Entities
Addresses
A single address: which operator runs it, how it was discovered, and what else sits on its network.
The most common entry point. Shows the verdict, the observations behind it, the surrounding network, and where to go next.
Two discovery channels
An address reaches the dataset by one of two independent channels. The distinction bears on how an answer should be weighted.
| Channel | What happened | Method |
|---|---|---|
| Probing | We connected through the provider and observed this exit | probe |
| Scanning | The host answered on a port VPN infrastructure uses | scan |
Probing is the stronger claim: traffic was routed through the service and egressed here. Scanning establishes that infrastructure is present without proving egress. Both are evidence; only probing produces a time series.
Sharing
sharing.iocValue states whether the address identifies the actor or only the service. On a commercial VPN exit shared by thousands of users, the address is a weak indicator regardless of attribution confidence. This is stated explicitly rather than left to inference.