◊ Continuous random-sample observatory

Reachable Web Observatory

distinct hosts
service records
%
cleartext · services
latest · not available UTC

A continuously updated random sample of the reachable public-IPv4 web. Stored observations cover five common web ports; this is not a full internet inventory or a vulnerability scan.

The Observatory draws a uniform-random sample of public-IPv4 addresses, captures what an anonymous visitor would see on a handful of common web ports, and enriches each host with public host-level CVE and reputation data. It is a research instrument, not a search engine — a sampled collection paired with daily aggregate snapshots, rather than a directory or a retained history of every capture.

◊ The question

Across a uniform random sample of the reachable public-IPv4 web, where do CVE-associated and reputation-flagged services concentrate — by network, geography, product, and port — and how does that change over time?

◊ What to look for

  • How much of the reachable web still serves cleartext HTTP
  • CVE-associated services clustering by network (ASN) and product
  • Geographic concentration of flagged hosts
  • How these shift over time as the sample accrues

Draw a random capture below, or browse all hosts observed to date → (all-time totals; the Stats page defaults to a recent window).

LOADING…
LOADING— — —

◊ Explore observation origins

open full map →
Layer
Window
Newest geolocated service per host in the last 24 hours. One newest matching service represents each host.
at-risk ring · 0

0 mapped hosts: 0 HTTPS, 0 cleartext HTTP, 0 at-risk. Drag to pan; use the controls or mouse wheel to zoom.

1.0×
drag to pan · wheel/double-click to zoom · select a marker for details
◌ UPDATING MAP…

Coarse IP-based geolocation—an approximate region, never a precise server location. The basemap is bundled locally; viewing it sends no requests to Google, OpenStreetMap, or another tile provider.

◊ Representative observations

full feed →