Explain hostile automation with evidence and honest coverage.

Build citable analysis from bounded observations with a stated window and method.

The job to be done

Study observed scanning and exploitation while preserving provenance, denominators and uncertainty. Distinguish verified identity, inferred behavior and claims in every finding.

What you get in five minutes

Explore public aggregates and the delayed, coarse 1-in-100 sample.
Read the methodology and citation guide; record the UTC observation window, source URL and access date.

Every week

Compare protocol and category activity in the accessible observation window without treating a short collection period as a baseline.
Use an approved Researcher key for reproducible bounded samples, recording methodology changes and withheld cells.

Put the evidence to work

Public data: Public samples and aggregates are CC BY 4.0; preserve attribution, observation window and limitations.
API keys: Approved Researcher access is free and limited to aggregates and the bounded sample; event rows need Professional.
Events: The free Console view previews the public sample. Paid access unlocks filtered event observations.

Choose the access you need

Start with Public. The approved, free Researcher plan permits up to 500 sample rows per call, 2,000 sample rows per day and a seven-day sample window, delayed at least 60 minutes. Professional adds proprietary event rows and stream access; Enterprise adds bounded proprietary exports. Paid access does not grant redistribution or training rights.

Console → Billing

Start with an observation.

Explore the free tiers, then choose the evidence and delivery your workflow needs.

Start free See pricing