Evidence
How the coverage figure is built
Three evidence layers, counted as a union rather than a sum, each labelled by strength.
The figure on the front page is the volume of anonymised address space the dataset can make a statement about. It spans the whole record rather than a recent window: an analyst reconstructing an intrusion discovered ten months late needs the addresses that were live then. Its three inputs differ in evidential strength and are reported separately.
| Layer | What it is | Method |
|---|---|---|
| Measured | Every exit address our own probing has observed, across the whole record | probe |
| Interpolated | Prefixes where our probing reached at least 10 % of the addresses, so the rest of the block is inferred | inferred |
| From external lists | Netblocks published sources attribute to anonymising services | feed |
Why interpolate at all
Where 30 of the 256 addresses in a block are observed and the block demonstrably belongs to one provider, treating the remaining 226 as unknown understates the evidence. Allocation practice does not support a provider holding a /24 and using a tenth of it. The threshold is 10 %: below it the block may be shared; above it the inference is defensible.
Union, not sum
The layers overlap substantially: most measured addresses fall inside an interpolated prefix, and many of those fall inside a listed netblock. Summing the three totals would count the same addresses up to three times. The ranges are therefore merged, and each layer reports only its marginal contribution. The rows sum correctly because they are differences, not independent totals.
What is left out
- Datacenter and cloud ranges. AWS, GCP, Cloudflare and comparable sources describe hosting, not anonymising services. A datacenter host is not by itself a VPN exit.
- Abuse feeds. Spamhaus DROP indicates a network is listed for abuse, which is context rather than evidence of anonymisation.
- IPv6. Not collected by probing. Some lists cover it, but the figure is IPv4 only.
- No time window. Addresses retired months ago still count. Whether one was live on a given date is a point-in-time question, answered per address rather than by filtering this total.
Recomputed by scripts/compute-coverage.ts whenever the data or feeds are refreshed. If it has not run, the page shows the measured count alone rather than an uncomputed estimate.