Evidence
Methods and evidence
probe, scan, cert, feed: what each method establishes and what it does not.
Every claim carries the method that produced it. The methods are not interchangeable; the ordering below reflects evidential strength.
| Method | What happened | Strength |
|---|---|---|
probe | Traffic was routed through the provider and egressed here | Direct observation |
cert | The TLS certificate issuer names the provider | Strong. Operators sign with their own CA |
scan | The host responded on a port used by this infrastructure | Presence established, egress not proven |
feed | An external list asserts it | Third-party measurement. Publisher and retrieval date attached |
inferred | Derived from neighbouring observations | Weakest. Treat as a lead |
Feeds never become measurements
External lists supplement gaps and never override a measurement. Attribution weights derive from our own probing and scanning only. Where a list names a provider, it appears under method: "feed" with the publisher, keeping retrieved data distinguishable from measured data. See External sources.