since 2008" | free, "at no cost for the purpose of research and analysis"; terms of use; the index API is rate-limited | not stated; 2008 to the read date; read 2026-11-02 | "we do not generally archive any entire website but a randomly selected subset of it"; "Currently, JavaScript is not executed and Cookies are not used"; "Common Crawl's dataset is a sample of the web" | Pages that need scripts, logins or permission, and sites that refuse its crawler. | b (LH003 row) and c (named in the summary of search L7a) | Sommese et al. 2023 (L07, preprint): Common Crawl covered 31% of names in 19 ccTLD zones in 2023, 7% that CT logs did not. |
| I22 | PyPI download table on BigQuery: https://docs.pypi.org/api/bigquery/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 8 | "downloads patterns of packages hosted on PyPI"; row unit not stated on the page | "streaming download logs from PyPI to BigQuery" | streaming; latency not stated | not stated | BigQuery; "licensed under the Creative Commons License" (linked to CC BY 4.0); quota and account not stated | not stated; not stated; read 2026-11-02 | not stated on the page read | A fetch is not an install, and nothing in the record says whose machine fetched (Lighthouse's own studies, LH011 to LH013). | a (LH011 to LH014 through ClickPy and pypistats) | |
| I23 | PyPI Stats (pypistats.org): https://pypistats.org/about (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 8 | aggregate download statistics and time series per package | the Python Software Foundation's public BigQuery dataset | not stated | "PyPI Stats retains data for 180 days." | JSON API; open source; licence not stated | not stated; rolling 180 days; read 2026-11-02 | "All aggregate download stats ignore known PyPI mirrors", "unless noted otherwise" | As the PyPI table it summarises, over a shorter memory. | a and b (LH003 row; re-read) | |
| I24 | ClickPy: https://clickpy.clickhouse.com/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 8 | Python package downloads; the page showed "over 3.65 trillion downloads" across "1,088,497" packages on 2 November 2026 (2 November extract), and "over 3.68 trillion downloads" across 1,092,462 packages on 6 November (raw) | not named on the page beyond PyPI | "updated daily" | not stated | "Free analytics service"; figures link to queries on sql.clickhouse.com; account not stated | not stated; not stated; read 2026-11-02 | not stated | As the PyPI table; it is another view of the same logs, not an independent instrument. | a (LH011 to LH014) | |
| I25 | npm download counts API: https://raw.githubusercontent.com/npm/registry/main/docs/download-counts.md (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 8 | "the total downloads for a given period, for all packages or a specific package" | "npm's raw log data is continuously written to a series of buckets on AWS S3" | "Once per day, soon after UTC midnight" | "The earliest date for which data will be returned is January 10, 2015." | public API; no key, terms or licence stated | not stated; 10 January 2015 to the previous UTC day; read 2026-11-02 | a download is not defined on the page (it defers to an external post); bulk queries at most 128 packages and 365 days; other queries at most 18 months; per-version counts "only available for the previous 7 days" | Which fetches were people, robots or CI, and installs from mirrors. | b (LH003 row; re-read through raw.githubusercontent.com) | |
| I26 | nodejs.org download summaries: https://nodejs.org/metrics/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 8 | daily download records of Node.js binaries and sources with "day, country, region, path, version, os, arch, bytes"; downloads and TiB | "gleaned from the access logs by matching for known binary and source files"; geolocation from MaxMind GeoLite2 | "roughly one log file per day"; the current day's file "is not final" | "starting on the 14th of May 2014 to the current day" | files linked from the page; licence not stated | not stated; 14 May 2014 to the read date; read 2026-11-02 | a gap "from the 1st to the 21st of September 2015 due to a server configuration error"; "IP addresses and exact times are not reported"; the version field "occasionaly empty" | Node.js obtained any other way: package managers, images, mirrors. | a (LH034) | |
| I27 | Packagist statistics: https://packagist.org/statistics (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 8 | packages (477,476), versions (6,015,953) and installs since 2012-04-13 (210,166,452,300), as displayed on 2 November 2026 (extract), and 479,199, 6,040,573 and 211,475,236,112 on 6 November (raw); daily and monthly install charts | not stated | daily and monthly points; "The last data point is for the current day (UTC) and shows partial data" | installs "since 2012-04-13" | shown on the page; API and feeds linked; terms not stated | not stated; 13 April 2012 to the read date; read 2026-11-02 | "The last data point is for the current month and shows partial data." | What an "install" is, which the page does not define; PHP software fetched outside Composer. | a (LH033) | |
| I28 | GH Archive: https://www.gharchive.org/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 8 | "JSON encoded events as reported by the GitHub API", 15+ types, "aggregated into hourly archives" | GitHub's Timeline API (2011 to 2014) and Events API (from 2015) | hourly; the BigQuery dataset "automatically updated every hour" | "Activity archives are available starting 2/12/2011" | HTTP download; public BigQuery with "1 TB of data processed per month free of charge"; licence not stated | not stated; 12 February 2011 to the read date; read 2026-11-02 | the payload "may be updated by GitHub at any point" | Private repositories and every other forge. | b (LH003 row; re-read) | |
| I29 | Open Source Insights (deps.dev): https://docs.deps.dev/faq/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 8, 9 | dependency graphs per package and version, "decorated with versioning and licensing information, known vulnerabilities, and other important signals" | package registries and repository hosts for Cargo, Go, Maven, npm, NuGet, PyPI and RubyGems | feeds plus a background scan; common packages "usually fresh, up to date to within an hour or so" | not stated | web pages, API and BigQuery; data licence not stated | not stated (footer 2021); current; read 2026-11-02 | "Quiescent or obsolete packages can be presented with staler data"; "there is no data for C or C++"; differences from "input from the build system not available to us" | What is resolved on paper, not what any machine runs. | a and b (LH003 row; re-read) | |
| I30 | CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities; https://www.cisa.gov/known-exploited-vulnerabilities-catalog (WebFetch extract, 2 November 2026; raw re-read refused on 6 November 2026 (HTTP 403 to the research client, twice), so this row still rests on the extract) | 9 | vulnerabilities by CVE ID with "reliable evidence that the vulnerability has been actively exploited in the wild"; the catalogue page showed "Showing 1 to 20 of 1766 results" on 2 November 2026 | CISA's own judgement against three criteria (CVE ID, reliable evidence of exploitation, a clear remediation); nominations by form | not stated (latest "Date Added" shown: 2026-10-30) | not stated | entries listed on the catalogue page with no sign-in shown; "The KEV catalog is also available in these formats": CSV and JSON, with a JSON Schema; a "License" link whose text was not read | refers to BOD 26-04 (10 June 2026); not stated (entries dated by "Date Added"); read 2026-11-02 | exploitability is not a criterion; scanning and proof-of-concept code are not exploitation; listing requires "a clear remediation action" | Exploited flaws with no fix yet, and exploitation nobody reported with evidence. | a (LH031) | Parla 2024 (L10): KEV "is also a subset of all exploited CVEs"; a fix must exist before listing. |
| I31 | CVE List (cvelistV5): https://www.cve.org/About/Overview (heading only); https://raw.githubusercontent.com/CVEProject/cvelistV5/main/README.md (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 9 | "a catalog of all CVE Records identified by, or reported to, the CVE Program" | records published by CVE Program partners | "updated regularly (about every 7 minutes)"; daily baseline and hourly delta files | "the full history of the deltaLog file is viewable in the Git history"; deltaLog keeps "a rolling 30 days" (temporarily 15 during a date normalisation from 16 to 28 February 2026) | "You may search, download, and use the content hosted in this repository, per the CVE Program Terms of Use" | most recent dated note 17 February 2026; the CVE Program's history; read 2026-11-02 | "Publication and update date discrepancies exist for CVE Records published by the MITRE CNA-LR." | Flaws never assigned a number, and anything about exploitation. | a and b (LH003's CVE.org row; LH030 reads vulnerability records) | |
| I32 | OSV.dev: https://osv.dev/about (302); https://google.github.io/osv.dev/faq (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 9 | vulnerability records in the OSV format; it "aggregates, enriches and indexes vulnerability data from databases that use the OSV schema" | upstream databases including "GitHub Security Advisories, PyPA, RustSec, and many more" | "Data sources no more than 15 minutes stale, 99.5% of the time" | not stated | public GCS bucket; API with "not a limit"; "completely open source"; data licence not named | not stated; not stated; read 2026-11-02 | records may fail import "due to there being a quality issue"; records deleted upstream from REST and Git sources are left "valid but orphaned" (deleted records from GCS sources are marked withdrawn) | Anything its sources have not published. | a and b (LH003 row; LH030 and others query its API) | |
| I33 | GitHub Advisory Database: https://docs.github.com/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 9 | advisories for "known security vulnerabilities and malware in open source packages", each with a GHSA ID | reviewed advisories from GitHub, NVD, npm, FriendsOfPHP, Go Vulncheck, the Python Packaging Advisory DB, the Ruby Advisory DB, RustSec and community contributions; unreviewed ones published automatically from the NVD feed; malware from npm and OpenSSF | EPSS scores synchronised daily; advisory cadence not stated | not stated | published in OSV format; licence not stated | not stated; not stated; read 2026-11-02 | unreviewed advisories "isn't checked for validity or completion"; "Malware alerts do not contain a fix version"; reviewed coverage limited to twelve ecosystems | Ecosystems outside the twelve, and packages from private registries. | b (LH003 row; re-read) | |
| I34 | EPSS (FIRST): https://www.first.org/epss/data_stats (404); https://www.first.org/epss/faq (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 9 | a daily probability, "between 0 and 1 for every publicly disclosed vulnerability (CVE)", of exploitation activity being observed in the next 30 days | data partners "(and their sensors)" that "detect, record and share evidence of exploitation activity" | "New scores are published each day... typically within a minute or two after 13:30 UTC"; retraining about annually | historical daily files in an archive; range not stated | free, no registration, CSV and API; attribution requested | not stated; not stated; read 2026-11-02 | the model "does not assume we are seeing all of the exploitation activity"; partner telemetry is under agreements "that prohibit redistribution, so the training data cannot be released" | Exploitation its partners' sensors do not see, and its evidence stays private. | c (named in the summary of search L9b) | Parla 2024 (L10): of 57 KEV entries from 2023 or later, 42 had consistently low EPSS scores before listing; more than two thirds of 250 KEV entries in the period were below a 36% threshold just before listing; the author calls EPSS "a trailing indicator of exploitation". A single-author preprint on a purposive sample. |
| I35 | Exploit Database: https://www.exploit-db.com/about-exploit-db (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 9 | "a CVE compliant archive of public exploits and corresponding vulnerable software" | "direct submissions, mailing lists, as well as other public sources" | not stated | not stated | "freely-available"; "provided as a public service by OffSec"; no licence named | not stated; not stated; read 2026-11-02 | "repository for exploits and proof-of-concepts rather than advisories" | Whether any exploit was ever used; a proof of concept is not an attack. | c (named in the summary of search L9a) | |
| I36 | Atlantic Council, Breaking Trust (software supply chain attacks): https://www.atlanticcouncil.org/content-series/cybersecurity-policy-and-strategy/software-supply-chain-security-the-dataset/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 9, 8 | entries for software supply chain attacks and disclosures: 250 entries, 168 attacks and 82 disclosures | not stated (a codebook is offered) | updates in 2020, 2021 and 2023; no schedule | earliest incident year not stated | XLSX dataset and codebook linked for download ("DOWNLOAD DATASET", "DOWNLOAD CODEBOOK") with no account asked; cost and licence not stated | 27 September 2023 (Update 3); not stated; read 2026-11-02 | not stated | Incidents nobody made public; its last update read is from 2023. | c (search L8a result 6, opened) | |
| I37 | SANS Internet Storm Center / DShield: https://isc.sans.edu/data/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 9, 10 | per-port and per-IP "Reports", "Target IPs" and "Sources"; the unit of a report is not defined | not stated (data categories include web logs, SSH and Telnet logs and threat feeds) | not stated (a submissions-per-day chart is linked) | not stated | data shown on the page; an API ("We have an API for you!"); a CC BY-NC-SA 4.0 badge whose scope is not stated | not stated; not stated; read 2026-11-02 | not stated | Only the networks whose volunteers submit logs. | c (named in the summary of search L9b) | |
| I38 | GreyNoise: https://docs.greynoise.io/docs/understanding-greynoise-data-collection (404); https://docs.greynoise.io/docs/introduction (404); https://www.greynoise.io/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 9, 10 | per-IP records of "malicious edge traffic" with classifications and tags for CVE, tooling and campaign | "A global grid of thousands of sensors"; locations not stated | "real-time" | not stated | a "Search for free" link to a visualiser; plans not shown | latest dated item 28 October 2026; not stated; read 2026-11-02 | not stated | Traffic that does not reach its sensors; only the home page could be read, so its own account of its limits is unknown. | c (named in the summary of search L9b) | |
| I39 | WIDE MAWI traffic archive: https://mawi.wide.ad.jp/mawi/ (503); http://mawi.wide.ad.jp/mawi/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 10 | packet traces "made by tcpdump", addresses scrambled | samplepoint-F, "the transit link of WIDE to the upstream ISP", with the BBIX link added on 8 August 2023 | "daily traces" at samplepoint-F | samplepoint-F "in operation since 2006/07/01"; older points from 1999 | "You may use WIDE traffic data for only research purposes"; some aggregated data members only | not stated (latest trace listed 8 April 2026); 1999 to 2026; read 2026-11-02 | "Data is missing from November 4 to December 15 in 2022, due to a hardware failure"; duplicated packets in 2015; "a large amount of ICMP traffic is in the traces since 2013, probing the entire IPv4 space" | One academic network's transit link in Japan; nothing about anyone else's traffic. | c (named in the summary of search L10b) | |
| I40 | Measurement Lab (M-Lab): https://www.measurementlab.net/about/; https://www.measurementlab.net/data/docs/ (WebFetch extract, 2 November 2026; raw re-read 6 November 2026 (data/reads-2026-11-06/)) | 10 | not stated as a unit; the pages name NDT tests ("TCP packet captures are conducted for each NDT test") and "network performance" data | "widely distributed servers"; who starts a test is not stated | not stated | founded "in 2009"; earliest data not stated | "All data collected via M-Lab is made publicly available"; BigQuery and Google Cloud Storage; CC BY 4.0 for the site's original material | not stated; not stated; read 2026-11-02 | not stated | Only paths that someone chose to test; a performance test does not count traffic. Placed on the traffic layer as the nearest, a classification made here. | c (named in the summaries of searches L1a, L6a and L8b) | |
| I41 | CAIDA AS Facilities: https://www.caida.org/catalog/datasets/as-facilities/; https://publicdata.caida.org/datasets/topology/as-facilities/; https://www.caida.org/about/legal/aua/caida_aua.html (raw curl read, 5 November 2026 (data/reads-2026-11-05/)) | 1 | "the mapping of peering interconnections to the interconnection facilities" (file mapped-aslinks.json), with facilities and AS-to-facility lists | Inference: "a large set of traceroutes toward the target ASes", combined with facility lists from "a public data source (e.g., PeeringDB database)" and CAIDA's AS Relationships data | One dataset: "derived using measurement data collected in March-April 2017"; no later edition listed | March to April 2017 only | The catalogue page links a public directory (publicdata.caida.org) listing the data files, which answered without an account on 5 November 2026; "Access to these data is subject to the terms of the following CAIDA Acceptable Use Agreement", whose licence is "solely for the purpose of non-profit research, non-profit education, commercial internal testing and evaluation of the data, or for government purposes" | "This dataset created in April 2017"; the directory's README.txt last modified 2026-08-07; March to April 2017; read 2026-11-05 | "Not all facilities have all fields" | One snapshot from 2017; only interconnections that the traceroutes crossed, placed among facilities that operators declared in PeeringDB. | c (search L1b results 3 and 9) | |
| I42 | DNS Coffee: https://dns.coffee/faq; https://dns.coffee/zones/com; https://dns.coffee/terms (raw curl read, 5 November 2026 (data/reads-2026-11-05/)) | 4 | Names, nameservers and glue addresses seen in zone files: "Most of it is derived from public zone files, DNS queries to public nameservers, and public domain lists"; the com zone's page showed "168,656,928 Domains" on 5 November 2026 | Zone files it imports and queries to public nameservers; "We read zone files, not general DNS lookups" | "Zone files are periodic snapshots"; the com page showed "Last Import Nov 05, 2026" | "DNS Coffee began with four zones in 2011 and now imports over 1200, each with its own start date"; com's "First Import Apr 11, 2011" | Zone and domain pages are readable without an account (the com zone's page was); "DNS Coffee offers a private, authenticated REST API"; the terms mention "Paid subscriptions" and say "Academic and non-commercial access is granted at our discretion"; automated access to the website is not permitted except by search engines; no licence stated | Terms "Last updated 16 October 2026"; 2011 to 5 November 2026 for com; per zone otherwise; read 2026-11-05 | "Zone files are periodic snapshots, so a name that appears and disappears between two imports may not be recorded at all"; "an address serving no in-zone nameserver will not appear here at all"; terms: "We make no guarantee that it is complete, current, or accurate" | Only zones whose files it obtains, and only delegated names in them; names below those, and names in zones it does not import, are unseen. | c (search L4b result 12, opened) | |
| I43 | Docker Hub pull counts: https://docs.docker.com/docker-hub/usage/; https://docs.docker.com/reference/api/hub/latest.yaml; https://hub.docker.com/v2/namespaces/library/repositories/nginx (endpoint check: HTTP 200, 17,842 bytes, no account; body not kept); https://docs.docker.com/docker-hub/usage/pulls/ (2 November extract) (raw curl read, 5 November 2026 (data/reads-2026-11-05/); the pull definition rests on the 2 November WebFetch extract) | 8 | A cumulative pull count per repository (the API's pull_count field); by the 2 November extract of the pulls page, "A Docker pull includes both a version check and any download", and a multi-architecture pull counts once per architecture | Docker's own registry | not stated | not stated | The Hub API specification: "Public repositories are accessible to everyone, while private repositories require appropriate authentication and permissions"; the repository endpoint answered without an account on 5 November 2026; unauthenticated users may pull "100 per IPv4 address or IPv6 /64 subnet" per 6 hours; licence not stated | not stated; not stated (current totals); read 2026-11-05 | not stated | A running total per repository, not per version or per day, and not who pulled; pulls through mirrors and other registries are unseen. | a (LH019, LH025) | |
| I44 | Hugging Face Hub download counts: https://huggingface.co/docs/hub/models-download-stats; https://huggingface.co/docs/hub/api; https://huggingface.co/.well-known/openapi.md; https://huggingface.co/google-bert/bert-base-uncased (raw curl read, 5 November 2026 (data/reads-2026-11-05/)) | 8 | Requests for a model's query files: "Every HTTP request to these files, including GET and HEAD , will be counted as a download"; GGUF files "will double count downloads in the case a user performs cloning" of a repository | "The count is done server-side as the Hub serves files for downloads" | A model page shows "Downloads last month"; update frequency not stated | not stated (the page read shows the last month) | A model page showed "Downloads last month 30,006,776" (google-bert/bert-base-uncased) without an account on 5 November 2026; "We have open endpoints that you can use to retrieve information from the Hub"; the OpenAPI document read names downloads only as a sort field; licence of the counts not stated | not stated; the last month, as labelled; read 2026-11-05 | not stated, beyond the double counting of GGUF files on cloning | Requests for chosen files, not users or uses; copies fetched from mirrors or caches outside the Hub are unseen. | b (LH003 row) | |
| I45 | Netlas: https://netlas.io/pricing; https://netlas.io/legal/data_collection_policy/ (2 November extract) (raw curl read, 5 November 2026 (data/reads-2026-11-05/) (pricing); the policy fields rest on the 2 November WebFetch extract) | 6 | Its free plan offers "internet scan data" and "DNS & IP WHOIS lookups"; by the 2 November extract of its policy, it "collects only externally accessible and publicly available data" | Its own scanning; by the 2 November extract, "Only nonintrusive techniques" | not stated | not stated | "Community Free Forever": "Basic plan for personal use only. 50 requests / day up to 200 results / download 2,5K search results / month"; "The Community subscription plan applies to every new account" (an account is needed) and is for "non-commercial use only"; paid plans above it; licence not stated | Policy last updated 14 September 2026 (2 November extract); pricing page not dated; not stated; read 2026-11-05 | not stated | Only what answers its scanners, and the free plan reads a small slice of it. | c (search L5b result 14, opened) | |
| I46 | Software Heritage graph dataset: https://docs.softwareheritage.org/devel/swh-export/graph/dataset.html (raw curl read, 5 November 2026 (data/reads-2026-11-05/)) | 8 | Exports of the archive's graph, as "Columnar data storage" and a "Compressed graph"; its nodes include origins, snapshots, releases, revisions, directories and contents | The archive's own holdings; how it collects is not stated on the page read | "We aim to provide regular exports"; exports listed include 2025-10-08, 2026-03-02 and 2026-06-04 | Exports from January 2019 (done "in two phases", one of them dated 2018-09-25) to June 2026 | "All datasets below are available publicly and with no login required, subject to the terms of use above" (an Ethical Charter and "Terms of use for bulk access", not read); the largest only from Amazon S3 | not stated; the latest export listed is dated 2026-06-04; Exports dated January 2019 to June 2026; read 2026-11-05 | not stated; the page lists errata, such as an export whose "author and committer timestamps were shifted back 1 or 2 hours" | Source code as archived, not fetches or installs: it says what exists, not who uses it. | b (LH003 row) | |
| I47 | National Vulnerability Database (NVD): https://www.nist.gov/itl/nvd; https://nvd.nist.gov/developers/start-here (script shell only); https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1 (endpoint check: HTTP 200, 2,517 bytes, no key; body not kept) (raw curl read, 5 November 2026 (data/reads-2026-11-05/) (NIST's page); nvd.nist.gov returned a script shell, as in LH003) | 9 | "a repository of information on software and hardware flaws that can compromise computer security"; it enriches CVE records (scores, SSVC and "affected" data, by its updates of 2026) | NIST's analysis of CVE records it receives ("incoming CVEs") | not stated | not stated | "a reliable, sustainable and publicly available source of information about cybersecurity vulnerabilities"; the page links data feeds and an API, and the CVE API answered without a key on 5 November 2026; licence not stated | News items dated 15 April to 26 August 2026; not stated; read 2026-11-05 | "Starting in early 2024, the NVD developed a significant backlog of unenriched CVEs. Unfortunately, we have been unable to clear that backlog"; backlogged CVEs published before 1 March 2026 move to "Not Scheduled" (update of 15 April 2026) | Only flaws with a CVE record, and since 2024 full analysis for a prioritised subset of them. | a and b (LH003 row; LH030) | |
| I48 | RIPEstat Data API: https://stat.ripe.net/docs/data_api; https://www.ripe.net/about-us/legal/ripestat-service-terms-and-conditions/; https://stat.ripe.net/data/routing-status/data.json?resource=AS3333 (endpoint check: HTTP 200, 911 bytes, no account; body not kept) (raw curl read, 5 November 2026 (data/reads-2026-11-05/)) | 2, 3 | "The RIPEstat Data API is the public data interface for RIPEstat"; its endpoints include BGP Updates, Routing History, RIS Peers, Atlas Probes and Address Space Usage | The RIPE NCC's data and others': the terms say the service "contains data that is provided by third parties"; endpoint names point to RIS and RIPE Atlas | not stated | not stated | "No limit on the amount of requests but please register if you plan to regularly do more than 1000 requests/day"; an endpoint answered without an account on 5 November 2026; terms: for "network analysis, network monitoring and debugging and research", no redistribution, no commercial use without written permission, and research results must be notified to the RIPE NCC | not stated; not stated; read 2026-11-05 | Terms: "The RIPE NCC shall not be responsible for the accuracy of this data" (third parties' data) | An interface over RIS, Atlas and registry data: it sees what they see, from the same vantage points. | c (named in the summary of search L3b) |
Notes on rows
I07 Packet Clearing House BGP routing data. The page read is a directory listing. The search summary's figure of more than 225 exchange points was not on it and is not used.
I41 CAIDA AS Facilities. Undetermined in version 0.1 (the request form was read, not the public directory). Draws on PeeringDB (I01) and CAIDA's AS Relationships (I08), by its own page.
I42 DNS Coffee. Undetermined in version 0.1 (only the FAQ was read). The FAQ and the com zone page were fetched with curl before the terms were read; the terms prohibit accessing the website "by automated means, except search engines", so no further page was fetched.
I43 Docker Hub pull counts. Undetermined in version 0.1 (the pages then read said most endpoints need authentication).
I44 Hugging Face Hub download counts. Undetermined in version 0.1 (the documentation did not say where counts are published); settled by a model page that shows one. Five fetches, one more than the round's guide of about four.
I45 Netlas. Undetermined in version 0.1 (only the collection policy was read). Included on a free tier that needs an account, which the brief allows ("a free tier counts").
I46 Software Heritage graph dataset. Unreadable in version 0.1. On 5 November its home page failed a TLS check from this container (curl exit 60); the documentation host answered.
I47 National Vulnerability Database (NVD). Unreadable in version 0.1 (nvd.nist.gov returned only its title). Read through NIST's own page about it. Draws on the CVE List (I31).
I48 RIPEstat Data API. Unreadable in version 0.1 (the documentation URL tried returned 404). Draws on RIPE RIS (I06) and RIPE Atlas (I10), by its endpoint names.
Counts by layer
| Layer | Included, any layer | Included, primary layer | Undetermined | Unreadable |
|---|---|---|---|---|
| 1 Physical and interconnection | 5 | 5 | 0 | 1 |
| 2 Routing | 7 | 5 | 0 | 0 |
| 3 Addresses and reachability | 6 | 2 | 1 | 0 |
| 4 Names | 4 | 2 | 1 | 0 |
| 5 Certificates | 3 | 1 | 0 | 0 |
| 6 Running services and their software | 4 | 3 | 1 | 0 |
| 7 Web content and technology | 5 | 5 | 0 | 0 |
| 8 Software supply | 12 | 11 | 0 | 0 |
| 9 Vulnerability and exploitation records | 13 | 11 | 0 | 0 |
| 10 Traffic | 7 | 3 | 0 | 0 |
Candidates without a row
Inclusion test applied (a decision made in this run, recorded in LH035.md, Method): a row is included when the pages read show data, link to data files, or describe the data as public, published, free or openly licensed. Undetermined: the pages read put the data behind an account, request, credentials or subscription without saying any of it is free, or say nothing of its availability, so the brief's rule could not be applied; not tabulated. Unreadable: the pages could not be read in this run; inconclusive, not excluded. Excluded: fails a rule of the brief.
| Candidate | Class | Layers | Origin | Pages tried | Reason |
|---|---|---|---|---|---|
| USC/ISI ANT datasets (censuses, hitlists, outages, Trinocular) | undetermined | 3 | c (search L3a result 4, opened) | https://ant.isi.edu/datasets/ (2 and 5 November); https://ant.isi.edu/datasets/requests.html (5 November); https://ant.isi.edu/datasets/all.html (5 November) | Still undetermined on 5 November (raw reads). The list of all datasets says they "are available through the LANDER project's participiation in the PREDICT program , or on request through the e-mail address listed below"; the requests page asks for the datasets wanted, the research project, "e-mail sent from your institution" and a justification, and says "You will need to sign the data use agrement". No page read says whether access is free or that any dataset is public. The datasets page states censuses that "ping every allocated IP address one time over about two months", "2 censuses every 2-4 months since 2006", and "We used to provide geolocation data but no longer can". |
| ICANN Centralized Zone Data Service (CZDS) | undetermined | 4 | c (ICANN's public data announcement, search L4b result 2, not opened; CZDS page read directly) | https://czds.icann.org/help (2 and 5 November); https://www.icann.org/resources/pages/czds-2014-03-03-en (5 November); http://newgtlds.icann.org/en/program-status/czds/terms-conditions-30sep13-en.pdf (5 November) | Still undetermined on 5 November (raw reads). An account and each registry's approval are needed: "Every new gTLD Registry is required to provide zone data to approved requesters (e.g. law enforcement agents, IP attorneys, researchers)"; the terms of 30 September 2013 grant "a nonexclusive, nontransferable, limited right to access and use for any legal purpose", forbid redistribution without the registry's consent and limit access to "no more than once per 24-hour period". No page read states a cost or a fee, either way. Covers "participating generic Top-Level Domains (gTLDs)"; for others, "contact the Registry Operator directly". |
| Shodan | undetermined | 6 | c (named in search summaries L5a, L6b, L9b) | https://help.shodan.io/the-basics/what-is-shodan (2 and 5 November); https://www.shodan.io/pricing (403 on 2 and 5 November); https://developer.shodan.io/pricing (403); https://internetdb.shodan.io/ (404, a JSON 'No information available') | Still undetermined on 5 November (raw reads). Both pricing pages returned HTTP 403 with a browser challenge ("Just a moment..."); the help page describes "banners, which are metadata about a software that's running on a device" and links "Pricing", "Membership" and "API Subscriptions" but states no free access. The InternetDB host's root returned 404 and no documentation was read for it. |
| Internet Atlas (University of Wisconsin) | unreadable | 1 | c (named in the summary of search L1a) | https://internetatlas.org/ (2 November; curl exit 56 and WebFetch EAI_AGAIN on 5 November); http://internetatlas.org/ (curl exit 6, host not resolved, 5 November) | Still unreadable on 5 November: the host did not resolve, or the connection failed, by curl over HTTPS and HTTP and by WebFetch. No other address for it was tried. |
| Rapid7 Project Sonar / Sonar data | excluded | 3, 4, 5, 6 | c (search L6b result 10 variant; LH003 excluded it unread) | https://www.rapid7.com/research/project-sonar/; https://opendata.rapid7.com/about/ (301); https://sonardata.rapid7.com/about/ | A commercial product with no public data: access "granted on a commercial basis to qualified organizations" since a policy change of 10 February 2022. |
| ITSA, Internet Traffic Statistics Archive (University of Twente) | excluded | 10 | c (search L10b result 3, opened) | https://research.utwente.nl/en/publications/itsa-internet-traffic-statistics-archive/ | Only a 2016 publication record was read (weekly reports from NetFlow since 2013); it gives no address for the archive and nothing read shows the data are still kept available. |
| Public IXP traffic compilation (472 exchanges, 2023 to 2024) | excluded | 10 | c (search L10b result 11, opened; the study is L10a result 5 and L10b result 1) | https://pulse.internetsociety.org/en/blog/can-ixps-take-the-pulse-of-the-internet/ | A one-off study (blog post of 9 April 2026 on a NINeS 2026 paper) of exchanges' own public graphs; the compiled data are not stated as kept available. Its stated limit, "Public IXP data does not include private interconnections", is recorded in the record's Findings. The exchanges' graphs themselves are each an exchange's view of its own estate. |
| Cloudflare AI Crawl Control | excluded | 10 | b (LH003 row) | not re-read | An organisation's view of its own customers' zones, needing an account for the zone; its subject is AI crawlers (LH003's subject). Not re-read. |
| OpenRouter rankings; Anthropic Economic Index; OpenAI usage paper; AI Incident Database | excluded | none | b (LH003 rows) | not re-read | Their subject is AI activity and they observe none of the ten layers. Not re-read. |
| Epoch AI's other datasets (models, chips, polling) | excluded | none | b (LH003 row) | not re-read | AI subject with no layer here; only its data-centre dataset has a row (I03). |
Leads not reached
Named in a search result or a search summary, not opened within the ceiling; leads only, with no row and no claim about them. Layer is the one the lead's wording suggests.
- iGDB, a research database of physical and logical topology (L1b result 4; layer 1)
- M-Lab's IP Route Survey (IPRS) dataset (L2a result 2; layer 2)
- NPD-Routes traceroutes, 1994 to 1995 (L2a result 1; layer 2)
- TARTAN traceroute dataset (IEEE DataPort) (L2a results 7 and 8; layer 2)
- GEANT and Abilene traffic matrices (L2a result 10; L10a result 2; layer 10)
- RIPE NCC Internet measurement data repository (L4a result 7; layer 3)
- CAIDA DNS Names dataset; WAND WITS traces (L4a summary; layer 4)
- ICANN's new public data page (announcement of 15 June 2026) (L4b result 2; layer 4)
- Net Data Directory (Berkman) (L4b result 9; layer unclear)
- EFF SSL Observatory (L5b result 11; layer 5)
- UpGuard CyberResilience; Zondex; Cambridge CCCC scanner (L6b results 2, 4, 8; layer 6)
- KIT web measurement datasets (L7a results 1 to 7; layer 7)
- Similarweb website datasets (commercial) (L7a result 5; layer 7)
- CodeSupply (EU Horizon project) (L8b result 3; layer 8)
- OSPtrack package-behaviour dataset (L8a results 4 and 5; layer 8)
- Vulners; VulnCheck; cyberdetails.org corpus (L9b results 5 to 7; L9a result 6; layer 9)
- DScope cloud telescope (L9a result 3; layer 9)
- ZoomEye (L9b summary; layer 6)
- MIRAGE-2019 mobile traffic; NDN testbed traces; CAIDA passive traces (L10a results 4 and 6; L10a summary; layer 10)
- Internet Society Pulse IXP tracker (a menu link on the page read) (L10b result 11; layer 10)
Instruments named only in papers read (leads outside the fixed plan, not read): OpenINTEL (L07's ground truth), bgp.tools (L06), the Merit and SURF telescopes (L09), Fofa, BinaryEdge and ONYPHE (L01), Hispar (L08).
Literature opened
| Id | Paper | URL and search result | How read | Rows | Method | Findings used | Limits |
|---|---|---|---|---|---|---|---|
| L01 | Durumeric, Clark, Cody, Cubit, Ellison, Izhikevich, Mirian. Censys: A Map of Internet Hosts and Services. ACM SIGCOMM 2025. | https://zakird.com/papers/censys-2025.pdf (P1 result 4) | PDF, text extracted with pdftotext | I12 | Coverage against a random 0.1% sub-sample of IPv4 services across all 65K ports scanned with ZMap for one week from 20 August 2024 (4.1 million services), and against Shodan, Fofa, ZoomEye and Netlas by querying 10K random addresses. | "Censys sees 98% of IPv4-based services on the top 10 ports, 97% of the top 100 ports, and 62% of services across all 65K ports"; daily BigQuery snapshots, after three months one weekday snapshot a week kept; 1,221 researchers given access 2018 to 2024. | Written by Censys's own staff. "we do not conduct comprehensive IPv6 scans" and IPv6 is not evaluated; "no ground truth dataset of Internet services exists"; "We restrict access to data that is ripe for abuse"; "intelligent 65K port scanning remains an unsolved problem"; other engines "do not provide access to raw data", so comparison is indirect. |
| L02 | Bennett, Abdou, van Oorschot. Empirical Scanning Analysis of Censys and Shodan. NDSS MADWeb workshop 2021. | https://www.ndss-symposium.org/wp-content/uploads/madweb2021_23009_paper.pdf (P1 result 8) | PDF, text extracted with pdftotext | I12 | Virtual machines in five locations (San Jose, Tokyo, Montreal, Paris, Sao Paulo) on AWS ran four services and recorded scans and banner grabs; planted tokens measured freshness. | "both engines made all captured tokens visible within 24 hours"; 65% within about 15 hours; Shodan 20% within 5 hours. | Described by its authors as an in-progress snapshot; "Censys/Shodan maybe scanning Amazon's AWS VMs different from non-Amazon devices"; TCP only. |
| L03 | Le Pochat, Van Goethem, Tajalizadehkhoob, Korczynski, Joosen. Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation. NDSS 2019. | https://ar5iv.labs.arxiv.org/html/1806.01156 (P2 result 7) | HTML, first 100,000 of 107,266 characters through the fetch tool | I14 | Alexa, Umbrella, Majestic and Quantcast lists from 1 January to 30 November 2018; similarity, stability, representativeness, responsiveness, benignness; manipulation experiments; survey of 133 papers. | The four lists held about 2.82 million sites and agreed on about 70,000; Umbrella changed about 10% a day; all four were manipulated. | Tranco inherits its sources' biases and they "remain susceptible to manipulation" if all are manipulated; findings tied to provider behaviour in 2018. |
| L04 | Certificate Perspectives (IMC 2016), as titled in the search result; not read. | https://faculty.cc.gatech.edu/~mbailey/publications/imc16_certperspectives.pdf (P3 result 6) | failed: HTTP 503 | The search summary's figure (90.5% of browser-trusted certificates in CT logs) was not read in the paper and is not used. | |||
| L05 | Sermpezis, Prehn, Kostoglou, Flores, Vakali, Aben. Bias in Internet Measurement Platforms. arXiv 2307.09958 (v2, July 2023). | https://arxiv.org/html/2307.09958v2 (P5 result 1 (opened as the abstract page and the HTML version)) | HTML through the fetch tool | I01, I05, I06, I10 | Bias as the distance between the distribution of more than 100,000 ASes and of the ASes hosting vantage points, over 22 characteristics; Kolmogorov-Smirnov tests and a bounded KL divergence score 0 to 1. | Average bias Atlas 0.06, RIS 0.16, RouteViews 0.15, combined collectors 0.14, a random sample 0.00 to 0.01; "RIPE RIS is heavily biased towards larger networks and IXPs"; Atlas default probe selection about twice as biased as random. | AS level only; "only 25% of ASNs have records in PeeringDB"; not every dimension matters to every study; effects on results not studied. |
| L06 | Alfroy, Holterbach, Krenc, Claffy, Pelsser. Measuring Internet Routing from the Most Valuable Points. arXiv 2405.13172 (v1, May 2024). | https://arxiv.org/html/2405.13172 (P4 result 8) | HTML, first 100,000 of 106,308 characters through the fetch tool | I05, I06, I08 | Scores RIS and RouteViews vantage points by redundancy using about 7,500 new-link events and 15 topological features; simulation and comparison with a private collector. | "A tiny fraction (1.3%) of the 74k ASes" host a vantage point, 8.4% of transit ASes; RIS 1,526 and RouteViews 1,071 vantage points in May 2023; bgp.tools saw 192k AS links no RIS or RouteViews point saw, and they saw 401k it missed. | Simulated topology differs from the real one; "cannot know how much additional topology we might observe from VPs that do not peer with the public collection systems"; approximate ground truth for hijacks. |
| L07 | Sommese, van Rijswijk-Deij, Jonker. This Is a Local Domain: On Amassing Country-Code Top-Level Domains from Public Data. arXiv 2309.01441 (preprint, September 2023). | https://arxiv.org/html/2309.01441v1 (P3 result 2 (opened as the abstract page and the HTML version)) | HTML through the fetch tool | I16, I21 | Registered domains under ccTLDs from 38 CT logs (certificates valid from 2017) and 58 Common Crawl snapshots (June 2017 to June 2023), compared yearly on 1 June 2018 to 2023 with OpenINTEL zone data for 19 ccTLDs. | In 2023 the public sources covered 43% (.us) to 80% (.ee) of zones, weighted 59%; CT 52%, Common Crawl 31%, Common Crawl alone 7%; 37% in 2018. | 19 of over 300 ccTLDs, "may be somewhat biased towards specific regions"; CT gives no reliable publication time; only CT and Common Crawl examined. |
| L08 | Aqeel, Chandrasekaran, Feldmann, Maggs. On Landing and Internal Web Pages: The Strange Case of Jekyll and Hyde in Web Performance Measurement. ACM IMC 2020. | https://par.nsf.gov/servlets/purl/10202310 (P6 result 5) | PDF, text extracted with pdftotext | I19 | Landing and internal pages of 1,000 sites compared; 119 web-performance papers from 2015 to 2019 reviewed; Hispar list built. | Internal pages "differ substantially" from landing pages; 41 papers need no revision, 48 minor and 30 major, so "nearly two-thirds" need revision to apply to internal pages. | "sample bias of selecting the top roughly 2000 web sites"; does not measure pages "behind a user log-in". |
| L09 | Degen, Kempen, claffy, Mok, Holz, van Rijswijk-Deij, Sommese, Jonker. Through a Smaller Lens: Revisiting Opportunistic Analysis using Network Telescopes. 2026 (hosted in CAIDA's catalogue; venue not recorded). | https://www.caida.org/catalog/papers/2026_through_smaller_lens/through_smaller_lens.pdf (P7 result 4) | PDF, text extracted with pdftotext | I13 | Traffic to three telescopes (UCSD-NT 10.9 million monitored addresses, MERIT-NT 476 thousand, SURF-NT 66.3 thousand) in April 2025, replicating a study of ten years before. | "smaller telescopes offer higher visibility per monitored address"; "37.0% of them targeting a /16 block in each of the three telescopes within an hour"; "larger telescopes detect many attacks missed by smaller ones". | Shorter period and smaller telescopes than the original study; UCSD-NT captures unavailable 2025-04-11 18:00 to 23:59; seven random one-hour samples for some analyses. |
| L10 | Parla. Efficacy of EPSS in High Severity CVEs found in CISA KEV. arXiv 2411.02618 (v1, November 2024), single author, independent. | https://arxiv.org/html/2411.02618v1 (P8 result 3) | HTML through the fetch tool | I30, I34 | 90 KEV entries with CVSS 9.0 or more added 15 March 2023 to 1 July 2024; EPSS score histories against disclosure, listing and first exploitation dates. | 42 of 57 KEV entries from 2023 or later had consistently low EPSS before listing; more than two thirds of 250 KEV entries in the period were below 36% just before listing. | Small purposive sample; EPSS features and data not public; KEV "is also a subset of all exploited CVEs"; untested assumptions. |
| L11 | Gustafsson, Overier, Arlitt, Carlsson. A First Look at the CT Landscape: Certificate Transparency Logs in Practice. PAM 2017. | https://www.ida.liu.se/~nikca89/papers/pam17.pdf (P3 result 4) | PDF, text extracted with pdftotext | I16 | A monitor over the public logs submitted to Chrome to December 2015 (three Google, seven CA-operated) and NORDUnet's log, beside 232 million HTTPS sessions on a university network. | "for almost all domains observed in the university traces, there is at least one log with a valid DV certificate (despite such logging being voluntary for all CAs except Symantec)". | Data end in 2015, before CT was required by browsers; one campus's traffic. |
Every fetch, 2 November 2026
100 page fetches (87 for instruments, 13 for papers), of which 75 returned readable content; redirects and failures are counted as fetches. Searches: 28 (20 survey, 8 literature).
Every read, 5 November 2026
37 fetches of the twelve candidates without a row in version 0.1: raw reads with curl (User-Agent "Lighthouse-research/1.0"), each body saved in data/reads-2026-11-05/ with its SHA-256 as fetched, three public endpoints checked once for status and size with no body kept, and one WebFetch fallback. Embedded page-furniture keys were redacted from six saved bodies after hashing (data/reads-2026-11-05/REDACTION.txt).
| File | URL | Start (UTC) | Status | Bytes |
|---|---|---|---|---|
| 01-caida-asfac.html | https://www.caida.org/catalog/datasets/as-facilities/ | 2026-11-05T14:21:30Z | 200 | 38931 |
| 02-isi-datasets.html | https://ant.isi.edu/datasets/ | 2026-11-05T14:21:31Z | 200 | 18754 |
| 03-czds-help.html | https://czds.icann.org/help | 2026-11-05T14:21:33Z | 200 | 23697 |
| 04-dnscoffee-faq.html | https://dns.coffee/faq | 2026-11-05T14:21:33Z | 200 | 15429 |
| 05-docker-usage.html | https://docs.docker.com/docker-hub/usage/ | 2026-11-05T14:21:34Z | 200 | 529875 |
| 06-hf-dlstats.html | https://huggingface.co/docs/hub/models-download-stats | 2026-11-05T14:21:34Z | 200 | 201103 |
| 07-shodan-pricing.html | https://www.shodan.io/pricing | 2026-11-05T14:21:34Z | 403 | 5371 |
| 08-netlas-pricing.html | https://netlas.io/pricing | 2026-11-05T14:21:35Z | 200 | 157539 |
| 09-swh-home.html | https://www.softwareheritage.org/ | 2026-11-05T14:21:35Z | error(curl exit 60) | 0 |
| 10-nvd-start.html | https://nvd.nist.gov/developers/start-here | 2026-11-05T14:21:36Z | 200 | 2268 |
| 11-internetatlas.html | https://internetatlas.org/ | 2026-11-05T14:21:36Z | error(curl exit 56) | 0 |
| 12-ripestat-docs.html | https://stat.ripe.net/docs/data-api/ | 2026-11-05T14:21:43Z | 404 | 146 |
| 13-caida-aua.html | https://www.caida.org/about/legal/aua/caida_aua.html | 2026-11-05T14:21:57Z | 200 | 11796 |
| 14-caida-publicdata-asfac.html | https://publicdata.caida.org/datasets/topology/as-facilities/ | 2026-11-05T14:21:58Z | 200 | 6448 |
| 15-isi-requests.html | https://ant.isi.edu/datasets/requests.html | 2026-11-05T14:22:11Z | 200 | 4849 |
| 16-isi-all.html | https://ant.isi.edu/datasets/all.html | 2026-11-05T14:22:17Z | 200 | 903121 |
| 17-icann-czds.html | https://www.icann.org/resources/pages/czds-2014-03-03-en | 2026-11-05T14:22:30Z | 200 | 160757 |
| 18-czds-terms-30sep13.pdf | http://newgtlds.icann.org/en/program-status/czds/terms-conditions-30sep13-en.pdf | 2026-11-05T14:22:39Z | 200 | 47644 |
| 19-dnscoffee-zone-com.html | https://dns.coffee/zones/com | 2026-11-05T14:22:57Z | 200 | 638497 |
| 20-dnscoffee-terms.html | https://dns.coffee/terms | 2026-11-05T14:22:58Z | 200 | 15490 |
| 21-dockerhub-api-latest.yaml | https://docs.docker.com/reference/api/hub/latest.yaml | 2026-11-05T14:23:13Z | 200 | 175089 |
| (endpoint check; body not kept) | https://hub.docker.com/v2/namespaces/library/repositories/nginx | 2026-11-05T14:23:20Z | 200 | 17842 |
| 22-hf-api.html | https://huggingface.co/docs/hub/api | 2026-11-05T14:23:31Z | 200 | 185139 |
| 23-hf-download-analytics.html | https://huggingface.co/docs/hub/download-analytics | 2026-11-05T14:23:40Z | 200 | 194249 |
| 24-hf-openapi.md | https://huggingface.co/.well-known/openapi.md | 2026-11-05T14:23:59Z | 200 | 407903 |
| 25-hf-model-page.html | https://huggingface.co/google-bert/bert-base-uncased | 2026-11-05T14:24:12Z | 200 | 252675 |
| 26-shodan-internetdb.html | https://internetdb.shodan.io/ | 2026-11-05T14:24:18Z | 404 | 37 |
| 27-shodan-help-basics.html | https://help.shodan.io/the-basics/what-is-shodan | 2026-11-05T14:24:18Z | 200 | 9563 |
| 28-shodan-dev-pricing.html | https://developer.shodan.io/pricing | 2026-11-05T14:24:28Z | 403 | 5375 |
| 29-swh-docs-graph-dataset.html | https://docs.softwareheritage.org/devel/swh-export/graph/dataset.html | 2026-11-05T14:25:04Z | 200 | 230534 |
| 30-nist-itl-nvd.html | https://www.nist.gov/itl/nvd | 2026-11-05T14:25:32Z | 200 | 111339 |
| (endpoint check; body not kept) | https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1 | 2026-11-05T14:25:32Z | 200 | 2517 |
| 31-internetatlas-http.html | http://internetatlas.org/ | 2026-11-05T14:25:56Z | error(curl exit 6) | 0 |
| 32-ripestat-docs.html | https://stat.ripe.net/docs/data_api | 2026-11-05T14:26:08Z | 200 | 72215 |
| 33-ripestat-terms.html | https://www.ripe.net/about-us/legal/ripestat-service-terms-and-conditions/ | 2026-11-05T14:26:09Z | 200 | 123575 |
| (endpoint check; body not kept) | https://stat.ripe.net/data/routing-status/data.json?resource=AS3333&sourceapp=lighthouse-research | 2026-11-05T14:26:26Z | 200 | 911 |
| (WebFetch fallback; no body) | https://internetatlas.org/ | 2026-11-05T14:27:03Z | error: getaddrinfo EAI_AGAIN (WebFetch) | 0 |
From studies/LH035/sources.md in the repository, last changed 6 November 2026.