Provenance: Programming:Cloudflare Radar

Back to Cloudflare Radar. Corpus-wide selection and extraction notes are on corpus. This is the page-specific query log.

Run record

Run date: 2026-08-27 (UTC).
Authoring agent: Cursor Grok 4.6, executing the drain item programming:cloudflare_radar (new) directly rather than via claude -p. Review: four passes on GPT 5.6 Sol medium (see below).
Corpus at run time: 5,859 extracted papers, 2010–2026, CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P. Read-only inputs under /workspace/publications_dataset/data/.
Read first: data/extract/OVERVIEW.md, the task spec, website_selection, tranco, Radar API docs, the 2022-09-30 launch post, Tranco methodology, Radar About (via Playwright; curl is 403).
Target page had no revision (core.getPageInfo “does not exist”). Creation, not an extension. website_selection already promised this API page and had two TODO boxes for advantages/limitations.
No Cloudflare API token in this environment. Unauthenticated ranking/top is HTTP 400 / code 9106; that path was executed. The authenticated download is specified, not demonstrated.
No write to the publication mount. Wiki saves through scripts/dw.mjs.

Why this page, not an overlap

website_selection already names Radar as list #3 and links here. tranco already says Radar is a 2023 default input, CC BY-NC 4.0, buckets converted by geometric mean. Those pages answer “pick which list” and “how Tranco mixes Radar”. This page answers “what the file actually contains, which API calls to make, and that a bucket is not a rank”. I created the promised child and filled the two selection-page TODOs rather than widening either neighbour. Farsight's TODO is untouched (a later item).

Population and queries

All counts are papers unless labelled tuples.

Query	Denominator	Result
full-text `/cloudflare[\s-]?radar/i` on `paper.cols.txt`	5,859 (4 missing `.cols`)	31
`population[].sourceList` matching the same regex	5,859	6
`tools[].name` matching the same regex	5,859	5
UNION of the three	5,859	32 (31 + 1 schema-only Cuba embargo paper; `.cols` splices “Cloudflare's” / “Radar API”)
Hand ROLE = sample / lookup / ingest / attack over the union	32	9 Domain Rankings uses (0.2% of corpus; 3 of 1,120 crawled)
ROLE = other	32	17 — BGP, TLS, outages, HTTP, categories, …
ROLE = citation	32	3
ROLE = tranco-input	32	3
sourceList papers that are not a Rankings use	6	2 (PathProb route leaks; RPKI hijack alerts)
Rankings-used papers with no sourceList hit	9	5
tracker-radar full-text overlap with this union	32	0

Membership of “Cloudflare Radar” is the regex. Homographs that do not match (DappRadar, Tracker Radar, Weather Radar, Qrator.Radar, PASSKEYS-RADAR) are excluded by requiring “cloudflare”. Regex residue is 0 by construction. ROLE residue is 0; the report exits 1 if a union hit has no verdict or a verdict has no hit.

Cuba embargo was first labelled lookup because tools[] says “Cloudflare Radar API”. Reading the spliced sentence: they used the category API, not Domain Rankings. Relabelled other before the page was drafted. Rankings-used moved 10 → 9.

Folding

Five sourceList spellings (4+1+1+1+1 papers; Ahmad has three tuples). Two tools[] spellings (“Cloudflare Radar” 4, “Cloudflare Radar API” 1). Exact string “Cloudflare Radar” undercounts the union because most ranking uses never reach sourceList.

Evidence quotes

32 ROLE deciding sentences against paper.cols.txt: 30 exact, 1 partial (75%), 1 spliced, 0 failed. The partial is the DNS-HTTPS Tranco-input sentence (column mix with CrUX). The splice is Cuba; the intended sentence is in paper.norm.txt. Load-bearing quotes on the content page (Galloway $10/two weeks; Beugin ordered top 100; Wickramasinghe top 2000; Ahmad merge on 2024-01-20) are exact.

External and industry verification

Source	Load-bearing fact	Verification 2026-08-27	Decision
API unauthenticated `/radar/ranking/top?limit=5`	HTTP 400, code 9106, names Authorization	`radar_api_probe.sh`	Used
`pages/pin_radar.py` no token	exit 2, stderr names `CLOUDFLARE_API_TOKEN`	executed	Quoted on the page
`pin_radar.py –top 200`	refused, “1–100”	executed	Quoted
`–bucket 3`, `–location` with `–bucket`, `–top`+`–bucket`	all exit 2	probe	Used
Domain Rankings docs	top 100 ordered; buckets to 1,000,000; 1.1.1.1	HTTP 200, strings present	Used
Radar overview docs	CC BY-NC 4.0 on API data	HTTP 200	Used
Launch post	published 2022-09-30; two models; population-size metric	`article:published_time`; body strings	Used as [1Martinho, Celso; Zejnilovic, Sabina (2022): "Goodbye, Alexa. Hello, Cloudflare Radar Domain Rankings". Cloudflare Blog. Published 2022-09-30 (Link)]
Tranco methodology	Radar since 2022-09-26; top 100 individually ranked; weekly otherwise	HTTP 200	Used
Radar About (Playwright)	graphs CC BY 4.0; API/downloads CC BY-NC 4.0	`out/radar/about.txt`	Used
Radar domains (Playwright)	top 10 on 2026-08-27; Internet-services table is not domains; malicious-behavior note	`out/radar/domains.txt`	Used
Galloway et al. IEEE S&P 2024	$10 VPN; Radar top 100k bucket; Tranco 1M in 10 days / 500k in 14 days	`paper.cols.txt`	Used; “ranking of 1 million” is rank ~1e6, not rank 1

Rejected:

curl of radar.cloudflare.com — HTTP 403; Playwright instead.
SEO “Alexa alternatives” listicles.
Treating sourceList == Cloudflare Radar as the page population — 2/6 are BGP/RPKI.
Ruth et al. as a Radar-vs-CrUX accuracy number — their GT is Cloudflare HTTP request logs (CDN), Rankings did not exist yet (Feb 2022 vs Sep 2022), and Rankings are not that GT. A first draft of this page wrongly called it “resolver traffic”; reviewer 2 caught that (see review log).
The dashboard “Top 100 Internet services” as a crawlable domain list.
/radar/ranking/top?limit=200 as an ordered top 200 — the ordered object stops at 100; the script refuses it.
Authenticated bucket download — no token this sitting; not faked.

What the corpus and sources do not establish

A current, independent accuracy comparison of Radar Rankings against CrUX or Tranco on 2026 lists.
The live ordered top 100 past rank 10 (the dashboard paginates; this sitting recorded 1–10).
An authenticated API response body. The missing-token path is the executed one.
Whether limit>100 on /ranking/top errors or silently truncates — refused client-side instead of probing a token-gated unknown.

Review log

Freeze: local files under pages/programming_cloudflare_radar.txt, pages/provenance_programming_cloudflare_radar.txt, pages/pin_radar.py, scripts/report_radar.mjs as of 2026-08-27 before the three focused passes (sha256 of out/frozen_radar/programming_cloudflare_radar.txt: cec2241fd106c328cf957f0e9f04296be2187b7328aa875528ab4b92be234460). Reviewers were told the author context may not be exhaustive and were given the page, the report script and its output, the pin script, and these notes. Model for all four passes: GPT 5.6 Sol medium (not the spec's sonnet/fable split). The three focused passes ran in parallel on that freeze. Their findings were applied, then the pages were frozen again for the generic pass.

GPT 5.6 Sol medium — figures versus script

Re-ran report_radar.mjs, radar_api_probe.sh, the four invalid CLI combinations, and the page-number / wrap / table / attribution guards.

Finding	Disposition
No defects. Union 32, ranking-used 9, 0.2% of 5,859, 3 of 1,120 crawled, sourceList 6/2/5, Cuba as `other`, HTTP 400/9106, all four invalid flags exit 2 before token lookup, embedded `pin_radar.py` byte-identical, ROLE failure path calls `process.exit(1)`.	Accepted, no change.

GPT 5.6 Sol medium — citations and quotes

Verified citekeys against live bibliography ∪ new keys, Crossref/venue metadata, ROLE quotes against .cols, and the load-bearing paper claims.

Finding	Disposition
Ruth et al. are not using “Cloudflare resolver traffic as ground truth”. §3 is “server-side HTTP request logs collected from Cloudflare” (CDN HTTP / TLS / client-IP metrics). Radar Rankings therefore do not sit on that paper's ground-truth side.	Accepted. First-read and manipulable sections rewritten. The same error was on the newly published tranco first-read line; corrected there too. Provenance rejected-list updated.
“CrUX remains the expensive-to-fake page-load ranking” cited to Ruth. The paper finds CrUX closest to Cloudflare HTTP logs; it does not measure manipulation cost.	Accepted. Now: Ruth for the 2022 accuracy finding; Galloway did not evaluate CrUX; cost-of-faking is on website_selection, not in either paper.
Scare quotes “hard to game” and “Radar vs CrUX” are not verbatim in the cited papers.	Accepted. Quotation marks dropped; paraphrase kept.
Galloway $10 / top 100k / Tranco 1M-in-10-days and 500k-in-14-days; Beugin top 100; Wickramasinghe top 2000; Ahmad YXQ4G 2024-01-20; Wu refs [7,18,29] are Radar, Majestic, SimilarWeb; launch-post construction claims; all six table-row surnames.	Accepted, no change.

GPT 5.6 Sol medium — external currency

Fetched docs, launch post, Tranco methodology, list 25299, latest 46W9X, dated 2026-08-27 (404), unauthenticated API, Playwright dashboard and About.

Finding	Disposition
website_selection still said DNS-based lists, including Radar, “rank domains based on DNS query volumes”. Radar's metric is estimated user-population size; volume is what the launch post rejected.	Accepted. Neighbour paragraph rewritten: DNS input vs Umbrella-by-volume vs Radar-by-population-size. The DNS-caveat list (machine queries, infrastructure names) stays, because the input is still DNS.
“The same day's Tranco daily list (`46W9X`)” reads as an 27 August list. Latest available on 2026-08-27 was generated 2026-08-26; `/api/lists/date/20260827` was 404.	Accepted. Now names generated-on and the 404.
Ordered top 100, twelve buckets, token/9106, licences, dashboard top 10, Tranco-since-2022-09-26 / default list 25299, `pin_radar.py` paths and keys.	Accepted, no change.

GPT 5.6 Sol medium — generic

Ran after the three focused findings were applied, on freeze out/frozen_radar2/programming_cloudflare_radar.txt (sha256 a605ca490fb1bcea7f947edcaec76e155ec7fc14db409b5e50a8ab373f302c33). No checklist.

Finding	Disposition
Quote-verification `FAILED` rows increment `failedQ` but never set `failed`, so the report can print FAILED and exit 0.	Accepted. The FAILED branch now sets `failed = true` (missing-`.cols` already did). Same pitfall as Tranco's allowlist-drift guard.
`pin_radar.py` hashed the raw API body, wrote a transformed CSV, and discarded the raw bytes. `bytes_sha256` could not verify the file a crawl actually uses.	Accepted. Manifest now stores `response_sha256` and `csv_sha256`; the cite line names both; the page tells you they are different objects.
“Tranco-with-Radar is only slightly less wrong” quantified a comparison nobody measured.	Accepted. Rewritten: default Tranco has included Radar since 2023-08-01, so Galloway's names reached Tranco through that input. No “slightly”.
website_selection still called CrUX “the most representative rankings” (Ruth measured closeness to Cloudflare HTTP logs in Feb 2022) and “billions of users sharing browsing data” (the same page's CrUX paragraph is opt-in).	Accepted. Advantages line scoped to Ruth's actual finding; manipulation paragraph now names the opt-in population and points at Le Pochat's cost estimate rather than Chrome's install base.

Reproduction

node scripts/report_radar.mjs > scripts/report_radar-output.txt
bash scripts/radar_api_probe.sh
python3 pages/pin_radar.py --top 20   # exits 2 without CLOUDFLARE_API_TOKEN

The report's real unedited output:

report_radar-output.txt

======================================================================
1. POPULATION — Cloudflare Radar mentions, then Domain Rankings
======================================================================
corpus                                              5859
crawled (crawlConfig or automated-web-crawl)        1120
full-text files missing                             4
 
full-text /cloudflare[\s-]?radar/i                  31
population[].sourceList matching the same regex     6
tools[].name matching the same regex                5
UNION of the three                                  32
  schema-only (tools[] hit, .cols splice)           1
 
ROLE over the union (papers, not tuples):
Role          Papers  Share of union 32
------------  ------  -----------------
other         17      53.1%
sample        5       15.6%
citation      3       9.4%
tranco-input  3       9.4%
ingest        2       6.3%
attack        1       3.1%
lookup        1       3.1%
 
PAGE POPULATION (sample|lookup|attack|ingest):      9
  ... of the 5859-paper corpus            0.2%
  ... of 1120 crawled                  0.3%
  crawled among ranking-used                        3
 
sourceList is both incomplete and dirty for this page:
  sourceList papers                                 6
  of those, not a Domain Rankings use               2  2026/NDSS/pathprob-probabilistic-inference-and-path-scoring-for-enhanced-and-flexible-bgp-route-leak-detection:other; 2026/NDSS/demystifying-rpki-invalid-prefixes-hidden-causes-and-security-risks:other
  ranking-used papers with no sourceList hit        5
 
======================================================================
2. YEAR — ranking-used papers / corpus that year
======================================================================
2025–2026 is provisional; not a complete-year trend.
Year  Corpus  Radar mentions (union)  Domain Rankings used  Share of year (used)
----  ------  ----------------------  --------------------  --------------------
2010  119     0                       0                     0.0%
2011  116     0                       0                     0.0%
2012  151     0                       0                     0.0%
2013  125     0                       0                     0.0%
2014  166     0                       0                     0.0%
2015  190     0                       0                     0.0%
2016  182     0                       0                     0.0%
2017  231     0                       0                     0.0%
2018  254     0                       0                     0.0%
2019  402     0                       0                     0.0%
2020  404     0                       0                     0.0%
2021  379     0                       0                     0.0%
2022  546     1                       0                     0.0%
2023  719     1                       0                     0.0%
2024  690     9                       3                     0.4%
2025  770     16                      4                     0.5%
2026  415     5                       2                     0.5%
 
Bucket      Corpus  Domain Rankings used  Share of corpus in bucket
----------  ------  --------------------  -------------------------
2010–2013   511     0                     0.0%
2014–2017   769     0                     0.0%
2018–2021   1439    0                     0.0%
2022–2024   1955    3                     0.2%
2025–2026*  1185    6                     0.5%
 
======================================================================
3. FOLDING — sourceList and tools[] spellings
======================================================================
distinct sourceList spellings: 5
Membership is the regex, so regex residue is 0 by construction. Homographs that do NOT match
(DappRadar, Tracker Radar, Weather Radar, Qrator.Radar, PASSKEYS-RADAR) are excluded by requiring "cloudflare".
sourceList spelling                                          Papers
-----------------------------------------------------------  ------
Cloudflare Radar                                             4
Cloudflare Radar and GRIP                                    1
Tranco and Cloudflare Radar                                  1
Tranco and Cloudflare Radar, filtered by valid AAAA records  1
Tranco; Majestic; Cisco Umbrella; Cloudflare Radar           1
 
distinct tools[].name spellings: 2
tools[].name spelling  Papers
---------------------  ------
Cloudflare Radar       4
Cloudflare Radar API   1
 
======================================================================
4. PAPERS that used Domain Rankings
======================================================================
Key                                                                                           Role    What was used
--------------------------------------------------------------------------------------------  ------  --------------------------------------------------------------
2024/IEEE-SP/practical-attacks-against-dns-reputation-systems                                 attack  Domain Rankings, manipulated with a VPN
2024/IMC/the-wisdom-of-the-measurement-crowd-building-the-internet-yellow-pages-a-knowled     ingest  ranking/top and datasets, plus dns/top, ingested into IYP
2024/PETS/interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi    sample  Domain Rankings ordered top 100, used as a total order
2025/IEEE-SP/sok-decoding-the-enigma-of-encrypted-network-traffic-classifiers                 sample  Domain Rankings top 2000 (a bucket, not an ordered list)
2025/IMC/measuring-the-deployment-of-dnssec-bootstrapping-using-authenticated-signals         sample  Domain Rankings as one of four top lists
2025/IMC/sibling-prefixes-identifying-similarities-in-ipv4-and-ipv6-prefixes                  ingest  OpenINTEL zone list, added October 2022
2025/USENIX/are-captchas-still-bot-hard-generalized-visual-captcha-solving-with-agentic-visi  lookup  popularity and categories, alongside Tranco
2026/PETS/more-space-less-privacy-measuring-the-effectiveness-of-ip-based-website-fingerpr    sample  Domain Rankings top 1M, merged with Tranco YXQ4G on 2024-01-20
2026/WWW/tracking-the-stray-sheep-understanding-dns-response-manipulation-in-the-wild         sample  one of three global popularity rankings
ranking-used: 9; ROLE residue on ranking-used: 0
 
======================================================================
5. SCHEMA sourceList tuples on ranking-used papers
======================================================================
Key                                                                                         sourceList                                                   n        unit      listVersion
------------------------------------------------------------------------------------------  -----------------------------------------------------------  -------  --------  ----------------
2025/IEEE-SP/sok-decoding-the-enigma-of-encrypted-network-traffic-classifiers               Cloudflare Radar                                             2000     domains   sentinel
2025/IMC/measuring-the-deployment-of-dnssec-bootstrapping-using-authenticated-signals       Tranco; Majestic; Cisco Umbrella; Cloudflare Radar           null     domains   2025
2026/PETS/more-space-less-privacy-measuring-the-effectiveness-of-ip-based-website-fingerpr  Cloudflare Radar                                             1000000  domains   January 20, 2024
2026/PETS/more-space-less-privacy-measuring-the-effectiveness-of-ip-based-website-fingerpr  Tranco and Cloudflare Radar                                  1300000  websites  January 20, 2024
2026/PETS/more-space-less-privacy-measuring-the-effectiveness-of-ip-based-website-fingerpr  Tranco and Cloudflare Radar, filtered by valid AAAA records  520000   websites  January 20, 2024
2026/WWW/tracking-the-stray-sheep-understanding-dns-response-manipulation-in-the-wild       Cloudflare Radar                                             null     domains   2025-10-04
tuples: 6 (count papers, never these)
 
======================================================================
6. ROLE quotes checked against paper.cols.txt
======================================================================
2022/USENIX/get-out-automated-discovery-of-application-layer-censorship-evasion-strategies | other | exact | "Cloudflare Radar: Up to date Internet trends and insight. https://radar.cloudflare.com/cn"
2023/USENIX/an-empirical-study-evaluation-of-modern-captchas | citation | exact | "There are several lists of \"popular\" websites that could be used for this type of study, including the Alexa Top Website list [2], Cisco Umbrella [6], Majestic [16], TRANCO [56], Cloudflare Radar [7], and SecRank TopDomain [71]."
2024/IEEE-SP/practical-attacks-against-dns-reputation-systems | attack | exact | "We will show that $10 in VPN services is sufficient to achieve high rankings on the Cisco Umbrella List, the Cloudflare Radar List, and the downstream Tranco List in just two weeks."
2024/IMC/measuring-network-latency-from-a-wireless-isp-variations-within-and-across-subne | other | exact | "We note that Cloudflare Radar4 recorded a spike in part of the overall end-to-end latency."
2024/IMC/exploring-the-ecosystem-of-dns-https-resource-records-an-end-to-end-perspective | tranco-input | partial (75%) | "Tranco changed its data sources by phasing out Alexa ranking for Chrome User Experience Report and Cloudflare Radar data [47]"
2024/IMC/the-wisdom-of-the-measurement-crowd-building-the-internet-yellow-pages-a-knowled | ingest | exact | "Cloudflare Radar API endpoints Cloudflare radar/dns/top/ases, radar/dns/top/locations, radar/ranking/top, radar/datasets"
2024/IMC/whats-in-the-dataset-unboxing-the-apnic-per-as-user-population-dataset | citation | exact | "About: Cloudflare Radar. https://radar.cloudflare.com/about."
2024/PETS/interest-disclosing-mechanisms-for-advertising-are-privacy-exposing-not-preservi | sample | exact | "we also use the ordered list of the top 100 eTLD+1 globally returned by Cloudflare Radar's Domain Ranking API [12]"
2024/USENIX/fingerprinting-obfuscated-proxy-traffic-with-encapsulated-tls-handshakes | citation | exact | "Goodbye, Alexa. Hello, Cloudflare Radar Domain Rankings"
2024/USENIX/gfweb-measuring-the-great-firewalls-web-censorship-at-scale | other | exact | "TCP-based measurement systems like Cloudflare Radar [63] will miss domains that are blocked by the DNS filter."
2024/USENIX/digital-discrimination-of-users-in-sanctioned-states-the-case-of-the-cuba-embarg | other | spliced (.cols) | "We use Cloudflare's Radar API to categorize each geoblocking domain"
2025/CCS/poster-reconsidering-dns-based-domain-verification-privacy-and-overhead-implicat | other | exact | "new DNS insights on Cloudflare Radar"
2025/CCS/the-odyssey-of-robots-txt-governance-measuring-convention-implications-of-web-bo | tranco-input | exact | "aggregating rankings from five sources, including Cisco Umbrella [20], Majestic [50], Farsight [33], the Chrome User Experience Report (CrUX)[19], and Cloudflare Radar[22]"
2025/IEEE-SP/sok-decoding-the-enigma-of-encrypted-network-traffic-classifiers | sample | exact | "we selected the top 2000 domains listed on Cloudflare Radar [12]"
2025/IEEE-SP/transport-layer-obscurity-circumventing-sni-censorship-on-the-tls-layer | other | exact | "Cloudflare Radar | Adoption & Usage Worldwide"
2025/IMC/the-developer-the-rfc-and-the-middlebox-an-http-2-compliance-story | other | exact | "Cloudflare Radar. 2024. Adoption & Usage."
2025/IMC/tracking-internet-disruptions-in-ukraine-insights-from-three-years-of-active-ful | other | exact | "Gone offline: how Cloudflare Radar detects Internet outages"
2025/IMC/measuring-the-deployment-of-dnssec-bootstrapping-using-authenticated-signals | sample | exact | "Domains from different top lists: Tranco [25], Majestic [28], Cisco Umbrella [8], and Cloudflare Radar [9]."
2025/IMC/sibling-prefixes-identifying-similarities-in-ipv4-and-ipv6-prefixes | ingest | exact | "The OpenINTEL dataset consists of DNS resolution results of the Alexa top 1M [3], Cloudflare Radar [17], Tranco [65], Cisco Umbrella [16], and open ccTLD domains."
2025/IMC/towards-a-non-binary-view-of-ipv6-adoption | tranco-input | exact | "(CrUX), Cloudflare Radar, Farsight, Majestic, and Cisco"
2025/NDSS/securing-bgp-asap-aspa-and-other-post-rov-defenses | other | exact | "our new cloudflare radar route leak service"
2025/PETS/understanding-privacy-norms-through-web-forms | other | exact | "Cloudflare Radar docs - Glossary > Content Categories"
2025/USENIX/are-captchas-still-bot-hard-generalized-visual-captcha-solving-with-agentic-visi | lookup | exact | "We enriched the domains with categorical and popularity information from Cloudflare Radar and Tranco."
2025/USENIX/irblock-a-large-scale-measurement-study-of-the-great-firewall-of-iran | other | exact | "Data explorer | cloudflare radar - http versions time series"
2025/USENIX/exposing-and-circumventing-sni-based-quic-censorship-of-the-great-firewall-of-ch | other | exact | "Cloudflare Radar - Adoption and Usage Worldwide"
2025/USENIX/stek-sharing-is-not-caring-bypassing-tls-authentication-in-web-servers-using-ses | other | exact | "Adoption & Usage Worldwide | Cloudflare Radar"
2025/USENIX/your-shield-is-my-sword-a-persistent-denial-of-service-attack-via-the-reuse-of-u | other | exact | "Cloudflare Radar Routing Information"
2026/NDSS/pathprob-probabilistic-inference-and-path-scoring-for-enhanced-and-flexible-bgp-route-leak-detection | other | exact | "We use the route leak events reported by Cloudflare Radar [40] as the ground truth."
2026/NDSS/demystifying-rpki-invalid-prefixes-hidden-causes-and-security-risks | other | exact | "GRIP [1] (based on BGPStream [44]) and Cloudflare Radar [15] also rely on RPKI data for hijack detection."
2026/NDSS/mvpnalyzer-an-investigative-framework-for-auditing-the-security-privacy-of-mobile-vpns | other | exact | "Adoption & Usage Worldwide | Cloudflare Radar"
2026/PETS/more-space-less-privacy-measuring-the-effectiveness-of-ip-based-website-fingerpr | sample | exact | "we merged two rankings: Tranco1 [44] and Cloudflare Radar2 [15], generated on January 20, 2024."
2026/WWW/tracking-the-stray-sheep-understanding-dns-response-manipulation-in-the-wild | sample | exact | "We selected the top domains across web application categories according to global popularity rankings [7, 18, 29]."
 
Summary: 32 ROLE quotes: 30 exact, 1 partial, 1 spliced (Cuba .cols), 0 failed.
 
======================================================================
7. EXTERNAL FIGURES the page may quote (not from this corpus)
======================================================================
BUCKETS: 200 500 1000 2000 5000 10000 20000 50000 100000 200000 500000 1000000
ORDERED_TOP: 100
TOP100_CADENCE: daily, last 24 hours
BUCKET_CADENCE: weekly, last 7 days
AVAILABLE_SINCE: 2022-09-26 (Tranco methodology); blog 2022-09-30T13:00:00.000Z
TRANCO_DEFAULT_FROM: 2023-08-01 list id 25299
LICENSE_API: CC BY-NC 4.0
LICENSE_GRAPHS: CC BY 4.0
DNS_RESOLVER: 1.1.1.1  (short form 1.1 for page-number scanner)
DASHBOARD_CURL: 403
HASH_ALG: SHA-256
TOKEN_MISSING_HTTP: 400
TOKEN_MISSING_CODE: 9106
TOKEN_MISSING_MSG: Missing X-Auth-Key, X-Auth-Email or Authorization headers
UI_TOP10_2026-08-27: google.com googleapis.com cloudflare.com gstatic.com apple.com microsoft.com facebook.com amazonaws.com googlevideo.com fbcdn.net
UI_UPDATED: Aug 27, 2026
GALLOWAY_COST: US$10 / $10
GALLOWAY_TIME: two weeks
GALLOWAY_RADAR: top 100,000
GALLOWAY_TRANCO: 1 million within 10 days; 500K within 14 days
BEUGIN_TOP: 100
WICKRAMASINGHE_TOP: 2000
AHMAD_DATE: January 20, 2024
AHMAD_TRANCO: YXQ4G
AHMAD_EACH: one million
OPENINTEL_ADDED: October 2022
DASHBOARD_NOTE: top 100 and trending lists include organic activity and emerging malicious behavior
TRANCO_LATEST: 46W9X generated 2026-08-26; dated lookup 2026-08-27 HTTP 404
 
======================================================================
8. HOMOGRAPH CHECK
======================================================================
tracker-radar full-text: 32; overlap with this union: 0
 
all checks passed

Measure The Web

Table of Contents