Close

Method and definitions

This view shows the 1,769 group one websites in the Hidden in Plain Sight data pack, frozen on 30 September 2026. Each mark is one website. No website in the sample is named. Nameservers run by operators (such as g6h2j9d5.top) are shown as technical selectors; none is a website in the sample.

• 225 Tor sites in the data pack are held and never counted.

Site types

Layers

How names were tidied

• Registrars are merged by ICANN registrar ID, so spellings such as "NameSilo, LLC" and "NameSilo,LLC" count once.
• DNS providers are reduced to the provider, so njalla.in, njalla.no and njalla.fo count as Njalla.
• Cloudflare, Fastly and DDoS-Guard are treated as CDNs or proxies, not hosts. Behind them the real host is not visible.
• Five Hong Kong resellers that share address space are grouped as Hong Kong cloud resellers.
• Where a site runs its own nameservers or mail, the provider is shown as self-hosted and the name is withheld.
• Personal names and personal email addresses on IP registration records are withheld.

Shared infrastructure

Two sites are linked when they share a server address (excluding CDNs, large shared platforms and domain parking), an identical set of operator-run nameservers, or a search engine verification token. Linked sites form groups.

Reading the figures

• Every figure states its base. Coverage differs by layer because not every record could be collected for every site.
• Country is the country on the IP address's registration record, not proof of physical location.
• First seen is the earliest sighting in passive DNS, so a site has been active since at least that date.