Getting started
Reading a verdict
Attribution, confidence, evidence and freshness: what each component asserts.
A verdict has four components, each answering a different question. Conflating them is the most frequent misreading.
| Part | Answers | Does not answer |
|---|---|---|
attribution[].provider | Whose infrastructure | Confidence in it |
attribution[].weight | Share of observations attributed to them | Evidential strength |
confidence | Evidential strength | Provider dominance |
evidence.freshness | Currency of the observation | Whether it was ever strong |
Weight and confidence are independent
CyberGhost holds 41.6 % of AS9009 across 9,227 observed addresses. The weight is moderate because the network is shared; the confidence is maximal because 9,227 observations establish presence beyond doubt. Combining the two would downgrade a well-evidenced finding solely for sharing a host.
Confidence
| Value | Means | Threshold |
|---|---|---|
| 3 | Strong | 50 or more observed addresses |
| 2 | Moderate | 5 to 49 |
| 1 | Weak. Corroborate before acting | Fewer than 5, or feed-only |
Freshness
| Value | Own observations | External lists |
|---|---|---|
fresh | Observed within 7 days | Within 3× the source refresh interval |
aging | 8 to 30 days | Within 12× |
stale | Over 30 days | Beyond that |