Security Exposure of JP Domains by Hosting Provider, 2026: Where About 1.09 Million .jp and Japanese-Language gTLD Sites Are Hosted, and How They Are Configured
- One non-intrusive observation was applied to every name in a ledger of delegated .jp domains (1,197,208 names as of 2026-10-29) and to 131,622 Japanese-language sites on gTLDs (.com / .net / .org). The 1,090,213 names whose website responded are grouped here by the hosting provider of the IP address that served the response. This is a separate cut of the same data as Article H (interim report).
- The hosting provider is defined by looking up the IP address in a public routing table (CAIDA RouteViews) and normalising the origin AS to a company name. Sites behind a CDN (Cloudflare, AWS CloudFront and others) made up 12.3% (11.0% of .jp, 45.8% of gTLD Japanese-language sites); the origin was not inferred and these sites were removed from the per-provider denominators.
- Of the remaining 952,161 names, Xserver hosts 21.7%, Sakura Internet 20.7% and GMO Internet 18.9%: 61.3% between the three. The 38 providers with 1,000 or more reachable names are named.
- HTTPS enforcement exceeds 90% at most providers, but HSTS (overall 10.6%), CSP (6.0%) and TLS 1.3 (73.8%) range from a few percent to over 90% depending on the provider. At Xserver, the largest, HSTS is 2.3% while version hiding is 99.1% and TLS 1.3 97.9%: items set by the server platform and items usually added by the customer diverge sharply.
- 11.1% of sites (105,237) announce a PHP version, and 53.5% of those are end-of-life. Disclosure counts differ greatly by provider: sites on GMO Internet account for 64,164 (61.0% of all disclosures). Among providers with 100 or more PHP disclosures, the end-of-life share ranges from 5.4% to 99.2%.
- 8.7% of sites announce a version within the range of a published CVE (upper bound). 85.4% of serving IP addresses are registered in Japan; IP addresses of overseas providers such as AWS and Google are often registered in the company's home country even when used in Japanese data centres.
- The values describe the sites hosted at each provider, not the provider. Even on shared hosting, the PHP version and most headers are often chosen or added by the customer.
Where this article sits
Article H (The Overall Picture of PHP and Other Vulnerability Exposure in JP Domains — Interim Report) showed adoption by NS provider, the company where a domain's DNS is hosted, which is not necessarily where the website lives. This article regroups the same observations by the owner of the IP address that actually served the website (the hosting provider).
Article H did not show CVE exposure per NS provider, because version disclosure and CVEs change with site-side configuration. Here the hosting provider is defined explicitly, and the end-of-life PHP share and CVE exposure (upper bound) are shown per provider as well. The values describe "the sites that responded from that provider's IP addresses" and are not an assessment of the provider's own security (§10).
How the hosting provider is defined
The observation is the same as in Article H: one DNS lookup, one TLS connection and one HTTP GET per domain, recording response headers and the certificate. The worker also recorded the IPv4 address it resolved at observation time (99.6% of names whose DNS resolved).
- Unit: as in Article H, if
example.jpresponded its row is used; if not andwww.example.jpresponded, the www row is used. The hosting provider is determined from that row's IP address - AS number: the IP address was looked up by longest-prefix match in CAIDA RouteViews prefix2as (2026-10-28, origin AS in the routing table). The routing table is public data; no additional access was made to the observed sites
- Company name: AS numbers were mapped to organisation names with CAIDA AS Organizations (2026-10-01), and multiple ASes of one company (such as Sakura Internet's three) were merged. The mapping uses public data only (1,818 ASes appeared)
- Behind a CDN: sites where a CDN or WAF was detected in the response headers, or whose IP is in a CDN operator's AS (Cloudflare, Fastly, Akamai's CDN, Imperva and others), were counted separately as "behind a CDN" and removed from the per-provider denominators. The origin behind the CDN was not inferred
- Naming threshold: providers with 1,000 or more reachable names (excluding CDN-fronted and IP-unknown) are named; the rest are grouped as "all other providers". PHP support status and CVE exposure are shown only for providers with 100 or more names announcing a PHP version
- IP registration country: allocation records of the five Regional Internet Registries (the same as Figure 16 of Article H)
A company may run several brands (shared hosting, VPS, cloud) on the same AS, which cannot be told apart at AS level, so the names in this article are the companies that hold the AS, not service brands. Conversely, a provider that resells another company's infrastructure is counted under the infrastructure owner.
Behind a CDN — nearly half of gTLD Japanese-language sites sit behind Cloudflare
Among responding sites, a CDN was in front for 11.0% of .jp (Cloudflare 7.2%, AWS CloudFront 2.9%, Fastly 0.6%) and for 45.8% of gTLD Japanese-language sites (Cloudflare 44.9%) (Figure 1). Only 53.8% of responding gTLD Japanese-language sites can be attributed to a hosting provider.
Because the CDN rewrites some headers, CDN-fronted sites show higher HSTS (41.1%) and TLS 1.3 (93.2%) than all other sites (HSTS 10.6%, TLS 1.3 73.8%). The per-provider figures below include a CDN row for reference, but the origin provider is unknown.
Where sites are hosted — three companies hold about 60%
Excluding CDN-fronted and IP-unknown names leaves 952,161 names: 931,651 .jp and 20,510 gTLD Japanese-language sites (Figure 2). Xserver has 206,817 (21.7%), Sakura Internet 197,363 (20.7%), GMO Internet 179,804 (18.9%) and AWS 71,025 (7.5%). The 38 named providers hold 95.6%; all other providers together hold 41,445 names (4.4%, 1635 AS).
Looking at gTLD Japanese-language sites alone, of the 20,510 names not behind a CDN, AWS hosts 19.3%, Namecheap 7.3% and Xserver 5.5%, while all other providers hold 42.6%.
Adoption of security measures
Adoption as a share of reachable names, by provider (Figure 3, Table 1). The dashed line is the overall value excluding CDN-fronted sites.
Table 1 Security measures by hosting provider (% of reachable names, excluding CDN-fronted)
| Hosting provider | Reachable | Share | IPs | HTTPS enforced | HSTS | CSP | TLS 1.3 | Version hidden |
|---|---|---|---|---|---|---|---|---|
| All (excluding CDN-fronted) | 952,161 | 100.0% | 171,198 | 94.3% | 10.6% | 6.0% | 73.8% | 83.1% |
| Xserver | 206,817 | 21.7% | 11,802 | 99.4% | 2.3% | 1.5% | 97.9% | 99.1% |
| Sakura Internet | 197,363 | 20.7% | 23,664 | 98.6% | 6.0% | 1.4% | 90.7% | 87.2% |
| GMO Internet | 179,804 | 18.9% | 4,602 | 92.3% | 5.3% | 3.6% | 83.3% | 63.5% |
| AWS (Amazon) | 71,025 | 7.5% | 16,190 | 95.4% | 42.3% | 8.6% | 46.8% | 69.8% |
| NTT DOCOMO BUSINESS (OCN) | 38,392 | 4.0% | 27,651 | 98.1% | 2.3% | 4.5% | 3.8% | 75.5% |
| IDC Frontier | 29,903 | 3.1% | 10,565 | 98.4% | 5.6% | 0.8% | 64.4% | 90.4% |
| GMO GlobalSign Holdings | 29,280 | 3.1% | 2,494 | 98.8% | 11.1% | 0.7% | 32.1% | 96.3% |
| NTTPC | 22,805 | 2.4% | 18,352 | 49.5% | 2.1% | 0.7% | 14.4% | 88.5% |
| 19,126 | 2.0% | 1,773 | 99.4% | 8.1% | 76.3% | 93.5% | 93.9% | |
| DigiRock | 16,042 | 1.7% | 414 | 99.6% | 82.7% | 1.3% | 98.8% | 94.5% |
| CPI (KDDI) | 15,155 | 1.6% | 10,418 | 99.2% | 24.0% | 1.9% | 43.3% | 91.0% |
| Future Spirits | 11,213 | 1.2% | 367 | 96.9% | 8.6% | 67.9% | 43.8% | 87.1% |
| KAGOYA JAPAN | 10,692 | 1.1% | 3,820 | 98.4% | 4.9% | 2.1% | 30.1% | 91.4% |
| Pacific Software Publishing | 9,542 | 1.0% | 58 | 99.7% | 0.1% | 0.1% | 97.8% | 100.0% |
| Otsuka Corporation | 7,734 | 0.8% | 7,711 | 48.7% | 4.9% | 99.5% | 0.1% | 99.8% |
| Canon IT Solutions | 3,817 | 0.4% | 16 | 17.0% | 98.7% | 0.1% | 17.1% | 99.9% |
| IIJ | 3,601 | 0.4% | 1,453 | 93.7% | 19.2% | 5.2% | 42.5% | 79.3% |
| KDDI | 3,452 | 0.4% | 936 | 92.6% | 11.8% | 1.3% | 69.7% | 75.8% |
| IBM Cloud | 3,229 | 0.3% | 72 | 98.8% | 15.7% | 0.0% | 0.6% | 99.0% |
| UCOM | 3,154 | 0.3% | 689 | 94.7% | 11.6% | 1.3% | 28.6% | 44.5% |
| Microsoft (Azure) | 2,957 | 0.3% | 1,332 | 94.9% | 38.1% | 9.6% | 70.1% | 38.1% |
| ASJ | 2,314 | 0.2% | 1,249 | 66.3% | 1.2% | 0.1% | 0.0% | 85.0% |
| Automattic (WordPress.com) | 1,854 | 0.2% | 154 | 87.0% | 78.4% | 1.7% | 99.5% | 99.9% |
| CLARA Online | 1,745 | 0.2% | 253 | 99.4% | 2.2% | 0.4% | 85.7% | 94.4% |
| Wix | 1,676 | 0.2% | 7 | 95.2% | 6.0% | 0.2% | 97.2% | 95.3% |
| ARTERIA Networks | 1,675 | 0.2% | 385 | 89.6% | 37.9% | 1.1% | 47.7% | 75.2% |
| NTT America | 1,588 | 0.2% | 16 | 3.9% | 1.2% | 0.2% | 1.8% | 2.3% |
| Namecheap | 1,565 | 0.2% | 931 | 55.9% | 1.2% | 0.2% | 44.9% | 90.4% |
| Akamai (Linode) | 1,474 | 0.2% | 361 | 92.3% | 16.6% | 2.7% | 38.6% | 74.6% |
| OPTAGE | 1,450 | 0.2% | 437 | 91.4% | 5.4% | 1.0% | 46.7% | 71.3% |
| Trellian (parking) | 1,449 | 0.2% | 51 | 98.8% | 0.0% | 0.0% | 97.0% | 100.0% |
| Mirai Communication Network | 1,418 | 0.1% | 201 | 96.9% | 11.7% | 2.5% | 70.5% | 71.9% |
| SoftBank | 1,392 | 0.1% | 837 | 93.0% | 14.0% | 3.8% | 34.1% | 57.3% |
| Oracle Cloud | 1,316 | 0.1% | 634 | 95.6% | 20.3% | 11.2% | 76.3% | 65.8% |
| Squarespace | 1,241 | 0.1% | 8 | 98.7% | 83.2% | 9.1% | 99.1% | 99.6% |
| Bear Cloud Solutions | 1,176 | 0.1% | 3 | 99.8% | 0.1% | 93.5% | 99.4% | 6.2% |
| Hostinger | 1,167 | 0.1% | 726 | 99.3% | 10.0% | 71.9% | 98.5% | 46.2% |
| Sedo (parking) | 1,113 | 0.1% | 8 | 99.4% | 8.4% | 0.0% | 99.0% | 1.2% |
| All other providers | 41,445 | 4.4% | 20,558 | 83.2% | 15.3% | 6.0% | 54.5% | 71.2% |
| (Reference) GMO companies combined | 209,084 | 22.0% | 7,096 | 93.2% | 6.1% | 3.2% | 76.2% | 68.1% |
| (Reference) Behind a CDN | 133,633 | 12.3% | 45,393 | 98.4% | 41.1% | 17.0% | 93.2% | 88.3% |
- HTTPS enforcement is 94.3% overall and above 90% at most providers. Lower values: NTTPC 49.5%, Otsuka Corporation 48.7%, Canon IT Solutions 17.0%, NTT America 3.9%.
- HSTS is 10.6% overall. It is high at Canon IT Solutions (98.7%), Squarespace (83.2%), DigiRock (82.7%) and Automattic (WordPress.com) (78.4%), and low at Xserver (2.3%), NTT DOCOMO BUSINESS (OCN) (2.3%) and Sakura Internet (6.0%). Whether the service adds it by default or leaves it to the customer appears to make the difference.
- CSP is 6.0% overall. Apart from Otsuka Corporation (99.5%), Google (76.3%) and Future Spirits (67.9%), almost every provider is in single digits.
- TLS 1.3 was negotiated by 73.8% overall: high at Xserver (97.9%), DigiRock (98.8%) and Sakura Internet (90.7%), low at NTT DOCOMO BUSINESS (OCN) (3.8%), NTTPC (14.4%) and ASJ (0.0%). The TLS version is set by the server software, which customers on shared hosting usually cannot change.
- Version hiding is 83.1% overall: 99.1% at Xserver against 63.5% at GMO Internet, 44.5% at UCOM and 38.1% at Microsoft (Azure).
"IPs" is the number of distinct IP addresses used by the names that responded at that provider. Where thousands of names share a handful of IPs (parking or forwarding services, website builders), the value reflects one service's configuration rather than individual sites.
PHP versions and support status
The share of sites announcing a PHP version (via X-Powered-By and similar), and the end-of-life share among them (8.1 and older, as of the observation date) (Figure 4, Table 2).
Table 2 PHP version disclosure and support status by hosting provider (providers with 100+ PHP disclosures)
| Hosting provider | Reachable | PHP version disclosed | Disclosure rate | of which EOL | of which security-only (8.2) | of which unpatched for 2026 critical CVEs |
|---|---|---|---|---|---|---|
| All (excluding CDN-fronted) | 952,161 | 105,237 | 11.1% | 53.5% | 4.8% | 49.7% |
| Xserver | 206,817 | 284 | 0.1% | 28.5% | 11.3% | 30.3% |
| Sakura Internet | 197,363 | 17,804 | 9.0% | 86.3% | 1.9% | 81.2% |
| GMO Internet | 179,804 | 64,164 | 35.7% | 47.9% | 4.9% | 45.7% |
| AWS (Amazon) | 71,025 | 3,028 | 4.3% | 61.6% | 16.6% | 58.9% |
| NTT DOCOMO BUSINESS (OCN) | 38,392 | 8,072 | 21.0% | 5.4% | 0.5% | 5.1% |
| IDC Frontier | 29,903 | 2,020 | 6.8% | 83.4% | 8.1% | 31.5% |
| GMO GlobalSign Holdings | 29,280 | 537 | 1.8% | 62.4% | 4.7% | 56.4% |
| NTTPC | 22,805 | 680 | 3.0% | 49.3% | 3.7% | 42.9% |
| 19,126 | 167 | 0.9% | 44.3% | 13.2% | 46.7% | |
| DigiRock | 16,042 | 329 | 2.1% | 92.4% | 0.9% | 88.8% |
| CPI (KDDI) | 15,155 | 1,337 | 8.8% | 95.5% | 0.7% | 74.9% |
| KAGOYA JAPAN | 10,692 | 311 | 2.9% | 61.4% | 5.8% | 55.9% |
| IIJ | 3,601 | 255 | 7.1% | 70.6% | 5.1% | 70.6% |
| KDDI | 3,452 | 281 | 8.1% | 46.6% | 15.7% | 34.9% |
| UCOM | 3,154 | 298 | 9.4% | 63.8% | 17.1% | 51.0% |
| Microsoft (Azure) | 2,957 | 203 | 6.9% | 26.6% | 12.8% | 27.6% |
| ASJ | 2,314 | 253 | 10.9% | 99.2% | 0.4% | 98.0% |
| ARTERIA Networks | 1,675 | 111 | 6.6% | 75.7% | 13.5% | 72.1% |
| Akamai (Linode) | 1,474 | 127 | 8.6% | 66.1% | 10.2% | 57.5% |
| Mirai Communication Network | 1,418 | 325 | 22.9% | 37.5% | 4.3% | 37.2% |
| SoftBank | 1,392 | 214 | 15.4% | 58.9% | 21.0% | 48.6% |
| Oracle Cloud | 1,316 | 154 | 11.7% | 42.9% | 3.9% | 42.9% |
| Hostinger | 1,167 | 600 | 51.4% | 15.5% | 26.8% | 42.8% |
| All other providers | 41,445 | 3,402 | 8.2% | 61.1% | 9.2% | 57.5% |
| (Reference) GMO companies combined | 209,084 | 64,701 | 30.9% | 48.0% | 4.9% | 45.7% |
- Of the 105,237 sites announcing a PHP version, 64,164 are on GMO Internet (disclosure rate 35.7%). The differences in disclosure rate appear to reflect whether the server configuration puts the version into
X-Powered-By. Xserver's disclosure rate is 0.1%; almost no sites there announce a version. - The end-of-life share ranges from 5.4% at NTT DOCOMO BUSINESS (OCN) to 99.2% at ASJ, with CPI (KDDI) at 95.5%, DigiRock at 92.4% and Sakura Internet at 86.3%. On shared hosting the customer often selects the PHP version in a control panel; if many sites keep an old selection, the share is high even when the provider offers current versions.
- 49.7% of sites announcing a PHP version announce one within the affected range of the 2026 critical PHP vulnerabilities (CVE-2026-109618 / 109619).
CVE exposure (upper bound)
The share of sites whose Server header, X-Powered-By or CMS version string falls within the affected range of a published CVE for PHP, Apache, nginx, WordPress and others (NVD, retrieved 2026-10-29) (Figure 5, Table 3). The matching rules are the same as in Article H. Because distribution back-ports cannot be seen, this is an upper bound. Exploitation was not tested.
Table 3 CVE exposure by hosting provider (upper bound, % of reachable names; providers with 100+ PHP disclosures)
| Hosting provider | Within range of a known CVE | RCE class (excl. Windows-only) | CRITICAL severity |
|---|---|---|---|
| All (excluding CDN-fronted) | 8.7% | 1.7% | 7.8% |
| Xserver | 0.5% | 0.3% | 0.3% |
| Sakura Internet | 11.4% | 2.3% | 10.7% |
| GMO Internet | 18.0% | 3.2% | 17.8% |
| AWS (Amazon) | 11.2% | 1.0% | 7.3% |
| NTT DOCOMO BUSINESS (OCN) | 2.9% | 0.6% | 2.6% |
| IDC Frontier | 7.4% | 5.0% | 7.1% |
| GMO GlobalSign Holdings | 2.4% | 0.9% | 2.3% |
| NTTPC | 9.5% | 1.1% | 5.5% |
| 2.5% | 0.2% | 1.4% | |
| DigiRock | 2.1% | 0.2% | 2.0% |
| CPI (KDDI) | 8.6% | 6.5% | 8.6% |
| KAGOYA JAPAN | 6.0% | 1.3% | 5.1% |
| IIJ | 10.2% | 1.6% | 9.3% |
| KDDI | 14.4% | 2.1% | 12.4% |
| UCOM | 47.0% | 3.7% | 16.0% |
| Microsoft (Azure) | 7.5% | 0.6% | 5.5% |
| ASJ | 15.0% | 0.3% | 15.0% |
| ARTERIA Networks | 20.5% | 3.8% | 18.6% |
| Akamai (Linode) | 11.5% | 1.5% | 10.2% |
| Mirai Communication Network | 9.5% | 2.0% | 9.5% |
| SoftBank | 24.7% | 5.7% | 23.1% |
| Oracle Cloud | 10.8% | 0.9% | 8.4% |
| Hostinger | 24.0% | 0.3% | 22.7% |
| All other providers | 14.1% | 2.8% | 11.4% |
| (Reference) GMO companies combined | 15.8% | 2.8% | 15.6% |
Overall: 8.7%. UCOM (47.0%), SoftBank (24.7%), Hostinger (24.0%), ARTERIA Networks (20.5%) and GMO Internet (18.0%) are above the overall value; Xserver (0.5%), DigiRock (2.1%) and GMO GlobalSign Holdings (2.4%) are low. Sites that do not announce a version cannot be matched, so providers with high version hiding come out lower. The value shows that an old version is being announced; it does not mean an attack would succeed.
IP address registration country
Excluding CDN-fronted sites, 85.4% of serving IP addresses are registered in Japan (86.9% for .jp alone). Domestic providers are almost 100% Japan-registered, while AWS (98.5% US-registered), Google, Microsoft (Azure) and Oracle Cloud are registered in the United States and elsewhere (Figure 6).
The registration country comes from RIR allocation records and may differ from where the server is located. Overseas cloud providers often register addresses used in their Japanese data centres (Tokyo and Osaka regions) in their home country, so "registered in the US" does not mean "located in the US".
NS provider versus hosting provider
For each NS provider in Article H (top 10), the hosting provider whose IP served the website (Figure 7, .jp only).
- 92.3% of names with Xserver NS, 93.3% with Sakura Internet NS and 93.4% with CPI (KDDI) NS were also served from the same company's IPs: DNS and web are with one provider.
- 78.1% of names with GMO Pepabo NS were served from IPs in GMO Internet's AS. At AS level, the company holding the AS cannot be distinguished from a company providing services on its infrastructure (§2).
- Names with GMO (VALUE-DOMAIN) NS split between DigiRock (40.9%), GMO Internet (29.2%) and Sakura Internet (10.6%). Names with GMO (DNSv) NS are spread across Sakura Internet (22.9%), AWS (12.3%), CDN-fronted (14.5%) and others: DNS is hosted in one place and the website in another.
- Names with AWS Route 53 NS: AWS 37.4%, CDN-fronted 33.1%, IDC Frontier 10.9%. Names with Cloudflare NS: 85.6% CDN-fronted.
- Names with customer.ne.jp NS: NTT DOCOMO BUSINESS (OCN) 79.3%, NTTPC 13.5%.
This puts a size on Article H's statement that the NS provider is not the hosting provider: for shared-hosting companies the per-NS and per-host values are close; for DNS-only and CDN providers they differ widely.
Reading the numbers — this is not an assessment of providers
- Who decides the settings: on shared hosting, the PHP version may be a provider default or selected by the customer in a control panel. HSTS and CSP are mostly added by the customer in
.htaccessor the application. On VPS and cloud, the customer manages everything from the OS to the application. Every value describes "the sites hosted at that provider" and does not directly measure the quality of the provider's own security. - Different business models: shared hosting, VPS and cloud, website builders, and parking or forwarding services appear in the same table. Providers with different service models cannot simply be ranked against each other.
- ASes are company-level: brands of one company cannot be separated, and services built on rented infrastructure are counted under the infrastructure owner.
- What is behind a CDN is unknown: CDN-fronted sites were removed from the denominators, so for providers whose customers use CDNs heavily, the values cover only the sites that do not.
Conflict-of-interest disclosure: the author runs a domain business (a JPRS-accredited registrar) through SkyClear Co., Ltd., and formerly served as the number two at a GMO Group subsidiary. The providers in this article include GMO group companies (GMO Internet, GMO GlobalSign Holdings and others). All values were computed for every provider with the same method and the same criteria, and company names are based on public data (routing tables and AS organisation names).
Limits and caveats
- The population and observation limits are the same as in Article H (ledger coverage 63.0% of the JPRS registration count, reachability from the observation point, 403 responses counted as reachable, version-based upper bounds).
- The hosting provider is the origin AS in the routing table; leased address space and the gap between the routing table date (2026-10-28) and the observation date (2026-10-29) are not reflected. IPs absent from the routing table and names whose IP could not be recorded were excluded as "IP unknown" (0.4%).
- The IP address is the result of a single resolution at observation time; names with several addresses are counted once.
- CDN detection is based on response headers and AS. CDNs that do not identify themselves, and providers that deliver over their own network, cannot be detected.
- Providers were not notified in advance. The values describe observed facts.
- Individual site or domain names are not given in this article.
Use the same non-intrusive method as this survey to see what your server announces: TLS, HSTS, headers and versions. No registration needed.
Use: Server information checkFAQ
Is this a ranking of providers?
No. Providers with different models (shared hosting, VPS and cloud, website builders) appear side by side, and the PHP version and headers are mostly decided by customers. The values describe "the sites that responded from that provider's IP addresses".
How was the hosting provider determined?
The IP address that served the website was looked up in a public routing table (CAIDA RouteViews) to find its AS, and the AS organisation name (CAIDA AS Organizations) was normalised to a company name. The name is that of the company holding the AS, not a service brand.
How were sites using a CDN handled?
When a CDN such as Cloudflare is in front, the IP belongs to the CDN and the real server (origin) is unknown. The origin was not inferred; such sites were counted separately as "behind a CDN" and removed from per-provider denominators.
How does this differ from the per-NS-provider values in Article H?
The NS provider is where DNS is hosted; the hosting provider owns the IP that served the website. They are often different companies. The correspondence is shown in §9.
Can I check my own site the same way?
Yes. Enter a URL in Site Scouter's server information check to see TLS, HSTS, headers and version disclosure with the same non-intrusive method as this survey.
Can my site be excluded from the observation?
Please contact us through Site Scouter's contact form. It will be excluded from subsequent observations.
References
Last checked: 2026-10-30. Specifications and policies can change; check the primary sources before acting.
- CAIDA: RouteViews Prefix-to-AS mappings
- CAIDA: AS Organizations
- APNIC: Delegated statistics (RIR allocation records)
- PHP: Supported Versions (php.net)
- NVD - National Vulnerability Database (NIST)
- Interim report: Security Exposure Across the .jp Domain Space (Site Scouter)
Yuki Nakazawa(personal blog nkzw.jp)
Contact: Official site ／ YouTube ／ Instagram ／ LinkedIn ／ X ／ Telegram