Resources · 01

OSINT guide: produce reliable decision intelligence

A six-step method for turning scattered open sources into a traceable, nuanced and actionable brief.

Updated 30 October 2026 · 14 min

Illustration · fictional scene

What this guide helps achieve

Stop collecting without a purpose
Avoid confusing repetition with corroboration
Make uncertainty visible
Connect recommendations to the decision

Quick check

Does the question fit into one sentence?
Is the validity deadline defined?
Are two sources genuinely independent?
Is personal information necessary to the reasoning?
Does the reader know what would change the conclusion?

Step-by-step method

01
Frame the decision
State the decision, its owner, deadline and likely cost of error. A strong question limits scope without imposing the conclusion.
Deliverable: one-page brief.
02
Build a collection plan
Break the question into sub-hypotheses and map sources that may confirm, qualify or refute each one. Define a stopping condition.
Deliverable: hypothesis, source and status table.
03
Trace provenance
Retain the primary URL or reference, author, publication date, access date and a compliant copy where lawful.
Deliverable: source log.
04
Assess without over-scoring
Score source reliability and information credibility separately. A capable source may have an interest; an unknown source may publish an authentic document.
Deliverable: confidence grid.
05
Corroborate and challenge
Seek an independent origin and actively try to refute the leading hypothesis. Multiple rewrites of one dispatch remain one origin.
Deliverable: corroboration matrix.
06
Report for action
Lead with the short answer, then decisive facts, limitations, scenarios and next action. Keep collection detail in an appendix.
Deliverable: decision brief and appendices.

Worked example

Illustrative situation

A management team must decide whether a public signal about a partner warrants enhanced review. The team separates the original record from reposts and commentary, dates each item and records what remains unknown.

Decision and expected evidence

The brief names the two facts that could change the decision, the confidence attached to each conclusion and the date for refreshing the search.

Management indicators

Indicator	What it measures	First action
Coverage	Decision sub-questions with at least one relevant source	Find uncovered angles before adding similar sources
Independence	Key claims corroborated by distinct origins	Trace every repetition back to its primary source
Freshness	Age of evidence relative to how quickly the subject changes	Give each conclusion an expiry date
Traceability	Key claims connected to a verifiable reference	Add citations during collection

Common pitfalls

Collecting before framing the decision
Citing an aggregator instead of the primary source
Turning lack of evidence into evidence of absence
Hiding contradictions to simplify the conclusion

Frequently asked questions

How is OSINT different from web search?

OSINT adds a defined objective, collection method, traceability, source assessment and reporting proportional to the decision risk.

How many sources are enough?

There is no universal number. Seek independent origins and sufficient coverage of the claims that could change the decision.

Can collection be automated?

Yes for discovery, normalisation and monitoring. Scope, legality, source identity, contradictions and conclusions still require explicit human review.

OSINT: origins, repetitions and corroboration

OSINT: five documents do not mean five origins

The number of repetitions of a claim does not describe independence. For the question being examined, trace each document to its underlying observation or acquisition. This fictional graph supplies its links for the exercise; they are not inferred automatically.

A feeds B, which feeds C. D uses a separate acquisition in the example. E has unknown origin. Five documents therefore lead to two documented origin chains and one unresolved origin, without a truth verdict. — Fictional example: repetitions, separate acquisition and unknown origin

OSINT: five documents do not mean five origins
Fictional document	Supplied document link	What the reader can retain
A · First sensor publication	Acquisition A retained for this exercise.	First declared origin chain; sensor accuracy is a separate question.
B · Article repeating A	B explicitly cites A with no new acquisition.	An additional repetition, not an additional independent observation.
C · Thread repeating B	C repeats B, which depends on A.	A second repetition still traces back to origin A.
D · Second sensor log	Acquisition D is separate in the fictional data.	Second documented chain in this exercise; inspect collection conditions before corroboration.
E · Capture with no reference	No origin established in the supplied set.	Unknown origin should count neither as independent nor as fake by default.

This example contains five documents, two documented origin chains (A and D) and one unresolved origin (E). The count is neither a credibility score nor proof that two observations confirm the same claim.

Four questions that can change the conclusion

Do the documents concern the same claim, period and object?
Are acquisitions separate or do they share a source, instrument, error or bias?
Which assumptions link observation to conclusion and what information would contradict them?
Which copy, collection date and exact link let another analyst repeat the comparison?

ICD 203 calls for describing source quality, expressing uncertainty, separating information from judgments and examining alternatives. We use those methodological references for this exercise; it is neither an official intelligence product nor an accreditation.

ODNI · ICD 203, Analytic Standards · D.6.e(1)–(4) · References consulted on 2026-10-30

Open the C2PA explorer and publication cases →

STIX indicators and TLP sharing

Qualify the source before using an indicator

Structured intelligence retains provenance and a version history. For an actionable OSINT note, separate collected facts, the producer’s assertion and the local conclusion, then state what still needs confirmation.

Distinguish the declared object creator from the service relaying it.
Compare versions, validity window and any revocation before reusing an old indicator.
Present producer confidence as a contextual assessment, including its limits and available independent corroboration.

Read the STIX, observations and TLP sharing reference →

Sources checked on 2026-10-22 · OASIS · STIX 2.1

OSINT: evidence preservation

Connect source context, preserved bytes and each handling action

Usable OSINT work retains more than a link and a screenshot. It connects collected material to context, handling roles and transformations used during analysis. The dossier must distinguish observations, technical copies, redacted versions and analytical conclusions.

This editorial method adapts NIST preservation principles for organisational review of sources and files. NIST IR 8387 primarily addresses evidence-management professionals; SP 800-86 covers IT forensics within incident response. Fields and scenarios below are local examples, not a NIST form, certification or guarantee of admissibility.

Empty archive room with document cases and digital evidence storage — Fictional empty archive with documents, media and secure storage. A conceptual illustration from the collection; it represents neither real evidence nor an agency facility.

Five questions the dossier must keep separate

Five questions the dossier must keep separate
Question	Useful evidence	Limit to retain
Byte integrity	Compare a calculated digest with a protected reference for a specific object and scope.	A match identifies neither the author nor the first custodian. A reference rewritten alongside the file no longer protects that comparison.
Origin and context	Record the claimed source, collection method, useful identifiers and observation conditions.	A filename, title or domain visible in an image does not by itself establish provenance.
Custody continuity	Connect transfers, receipts, access and actions to identifiable roles and times.	An unchanged digest does not fill undocumented periods or transfers.
Transformation and lineage	Give an extract, transcription or redacted version a new identifier and retain its parent link.	A derivative can have a different digest without being a covert alteration of the preserved object.
Analytical interpretation	Cite material used, assumptions, alternatives and coverage limits.	Intact bytes may contain false, partial or out-of-context information.

Ten proposed preservation-record fields

Ten proposed preservation-record fields
Proposed field	Useful content	Review check
Identity and scope	Case, object, version, collection type and links to related material.	Identify a precise object without conflating a file, whole archive and extract.
Observed source	URL or system, publication identifier, provider and authorised access context.	Separate claimed source, direct observation and material copied by a third party.
Time and clock	Raw time, known timezone or offset, collection time and any normalization.	Retain clock uncertainty; do not invent ordering between poorly dated events.
Collection method	Tool, version, relevant parameters and responsible operator or role.	Make the procedure understandable; a logical export is not automatically a complete media image.
Reference digest	Algorithm, value, byte count and exact scope of hashed data.	Keep the reference protected against changes made alongside the object.
Location and access	Internal storage reference, access level, owner and useful history.	Check who can read, modify, replace or delete both material and its reference record.
Handover and receipt	Sender, recipient, time, object, purpose and acknowledgement.	A declared handover differs from confirmed receipt.
Copies and derivatives	Parent, new identifier, transformation, tool and digest for each result.	Preserve the reference object and state what was removed or transformed.
Preservation incidents	Digest mismatch, unexplained access, missing transfer and handling action.	Retain the observed discrepancy; never silently replace the reference to make the check pass.
Purpose and retention	Analysis purpose, intended recipients, retention policy and review point.	Adapt access and retention to the case; the example establishes no universal duration.

Exact copies and derivatives require different comparisons

Three objects, two binary contents in the exercise

All three objects are invented. Digests below are calculated over their exact UTF-8 strings, with LF after each line including the final line. E01 and E02 have identical content; D01 is documented new content.

Three objects, two binary contents in the exercise
Object / parent	Scenario role	UTF-8 size and SHA-256
E01	Fictional captured object; no parent within this dossier.	72 bytes · SHA-256: 26b8f611a7e9a53474ffc21f3e7b7be89ca1bb8cf69f85f526171e9b91eee963
E02 ← E01	Exact copy of E01 for technical review.	72 bytes · SHA-256: 26b8f611a7e9a53474ffc21f3e7b7be89ca1bb8cf69f85f526171e9b91eee963
D01 ← E02	Version of E02 with the textual source replaced by [redacted].	51 bytes · SHA-256: 98fd0d2daa0e77e87bfe1f497150a5c8cde80dc5d6b4a14489caacdc54f7f2cc

Inspect the exact strings used to calculate the digests

Inspect the exact strings used to calculate the digests
Object	JSON string representing the UTF-8 bytes
E01	"CASE-TRAINING-07\nstatus=observed\nsource=https://public.example/report/7\n"
E02	"CASE-TRAINING-07\nstatus=observed\nsource=https://public.example/report/7\n"
D01	"CASE-TRAINING-07\nstatus=observed\nsource=[redacted]\n"

SHA-256 covers text content only here: not the filename, path, permissions or filesystem timestamps. Matching digests therefore do not establish equal metadata, origin or creation time.

Seven records in a fictional chain of custody

All times in this scenario are UTC on 2026-10-22. Roles A–D are fictional. Timestamps express recorded exercise events; they are not qualified timestamp tokens or digital signatures.

Seven records in a fictional chain of custody
UTC time / object	Role and action	Recorded outcome
10:00:00 · E01	Collector A: record capture and context.	Initial digest and collection reference retained in the scenario.
10:02:00 · E01	Custodian B: confirm receipt into preservation storage.	Receipt and protected reference recorded; preservation separate from workspace.
10:05:00 · E02	Analyst C: create a working copy of E01.	Size and digest compared with E01; parent link retained.
10:08:00 · E02	Analyst C: declare handover for controlled review.	Handover recorded; receipt still pending at this instant.
10:09:00 · E02	Reviewer D: acknowledge receipt and check the copy.	Receipt linked to the preceding handover; content comparison recorded.
10:15:00 · D01	Analyst C: create a redacted derivative of E02.	New identifier, transformation and D01 digest recorded; E01 and E02 preserved.
10:20:00 · D01	Reviewer D: review the release scope.	Redaction review recorded; this example performs no actual publication.

A log does not become tamper-proof because it contains digests. Storage, individual authentication, permissions and reference protection require separate checks. Report a gap explicitly; adding a plausible time afterwards does not repair it.

Eight situations requiring a bounded conclusion

01 · Identical copy, origin still uncorroborated

Fictional observation: E01 and E02 share size and SHA-256; the claimed source of E01 has not been corroborated.

Bounded conclusion: comparison is consistent with a byte-identical copy. It does not prove the claimed author or origin. Next evidence: collection context and independent corroboration.

02 · First digest calculated after a change

Fictional observation: the first available digest was calculated after an edit of unknown extent.

Bounded conclusion: the reference describes the version hashed at that time. It does not establish absence of changes before calculation. Retain this limit and seek a documented earlier copy.

03 · File and reference replaced together

Fictional observation: one account can replace both object and control reference without an independent trail.

Bounded conclusion: a check can become self-consistent after alteration. Preserve protected references and examine rights and logs; comparison alone is insufficient.

04 · Redacted derivative with a new digest

Fictional observation: D01 removes the textual source and has a different digest from E02. The transformation is documented.

Bounded conclusion: this derivative’s difference is expected and must remain visible. Check lineage, removed content and release suitability. A redacted label does not prove absence of residual data.

05 · Digest mismatch on a claimed exact copy

Fictional observation: a claimed exact copy does not match the expected reference digest.

Bounded conclusion: comparison fails for the hashed scope. Isolate the working copy, retain the observation and investigate cause; infer neither malicious intent nor permission to overwrite the reference.

06 · Declared handover without receipt

Fictional observation: a record declares handover at 10:08 but no confirmed receipt is available.

Bounded conclusion: handover is declared; receipt remains unestablished. An unchanged digest does not identify the custodian during the interval. Seek receipt records and disclose the gap.

07 · Unknown timezone in a timeline

Fictional observation: two logs show 10:05 and 10:07, but one clock’s timezone and offset are unknown.

Bounded conclusion: retain raw times and uncertainty; do not infer causality from apparent order. Any normalization must retain an explicit, revisable assumption.

08 · Screenshot with incomplete source coverage

Fictional observation: an intact screenshot shows neither the whole publication nor its display conditions.

Bounded conclusion: it retains an observed view, not necessarily the whole source. Record visible content, missing coverage and possible dynamic versions; distinguish capture fidelity from content truthfulness.

Six checks before handing over an assessment

Each important assertion points to an identified object and its collection scope.
Digests retain algorithm, exact byte scope and a protected reference.
Working copies and derivatives retain parents, versions and transformations.
Handover and receipt remain distinct; gaps and uncertain times stay visible.
Release uses the intended versions and a review of removed or remaining information.
The assessment separates observation, interpretation, assumption and unproven conclusion.

Field numbers, three objects and seven records are a local teaching construction. Document editions and scope are stated so they are not presented as a universal judicial procedure.

Primary sources and method adaptation

NIST · Digital Evidence Preservation · NIST IR 8387 · September 2022
Preservation scope and publication record
NIST IR 8387 · Full report · September 2022 · reviewed 2026-10-22
§3.2 · printed pp. 7–11: custody, copies, storage and protection of reference hashes
NIST · SP 800-86 · August 2006 · IT forensics guidance
Scope: integration of forensic techniques into incident response
NIST SP 800-86 · Full report · August 2006 · reviewed 2026-10-22
§3.1 · printed pp. 3-2–3-5: acquire, verify and document custody
NIST · FIPS 180-4 · Secure Hash Standard · August 2015 · revision planning note dated 2023-03-07
Hash algorithms and message-change detection; a digest is not proof of origin

Sources reviewed on 2026-10-22

PDF: redaction and release

Redact the assessment without replacing preserved sources

A shareable version and a working reference serve different purposes. Retain lineage and review visible information, hidden content and recipients of the derivative.

Give the redacted copy an identifier and retain its parent link.
Do not repeat removed values in a widely accessible ticket or screenshot.
Test the delivered file, including its text layer and attachments.

See surfaces and the pre-sharing review matrix →

Sources reviewed on 2026-10-22 · Adobe · Redacting and sanitizing PDFs · Adobe · Redact sensitive content · Adobe · Sanitize PDFs · ICO · Avoid accidental breaches when redacting · ICO · Hidden information in documents · Microsoft · Document Inspector

Timelines: UTC and time zones

A displayed date cannot by itself order sources

Collection can encounter repeated local times or receive a publication late. Preserve original text, offset, zone and observation traceability before constructing an OSINT timeline.

Seek clarification when one local time has two possible instants.
Retain the time-zone rule version used for conversion.
Separate computed temporal order, clock quality and causal interpretation.

Read the 12 cases and three dated snapshots →

Sources reviewed on 2026-10-22 · IETF · RFC 3339 · Python · PEP 495 · Python 3.12 · zoneinfo · IANA · Time Zone Database 2026e · IANA · 2026e Europe rules · OpenTelemetry · Logs Data Model

IANA references and DNSSEC interpretation

DNS evidence alone cannot attribute a website

An authenticated DNS response concerns zone data in a trust chain. It does not by itself identify the organisation deciding what content is published.

Keep queried name, type, time, resolver and observed response.
Separate RDAP registration data, hosting, DNS publication and editorial content.
Reconcile independent evidence and preserve unresolved points.

Read the registries and try the cache model →

IETF · RFC 4033 · §3–5 · 2026-10-23

TLS certificates and open-source intelligence

Certificate Transparency (CT) makes TLS certificates and precertificates observable in public logs. For OSINT and attack-surface research, this is documentary evidence to corroborate: a certificate trace does not establish a live service, current domain control or the identity of a publisher.

Documentary snapshot of Chrome’s list, version 95.9, generated on 22 October 2026 at 13:35:15 UTC and checked on 23 October 2026. Scope: log_list.json only, not every CT log in existence. States and interfaces describe this edition; this page performs no network checks of the logs.

Four different evidence objects

Four different evidence objects
Object	What it helps examine	What it does not establish alone
Certificate / precertificate	Declared names, issuer, public key and validity period; a precertificate is a distinct object.	Server deployment, present DNS resolution or the responsible party’s legal identity.
SCT · Signed Certificate Timestamp	A log’s signed commitment to incorporate an entry within its MMD.	Already demonstrated membership in a tree: a promise is not an inclusion proof.
STH + inclusion proof	Membership of a leaf in the root of a tree of a specified size, following cryptographic verification.	Consistency of every view of the log or current TLS validity of the certificate.
Consistency proof	A relationship between two states of the same tree: the later state extends the earlier one without changing old entries.	Worldwide absence of divergent views; observations also need comparison between observers.

IETF · RFC 6962 · Certificate Transparency · June 2013 · Experimental · §§2.1, 3, 5.4, 7

Two interface families in the snapshot

The source’s “logs” entries correspond to RFC 6962; “tiled_logs” entries to static-ct-api. The latter separates submission and static-resource monitoring prefixes while producing SCTs according to RFC 6962. It is not another name for CT v2. RFC 9162 describes version 2.0 and obsoletes RFC 6962 as a document; that does not automatically turn deployed interfaces into v2.

C2SP · Static Certificate Transparency API · v1.1.0

IETF · RFC 9162 · Certificate Transparency Version 2.0 · December 2021 · Experimental · obsoletes RFC 6962

Read the fields without changing their meaning

Read the fields without changing their meaning
Source field	Correct reading	Analytical pitfall
log_id	SHA-256 of the DER SubjectPublicKeyInfo public key, encoded as base64.	A human-readable log name does not replace this cryptographic identifier.
state + timestamp	The distributor’s state for the log and the instant it entered that state.	That instant is not a certificate’s issuance date.
mmd	Declared maximum merge delay in seconds.	It is neither measured uptime nor certificate validity duration.
temporal_interval	Accepted NotAfter expiry dates: inclusive start, exclusive end.	It is not the log’s operational lifetime.
url / monitoring_url / submission_url	Log interface prefixes, retaining their respective roles.	A static monitoring prefix is not an RFC 6962 get-entries API.

Google Chrome · Log list schema v3 · Schema checked against the stored source snapshot

Understand the four states present

Understand the four states present
State at list time	Documentary interpretation
usable	Usable in Chrome’s described lifecycle; this label is not a health measurement performed by CIE.
qualified	Admitted following initial monitoring; recognition propagates through client releases.
readonly	The log stops issuing new SCTs; a final tree size and root are published in the source.
retired	The log is no longer relied on to create new SCTs. Analysis of old SCTs depends on their dates and the client’s policy, among other factors.

Other states exist, including pending and rejected, but are absent from this snapshot. This table explains labels; it does not calculate a certificate’s compliance with a browser policy.

Google Chrome · CT Log Lifecycle · Consulted 2026-10-23

Explore the 85 logs in the dated list

Filters apply to the local snapshot only. All 85 rows remain available without JavaScript. Global counts retain the complete scope; filtered results have a separate counter. Prefixes are displayed as documentary data without automatic requests. The table has its own vertical and horizontal scrolling region, accessible by keyboard.

Logs in the snapshot: 85
Operators: 11
usable: 43
readonly: 2
qualified: 37
retired: 3
RFC 6962: 26
static-ct-api: 59

Logs shown : 85 / 85

Explore the 85 logs in the dated list · 2026-10-22T13:35:15Z
Log and LogID	Operator	State at list time	MMD (s)	Accepted NotAfter · UTC	Interface and prefixes
Google Argon2026h2 Technical details LogID: `1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=`	Google	usable 2024-09-30T22:19:27Z	86400	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	RFC 6962 Technical details url: `https://ct.googleapis.com/logs/us1/argon2026h2/`
Google Argon2027h1 Technical details LogID: `1tWNqdAXU/NqSqDHV0kCr+vH3CzTjNn3ZMgMiRkenwI=`	Google	usable 2025-12-28T00:30:00Z	86400	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	RFC 6962 Technical details url: `https://ct.googleapis.com/logs/us1/argon2027h1/`
Google Xenon2026h2 Technical details LogID: `2AlVO5RPev/IFhlvlE+Fq7D4/F6HVSYPFdEucrtFSxQ=`	Google	usable 2024-09-30T22:19:27Z	86400	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	RFC 6962 Technical details url: `https://ct.googleapis.com/logs/eu1/xenon2026h2/`
Google Xenon2027h1 Technical details LogID: `RMK9DOkUDmSlyUoBkwpaobs1lw4A7hEWiWgqHETXtWY=`	Google	usable 2025-12-28T00:30:00Z	86400	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	RFC 6962 Technical details url: `https://ct.googleapis.com/logs/eu1/xenon2027h1/`
Google ParcelYard2026h2 Technical details LogID: `utuIpG+cr6QJDoLlk1bbbni0pT9YLbCBl5UkLym2jJg=`	Google	usable 2026-08-31T13:50:00Z	60	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://parcelyard2026h2.prod.certificate.transparency.goog/` monitoring_url: `https://storage.googleapis.com/parcelyard2026h2.prod.certificate.transparency.goog/`
Google ParcelYard2027h1 Technical details LogID: `HIl0B+YBCgEpO7Z439ejaM6xjMpSHcyk04bkoy5bXQQ=`	Google	usable 2026-08-31T13:50:00Z	60	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://parcelyard2027h1.prod.certificate.transparency.goog/` monitoring_url: `https://storage.googleapis.com/parcelyard2027h1.prod.certificate.transparency.goog/`
Google ParcelYard2027h2 Technical details LogID: `aYS3IzyydLLRRn2l4EDXH+upCiHniGU3Srn5vPhocjc=`	Google	usable 2026-08-31T13:50:00Z	60	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://parcelyard2027h2.prod.certificate.transparency.goog/` monitoring_url: `https://storage.googleapis.com/parcelyard2027h2.prod.certificate.transparency.goog/`
Google PlumbersArms2026h2 Technical details LogID: `IPBfqqOkkvxqwUjMM6ICNhhrSfqpfmuzkk+yXsNrHDU=`	Google	usable 2026-08-31T13:50:00Z	60	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://plumbersarms2026h2.prod.certificate.transparency.goog/` monitoring_url: `https://storage.googleapis.com/plumbersarms2026h2.prod.certificate.transparency.goog/`
Google PlumbersArms2027h1 Technical details LogID: `X/nA+6QtrHjOZELrGazggaKb1OL7U68MYzB55QWCBMk=`	Google	usable 2026-08-31T13:50:00Z	60	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://plumbersarms2027h1.prod.certificate.transparency.goog/` monitoring_url: `https://storage.googleapis.com/plumbersarms2027h1.prod.certificate.transparency.goog/`
Google PlumbersArms2027h2 Technical details LogID: `M3qex8rmqQSLdS8tk65+SyqQLSG0lxKdg+J5x1PJL4w=`	Google	usable 2026-08-31T13:50:00Z	60	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://plumbersarms2027h2.prod.certificate.transparency.goog/` monitoring_url: `https://storage.googleapis.com/plumbersarms2027h2.prod.certificate.transparency.goog/`
Cloudflare Nimbus2026 Technical details LogID: `yzj3FYl8hKFEX1vB3fvJbvKaWc1HCmkFhbDLFMMUWOc=`	Cloudflare	usable 2024-11-08T18:00:00Z	86400	Inclusive start 2026-01-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	RFC 6962 Technical details url: `https://ct.cloudflare.com/logs/nimbus2026/`
Cloudflare Nimbus2027 Technical details LogID: `TGPcmOWcHauI9h6KPd6uj6tEozd7X5uUw/uhnPzBviY=`	Cloudflare	usable 2025-11-15T00:00:00Z	86400	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	RFC 6962 Technical details url: `https://ct.cloudflare.com/logs/nimbus2027/`
DigiCert Wyvern2026h2 Technical details LogID: `wjF+V0UZo0XufzjespBB68fCIVoiv3/Vta12mtkOUs0=`	DigiCert	usable 2024-11-08T00:00:00Z	86400	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	RFC 6962 Technical details url: `https://wyvern.ct.digicert.com/2026h2/`
DigiCert Wyvern2027h1 Technical details LogID: `ABpdGhwtk3W2SFV4+C9xoa5u7zl9KXyK4xV7yt7hoB4=`	DigiCert	usable 2025-12-20T18:00:00Z	86400	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	RFC 6962 Technical details url: `https://wyvern.ct.digicert.com/2027h1/`
DigiCert Wyvern2027h2 Technical details LogID: `N6oHzCFvLm2RnHCdJNj3MbAPKxR8YhzAkaX6GoTYFt0=`	DigiCert	usable 2025-12-20T18:00:00Z	86400	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	RFC 6962 Technical details url: `https://wyvern.ct.digicert.com/2027h2/`
DigiCert Sphinx2026h2 Technical details LogID: `lE5Dh/rswe+B8xkkJqgYZQHH0184AgE/cmd9VTcuGdg=`	DigiCert	usable 2024-11-08T00:00:00Z	86400	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	RFC 6962 Technical details url: `https://sphinx.ct.digicert.com/2026h2/`
DigiCert Sphinx2027h1 Technical details LogID: `RqI5Z8YNtkaHxm89+ZmUdpOmphEghFfVVefj0KHZtkY=`	DigiCert	usable 2025-12-20T18:00:00Z	86400	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	RFC 6962 Technical details url: `https://sphinx.ct.digicert.com/2027h1/`
DigiCert Sphinx2027h2 Technical details LogID: `H7D4qS2K3aEhd2wF4qouFbrLxitlOTaVV2qqtS4R0R0=`	DigiCert	usable 2025-12-20T18:00:00Z	86400	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	RFC 6962 Technical details url: `https://sphinx.ct.digicert.com/2027h2/`
Sectigo Mammoth2026h2 Technical details LogID: `lLHBirDQV8R74KwEDh8svI3DdXJ7yVHyClJhJoY7pzw=` Final tree size: `57634084` Final tree root (SHA-256): `vJHecZC18lG3qp9lV2jZoi+7nkPHQx2SmM4VWglNsIk=`	Sectigo	readonly 2025-09-18T17:20:00Z	86400	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	RFC 6962 Technical details url: `https://mammoth2026h2.ct.sectigo.com/`
Sectigo Sabre2026h2 Technical details LogID: `H1bRq5RwSkHdP+r99GmTVTAsFDG/5hNGCJ//rnldzC8=` Final tree size: `68732791` Final tree root (SHA-256): `HWG3vP/FX6JRs5yyXDfrNoUA7D6TZAib9ZE2Llno0II=`	Sectigo	readonly 2025-09-18T17:20:00Z	86400	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	RFC 6962 Technical details url: `https://sabre2026h2.ct.sectigo.com/`
Sectigo Elephant2026h2 Technical details LogID: `r2eIO1ewTt2Pptl+9i6o64EKx3Fg8CReVdYML+eFhzo=`	Sectigo	usable 2025-07-22T01:33:20Z	86400	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	RFC 6962 Technical details url: `https://elephant2026h2.ct.sectigo.com/`
Sectigo Elephant2027h1 Technical details LogID: `YEyar3p/d18B1Ab8kg3ImesLHH34yVIb+voXdzuXi8k=`	Sectigo	usable 2025-07-22T01:33:20Z	86400	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	RFC 6962 Technical details url: `https://elephant2027h1.ct.sectigo.com/`
Sectigo Elephant2027h2 Technical details LogID: `okkM3NuOM6QAMhdg1tTVGiA2GR6nfZaL4mqKAPb///c=`	Sectigo	usable 2025-07-22T01:33:20Z	86400	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	RFC 6962 Technical details url: `https://elephant2027h2.ct.sectigo.com/`
Sectigo Tiger2026h2 Technical details LogID: `yKPEf8ezrbk1awE/anoSbeM6TkOlxkb5l605dZkdz5o=`	Sectigo	usable 2025-09-18T23:00:00Z	86400	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	RFC 6962 Technical details url: `https://tiger2026h2.ct.sectigo.com/`
Sectigo Tiger2027h1 Technical details LogID: `HJ9oLOn68EVpUPgbloqH3dsyENhM5siy44JSSsTPWZ8=`	Sectigo	usable 2025-09-18T23:00:00Z	86400	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	RFC 6962 Technical details url: `https://tiger2027h1.ct.sectigo.com/`
Sectigo Tiger2027h2 Technical details LogID: `A4AqwmL24F4D+Lxve5hRMk/Xaj31t1lRdeIi+46b1fY=`	Sectigo	usable 2025-09-18T23:00:00Z	86400	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	RFC 6962 Technical details url: `https://tiger2027h2.ct.sectigo.com/`
Sectigo Monument2027h1 Technical details LogID: `lU+RNjI2rVhXzDYVRyLcQOf5ugowsOdS+/DHSylmVrg=`	Sectigo	qualified 2026-10-14T13:50:00Z	60	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://monument2027h1.sub.ct.sectigo.com/` monitoring_url: `https://monument2027h1.mon.ct.sectigo.com/`
Sectigo Monument2027h2 Technical details LogID: `tvzC6p+E49qX4wl/sfIW6R/w154KB0QDJbBvlPXmU8U=`	Sectigo	qualified 2026-10-14T13:50:00Z	60	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://monument2027h2.sub.ct.sectigo.com/` monitoring_url: `https://monument2027h2.mon.ct.sectigo.com/`
Sectigo Monument2028h1 Technical details LogID: `Mk28xZLuH+bg6aYx4WURJaunVGze9l0TxxGtWhs4aqk=`	Sectigo	qualified 2026-10-14T13:50:00Z	60	Inclusive start 2028-01-01T00:00:00Z Exclusive end 2028-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://monument2028h1.sub.ct.sectigo.com/` monitoring_url: `https://monument2028h1.mon.ct.sectigo.com/`
Sectigo Monument2028h2 Technical details LogID: `bHsR9YaIq7BLUlT3PyIbVVjgvpNRI3MlcGGfeugsbBA=`	Sectigo	qualified 2026-10-14T13:50:00Z	60	Inclusive start 2028-07-01T00:00:00Z Exclusive end 2029-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://monument2028h2.sub.ct.sectigo.com/` monitoring_url: `https://monument2028h2.mon.ct.sectigo.com/`
Sectigo Statue2027h1 Technical details LogID: `k0C4iKejzC796l4cBupj6U7f6w4VXgIIZFIAYZlMotE=`	Sectigo	qualified 2026-10-14T13:50:00Z	60	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://statue2027h1.sub.ct.sectigo.com/` monitoring_url: `https://statue2027h1.mon.ct.sectigo.com/`
Sectigo Statue2027h2 Technical details LogID: `V+RgJ5TwE01vJbkN3nyKr9cuefY8ogzD9dFPs4lFv1U=`	Sectigo	qualified 2026-10-14T13:50:00Z	60	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://statue2027h2.sub.ct.sectigo.com/` monitoring_url: `https://statue2027h2.mon.ct.sectigo.com/`
Sectigo Statue2028h1 Technical details LogID: `/Cvx3M57P/mNzO4pdqi0IuiOCa6pt5mhesjSWzqR+MA=`	Sectigo	qualified 2026-10-14T13:50:00Z	60	Inclusive start 2028-01-01T00:00:00Z Exclusive end 2028-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://statue2028h1.sub.ct.sectigo.com/` monitoring_url: `https://statue2028h1.mon.ct.sectigo.com/`
Sectigo Statue2028h2 Technical details LogID: `Zw/v+c0tZeC4UfTSi9vY+BdtNeIL3fhbQhT74s+jXiM=`	Sectigo	qualified 2026-10-14T13:50:00Z	60	Inclusive start 2028-07-01T00:00:00Z Exclusive end 2029-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://statue2028h2.sub.ct.sectigo.com/` monitoring_url: `https://statue2028h2.mon.ct.sectigo.com/`
Let's Encrypt Oak2026h2 Technical details LogID: `rKswcGzr7IQx9BPS9JFfER5CJEOx8qaMTzwrO6ceAsM=`	Let's Encrypt	retired 2026-02-28T00:00:00Z	86400	Inclusive start 2026-06-20T00:00:00Z Exclusive end 2027-01-20T00:00:00Z	RFC 6962 Technical details url: `https://oak.ct.letsencrypt.org/2026h2/`
Let's Encrypt Sycamore2026h2 Technical details LogID: `bP5QGUOoXqkWvFLRM+TcyR7xQRx9JYQg0XOAnhgY6zo=`	Let's Encrypt	usable 2025-11-27T03:00:00Z	60	Inclusive start 2026-06-18T00:00:00Z Exclusive end 2026-12-17T00:00:00Z	static-ct-api Technical details submission_url: `https://log.sycamore.ct.letsencrypt.org/2026h2/` monitoring_url: `https://mon.sycamore.ct.letsencrypt.org/2026h2/`
Let's Encrypt Sycamore2027h1 Technical details LogID: `jspHC6zeavOiBrCkeoS3Rv4fxr+VPiXmm07kAkjzxug=`	Let's Encrypt	usable 2025-11-27T03:00:00Z	60	Inclusive start 2026-12-17T00:00:00Z Exclusive end 2027-06-18T00:00:00Z	static-ct-api Technical details submission_url: `https://log.sycamore.ct.letsencrypt.org/2027h1/` monitoring_url: `https://mon.sycamore.ct.letsencrypt.org/2027h1/`
Let's Encrypt Sycamore2027h2 Technical details LogID: `5eNiR9ku9K2jhYO1NZHbcp/C8ArktnRRdNPd/GqiU4g=`	Let's Encrypt	usable 2025-11-27T03:00:00Z	60	Inclusive start 2027-06-18T00:00:00Z Exclusive end 2027-12-16T00:00:00Z	static-ct-api Technical details submission_url: `https://log.sycamore.ct.letsencrypt.org/2027h2/` monitoring_url: `https://mon.sycamore.ct.letsencrypt.org/2027h2/`
Let's Encrypt Willow2026h2 Technical details LogID: `qCbL4wrGNRJGUz/gZfFPGdluGQgTxB3ZbXkAsxI8VSc=`	Let's Encrypt	usable 2025-11-27T03:00:00Z	60	Inclusive start 2026-06-17T00:00:00Z Exclusive end 2026-12-16T00:00:00Z	static-ct-api Technical details submission_url: `https://log.willow.ct.letsencrypt.org/2026h2/` monitoring_url: `https://mon.willow.ct.letsencrypt.org/2026h2/`
Let's Encrypt Willow2027h1 Technical details LogID: `ooEAGHNOF24dR+CVQPOBulRml81jqENQcW64CU7a8Q0=`	Let's Encrypt	usable 2025-11-27T03:00:00Z	60	Inclusive start 2026-12-16T00:00:00Z Exclusive end 2027-06-17T00:00:00Z	static-ct-api Technical details submission_url: `https://log.willow.ct.letsencrypt.org/2027h1/` monitoring_url: `https://mon.willow.ct.letsencrypt.org/2027h1/`
Let's Encrypt Willow2027h2 Technical details LogID: `ppWirZJtb5lujvxJAUJX2LvwRqfWJYm4jcLXh2x45S8=`	Let's Encrypt	usable 2025-11-27T03:00:00Z	60	Inclusive start 2027-06-17T00:00:00Z Exclusive end 2027-12-15T00:00:00Z	static-ct-api Technical details submission_url: `https://log.willow.ct.letsencrypt.org/2027h2/` monitoring_url: `https://mon.willow.ct.letsencrypt.org/2027h2/`
Let's Encrypt Sycamore2028h1 Technical details LogID: `G3i5n/pJwlzEUFl1q/10eRTf3fp7/dOdKjW5WQStPog=`	Let's Encrypt	qualified 2026-10-14T13:50:00Z	60	Inclusive start 2027-12-16T00:00:00Z Exclusive end 2028-06-14T00:00:00Z	static-ct-api Technical details submission_url: `https://log.sycamore.ct.letsencrypt.org/2028h1/` monitoring_url: `https://mon.sycamore.ct.letsencrypt.org/2028h1/`
Let's Encrypt Sycamore2028h2 Technical details LogID: `d+CXC8fTD+AkXF2y76h1TAjrOpDdwSu11U7iiv4neHA=`	Let's Encrypt	qualified 2026-10-14T13:50:00Z	60	Inclusive start 2028-06-14T00:00:00Z Exclusive end 2028-12-20T00:00:00Z	static-ct-api Technical details submission_url: `https://log.sycamore.ct.letsencrypt.org/2028h2/` monitoring_url: `https://mon.sycamore.ct.letsencrypt.org/2028h2/`
Let's Encrypt Willow2028h1 Technical details LogID: `caQ99zUpUI88YXJqTPeP+cknbMBSwvd3Zql1T9QKkMM=`	Let's Encrypt	qualified 2026-10-14T13:50:00Z	60	Inclusive start 2027-12-15T00:00:00Z Exclusive end 2028-06-15T00:00:00Z	static-ct-api Technical details submission_url: `https://log.willow.ct.letsencrypt.org/2028h1/` monitoring_url: `https://mon.willow.ct.letsencrypt.org/2028h1/`
Let's Encrypt Willow2028h2 Technical details LogID: `vey1qmLph0NZ/U7NvnDZ8G8+j71Fo6xrycKFEbx0wJw=`	Let's Encrypt	qualified 2026-10-14T13:50:00Z	60	Inclusive start 2028-06-15T00:00:00Z Exclusive end 2028-12-21T00:00:00Z	static-ct-api Technical details submission_url: `https://log.willow.ct.letsencrypt.org/2028h2/` monitoring_url: `https://mon.willow.ct.letsencrypt.org/2028h2/`
TrustAsia log2026a Technical details LogID: `dNudWPfUfp39eHoWKpkcGM9pjafHKZGMmhiwRQ26RLw=`	TrustAsia	usable 2024-09-20T00:00:00Z	86400	Inclusive start 2025-12-24T00:00:00Z Exclusive end 2027-01-08T00:00:00Z	RFC 6962 Technical details url: `https://ct2026-a.trustasia.com/log2026a/`
TrustAsia log2026b Technical details LogID: `Jbfv3qETAZPtkweXcKoyKiZiDeNayKp8dRl94LGp4GU=`	TrustAsia	usable 2024-09-20T00:00:00Z	86400	Inclusive start 2025-12-24T00:00:00Z Exclusive end 2027-01-08T00:00:00Z	RFC 6962 Technical details url: `https://ct2026-b.trustasia.com/log2026b/`
TrustAsia HETU2027 Technical details LogID: `7drrgVxjITRJtHvlB3kFq9DZMUfCesUUazvFjkPptsc=`	TrustAsia	usable 2025-12-28T00:30:00Z	86400	Inclusive start 2026-12-25T00:00:00Z Exclusive end 2028-01-08T00:00:00Z	RFC 6962 Technical details url: `https://hetu2027.trustasia.com/hetu2027/`
TrustAsia Luoshu2027 Technical details LogID: `VzRIzG4dLA3JS2nyh9Hv5IPHolxQxTILuzrep29usEE=`	TrustAsia	usable 2026-02-11T18:30:00Z	60	Inclusive start 2026-12-24T00:00:00Z Exclusive end 2028-01-08T00:00:00Z	static-ct-api Technical details submission_url: `https://luoshu2027.trustasia.com/luoshu2027/` monitoring_url: `https://luoshu2027.trustasia.com/luoshu2027/`
Bogus placeholder log to unbreak misbehaving CT libraries Technical details LogID: `LtakTeuPDIZGZ3acTt0EH4QjZ1X6OqymNNCTXfzVmnA=`	Geomys	retired 2025-06-21T07:00:00Z	86400	Inclusive start 2020-01-01T08:00:00Z Exclusive end 2020-01-02T08:00:00Z	RFC 6962 Technical details url: `https://ct.example.com/bogus/`
Geomys Tuscolo2026h2 Technical details LogID: `Rq+GPTs+5Z+ld96oJF02sNntIqIj9GF3QSKUUu6VUF8=`	Geomys	usable 2025-08-31T07:00:00Z	60	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://tuscolo2026h2.sunlight.geomys.org/` monitoring_url: `https://tuscolo2026h2.skylight.geomys.org/`
Geomys Tuscolo2027h1 Technical details LogID: `WW5sM4aUsllyolbIoOjdkEp26Ag92oc7AQg4KBQ87lk=`	Geomys	usable 2025-10-08T21:00:00Z	60	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://tuscolo2027h1.sunlight.geomys.org/` monitoring_url: `https://tuscolo2027h1.skylight.geomys.org/`
Geomys Tuscolo2027h2 Technical details LogID: `1d5V7roItgyf/BjFE75qYLoARga8WVuWu0T2LMV9Ofo=`	Geomys	usable 2025-10-08T21:00:00Z	60	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://tuscolo2027h2.sunlight.geomys.org/` monitoring_url: `https://tuscolo2027h2.skylight.geomys.org/`
Geomys Tuscolo2028h1 Technical details LogID: `TefD7+U3ZpoMsB44OPqv3PCMmoBWM55wK1iVm9FxiS4=`	Geomys	qualified 2026-09-09T13:45:00Z	60	Inclusive start 2028-01-01T00:00:00Z Exclusive end 2028-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://tuscolo2028h1.sunlight.geomys.org/` monitoring_url: `https://tuscolo2028h1.skylight.geomys.org/`
Geomys Tuscolo2028h2 Technical details LogID: `A18eYQnn44YBqbhkHlfl9aePeIcnUy/PQlPx68mqDzk=`	Geomys	qualified 2026-09-09T13:45:00Z	60	Inclusive start 2028-07-01T00:00:00Z Exclusive end 2029-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://tuscolo2028h2.sunlight.geomys.org/` monitoring_url: `https://tuscolo2028h2.skylight.geomys.org/`
Geomys Trastevere2026h2 Technical details LogID: `yMaDuhp5vKPNGyZsbZ6MzSf0hFEMerHyV59nUhBYOgM=`	Geomys	qualified 2026-09-09T13:45:00Z	60	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://trastevere2026h2.sunlight.geomys.org/` monitoring_url: `https://trastevere2026h2.skylight.geomys.org/`
Geomys Trastevere2027h1 Technical details LogID: `F23RQr8KrLyBjUUTu9zDCtteWTJiU5KLmtfLdg/247k=`	Geomys	qualified 2026-09-09T13:45:00Z	60	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://trastevere2027h1.sunlight.geomys.org/` monitoring_url: `https://trastevere2027h1.skylight.geomys.org/`
Geomys Trastevere2027h2 Technical details LogID: `dZIIKK86Y1XymO0JfjR1dfm5hDwR4TkfV0QpnxyujO4=`	Geomys	qualified 2026-09-09T13:45:00Z	60	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://trastevere2027h2.sunlight.geomys.org/` monitoring_url: `https://trastevere2027h2.skylight.geomys.org/`
Geomys Trastevere2028h1 Technical details LogID: `j5ct6c9T2eqhZDHY6vWLWGZ8/QysT5c0VLGZaVHvlYc=`	Geomys	qualified 2026-09-09T13:45:00Z	60	Inclusive start 2028-01-01T00:00:00Z Exclusive end 2028-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://trastevere2028h1.sunlight.geomys.org/` monitoring_url: `https://trastevere2028h1.skylight.geomys.org/`
Geomys Trastevere2028h2 Technical details LogID: `y6VZ4BSDyZ+U7N2er0ezmWM1bZ/1wShe6un50SqgTMc=`	Geomys	qualified 2026-09-09T13:45:00Z	60	Inclusive start 2028-07-01T00:00:00Z Exclusive end 2029-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://trastevere2028h2.sunlight.geomys.org/` monitoring_url: `https://trastevere2028h2.skylight.geomys.org/`
Bogus RFC6962 log to avoid breaking misbehaving CT libraries Technical details LogID: `0vxlL6X5tzi4N1X6XrFfC0UlP06Po7m2T9TeVmLRhwg=`	IPng Networks	retired 2025-06-21T07:00:00Z	86400	Inclusive start 2020-01-01T08:00:00Z Exclusive end 2020-01-02T08:00:00Z	RFC 6962 Technical details url: `https://ct.example.com/bogus/ipng/`
IPng Networks Halloumi2026h2a Technical details LogID: `JuNkblhpISO8ND9HJDWbN5LNJFqI2BXTkzP9mRirRyM=`	IPng Networks	usable 2026-01-01T07:30:00Z	60	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://halloumi2026h2a.log.ct.ipng.ch/` monitoring_url: `https://halloumi2026h2a.mon.ct.ipng.ch/`
IPng Networks Halloumi2027h1 Technical details LogID: `ROgi/CurDpLu0On61pZkYCd20Bdg4IkFCckjobA/w38=`	IPng Networks	usable 2025-12-17T18:30:00Z	60	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://halloumi2027h1.log.ct.ipng.ch/` monitoring_url: `https://halloumi2027h1.mon.ct.ipng.ch/`
IPng Networks Halloumi2027h2 Technical details LogID: `CRV/Yy1Gx/dtlSZUk7wPALOVrF2zorJr+wQ9ukrGOJM=`	IPng Networks	usable 2025-12-17T18:30:00Z	60	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://halloumi2027h2.log.ct.ipng.ch/` monitoring_url: `https://halloumi2027h2.mon.ct.ipng.ch/`
IPng Networks Gouda2026h2 Technical details LogID: `Goudaw/+v4G0eTnG0jEKhtbRAtTwRuIYLJ3jX14mJe8=`	IPng Networks	usable 2025-11-27T03:00:00Z	60	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://gouda2026h2.log.ct.ipng.ch/` monitoring_url: `https://gouda2026h2.mon.ct.ipng.ch/`
IPng Networks Gouda2027h1 Technical details LogID: `Gouda43XkdHNBUnttgNV1ga2T60w23H+eI8Px8j7xLE=`	IPng Networks	usable 2025-11-27T03:00:00Z	60	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://gouda2027h1.log.ct.ipng.ch/` monitoring_url: `https://gouda2027h1.mon.ct.ipng.ch/`
IPng Networks Gouda2027h2 Technical details LogID: `GoudaVNi2GSSp7niI2BuNOzp4xC6NPuTBXhdKc5XV+s=`	IPng Networks	usable 2025-11-27T03:00:00Z	60	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://gouda2027h2.log.ct.ipng.ch/` monitoring_url: `https://gouda2027h2.mon.ct.ipng.ch/`
IPng Networks Gouda2028h1 Technical details LogID: `EgXQJVrBiTyuVBBwPE8Sc/yXAOErWEp/gGrcVVWAwLE=`	IPng Networks	qualified 2026-09-09T13:45:00Z	60	Inclusive start 2028-01-01T00:00:00Z Exclusive end 2028-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://gouda2028h1.log.ct.ipng.ch/` monitoring_url: `https://gouda2028h1.mon.ct.ipng.ch/`
IPng Networks Gouda2028h2 Technical details LogID: `ANXCUqZpzf6O0sgXpi5M/O2SyHSR7pccmv3bUoh4hag=`	IPng Networks	qualified 2026-09-09T13:45:00Z	60	Inclusive start 2028-07-01T00:00:00Z Exclusive end 2029-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://gouda2028h2.log.ct.ipng.ch/` monitoring_url: `https://gouda2028h2.mon.ct.ipng.ch/`
IPng Networks Halloumi2028h1 Technical details LogID: `6+a9C+qJOkTtPzg+2/4QzZnxhphufXsmsBqEMk57934=`	IPng Networks	qualified 2026-09-09T13:45:00Z	60	Inclusive start 2028-01-01T00:00:00Z Exclusive end 2028-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://halloumi2028h1.log.ct.ipng.ch/` monitoring_url: `https://halloumi2028h1.mon.ct.ipng.ch/`
IPng Networks Halloumi2028h2 Technical details LogID: `ALNWz93lJLRlXUxjZTxSUMQ04goEhRA5uv1kzlyFq2s=`	IPng Networks	qualified 2026-09-09T13:45:00Z	60	Inclusive start 2028-07-01T00:00:00Z Exclusive end 2029-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://halloumi2028h2.log.ct.ipng.ch/` monitoring_url: `https://halloumi2028h2.mon.ct.ipng.ch/`
Microsec Eszigno2026h2 Technical details LogID: `KNPGjqGDY293g5DLHjiKzpOgTpFpnQdXNunGFtEf4Gc=`	Microsec	qualified 2026-09-22T13:45:00Z	60	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://eszigno2026h2.log.ct.e-szigno.hu/` monitoring_url: `https://eszigno2026h2.mon.ct.e-szigno.hu/`
Microsec Eszigno2027h1 Technical details LogID: `eBAmYgxXrnCeBgs/iwSfqrh6aXhhDP+YpDWqAgNwe9k=`	Microsec	qualified 2026-09-22T13:45:00Z	60	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://eszigno2027h1.log.ct.e-szigno.hu/` monitoring_url: `https://eszigno2027h1.mon.ct.e-szigno.hu/`
Microsec Eszigno2027h2 Technical details LogID: `GrnppF/Ct4QLH+fciv7lRpXau5p8I9NfpTclu4k6md0=`	Microsec	qualified 2026-09-22T13:45:00Z	60	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://eszigno2027h2.log.ct.e-szigno.hu/` monitoring_url: `https://eszigno2027h2.mon.ct.e-szigno.hu/`
Microsec Eszigno2028h1 Technical details LogID: `bdyd6YsZgQp1oXcR+tZVoOVbdYzpKkXZg27d9PznIBM=`	Microsec	qualified 2026-09-22T13:45:00Z	60	Inclusive start 2028-01-01T00:00:00Z Exclusive end 2028-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://eszigno2028h1.log.ct.e-szigno.hu/` monitoring_url: `https://eszigno2028h1.mon.ct.e-szigno.hu/`
Microsec Eszigno2028h2 Technical details LogID: `2iKjSO8buzFuV+ARSkqcdAe1DxOmJTk9JtLe4joj4hY=`	Microsec	qualified 2026-09-22T13:45:00Z	60	Inclusive start 2028-07-01T00:00:00Z Exclusive end 2029-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://eszigno2028h2.log.ct.e-szigno.hu/` monitoring_url: `https://eszigno2028h2.mon.ct.e-szigno.hu/`
GoDaddy Aquamarine2026h2 Technical details LogID: `6jAGlJ1CunsD2FCB4yYsua5xil5vUDT3ePE4BU6CdFw=`	GoDaddy	qualified 2026-09-30T13:40:00Z	60	Inclusive start 2026-07-01T00:00:00Z Exclusive end 2027-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://ct-log-api.godaddy.com/aquamarine2026h2/` monitoring_url: `https://ct-log-api.godaddy.com/aquamarine2026h2/`
GoDaddy Aquamarine2027h1 Technical details LogID: `/cLoBbiE8/CzcwbEliJzk9OExUIiB/1Aj+4CBc6jVhY=`	GoDaddy	qualified 2026-09-30T13:40:00Z	60	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://ct-log-api.godaddy.com/aquamarine2027h1/` monitoring_url: `https://ct-log-api.godaddy.com/aquamarine2027h1/`
GoDaddy Aquamarine2027h2 Technical details LogID: `8LDBho1KJqIqj/7ghUOplCvvi7u69tYBqyHdvnFJ/68=`	GoDaddy	qualified 2026-09-30T13:40:00Z	60	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://ct-log-api.godaddy.com/aquamarine2027h2/` monitoring_url: `https://ct-log-api.godaddy.com/aquamarine2027h2/`
GoDaddy Aquamarine2028h1 Technical details LogID: `Nh2PNG9+2gYj4hlfNqqVGKiHKCEzvpzppruUJGPrTaY=`	GoDaddy	qualified 2026-09-30T13:40:00Z	60	Inclusive start 2028-01-01T00:00:00Z Exclusive end 2028-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://ct-log-api.godaddy.com/aquamarine2028h1/` monitoring_url: `https://ct-log-api.godaddy.com/aquamarine2028h1/`
GoDaddy Aquamarine2028h2 Technical details LogID: `/jwyxS3R1tXbsRUdYe6iH5EhBfIZa1UNh/as89aPnFM=`	GoDaddy	qualified 2026-09-30T13:40:00Z	60	Inclusive start 2028-07-01T00:00:00Z Exclusive end 2029-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://ct-log-api.godaddy.com/aquamarine2028h2/` monitoring_url: `https://ct-log-api.godaddy.com/aquamarine2028h2/`
HARICA Selene2027h1 Technical details LogID: `g92PTAqC4jctZFmPZBgRxF27h4JAz96XF7b9cOQAZ4c=`	HARICA	qualified 2026-10-13T13:55:00Z	60	Inclusive start 2027-01-01T00:00:00Z Exclusive end 2027-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://selene.ct.harica.eu/selene2027h1/` monitoring_url: `https://selene.mon.ct.harica.eu/selene2027h1/`
HARICA Selene2027h2 Technical details LogID: `sYdPqlxcQTingZPPo7kk2ImvyDNpOcfp+q0JVhrGpV4=`	HARICA	qualified 2026-10-13T13:55:00Z	60	Inclusive start 2027-07-01T00:00:00Z Exclusive end 2028-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://selene.ct.harica.eu/selene2027h2/` monitoring_url: `https://selene.mon.ct.harica.eu/selene2027h2/`
HARICA Selene2028h1 Technical details LogID: `GZ9TRtShpGoaPdygptJx/Taqms3LslRJmOM+dVHZi8k=`	HARICA	qualified 2026-10-13T13:55:00Z	60	Inclusive start 2028-01-01T00:00:00Z Exclusive end 2028-07-01T00:00:00Z	static-ct-api Technical details submission_url: `https://selene.ct.harica.eu/selene2028h1/` monitoring_url: `https://selene.mon.ct.harica.eu/selene2028h1/`
HARICA Selene2028h2 Technical details LogID: `+ZgQ1evkfhzxtCH/beNb+MHsluJeBNv8dW9r5FxlXMo=`	HARICA	qualified 2026-10-13T13:55:00Z	60	Inclusive start 2028-07-01T00:00:00Z Exclusive end 2029-01-01T00:00:00Z	static-ct-api Technical details submission_url: `https://selene.ct.harica.eu/selene2028h2/` monitoring_url: `https://selene.mon.ct.harica.eu/selene2028h2/`

Source provenance and file checks

Source-file checks: JSON schema v3 validated; detached signature verified with Google’s published RSA 4096-bit key, RSASSA-PKCS1-v1_5 / SHA-256; all 85 LogIDs checked against SHA-256 of DER keys. These checks concern the downloaded list, not certificate or SCT signatures, inclusion proofs or current service state.

Source JSON SHA-256: cca934bf9f2eaaf3f038ed0565e6d2a3775e44b200be71d3f437bc889f4f59ac
Public key PEM SHA-256: a284e4ad744211a6636a03c59aca9446ecd5ff2c14d7cb6edd69f7ba2108bf95

Google Chrome · log_list.json · Published public key · 2026-10-23

Investigation cases: turn a signal into a question

Investigation cases: turn a signal into a question
Fictional observation	Check to prepare	Proportionate conclusion
A name appears in certificate SANs	Record exact name, issuer, serial number, dates and source. Separately check authorised, dated DNS and TLS observations.	“Name present in an observed certificate”, without claiming the server still exists.
The same certificate appears in multiple logs	Match the exact object by its fingerprint and distinguish logging occurrences. Separate final certificates, precertificates and renewals.	Multiple occurrences are not multiple services or multiple compromises.
A certificate contains *.example.org	Preserve the wildcard as such. Do not manufacture hostnames from that entry alone.	The pattern does not enumerate deployed subdomains.
A search returns no result	Document the tool, covered logs, query, time and possible collection delay.	No result within this scope, without claiming no certificate or asset exists.
An SCT is dated 12:00 UTC, with MMD = 60 s	The theoretical incorporation deadline is 12:01 UTC. Examine the promise using the appropriate log objects and proofs.	A missing search result at 12:00:30 does not demonstrate an MMD violation.

Google Chrome · Certificate Transparency for Site Operators · Domain Privacy · consulted 2026-10-23

IETF · RFC 5280 · X.509 certificate profile · May 2008 · §§4.1.2.5, 4.2.1.6, 6

Make a trace usable in an intelligence note

Define collection scope
Record domain or pattern, primary source or aggregator, UTC time and scope. A search source may have its own coverage and lag.
Keep object and context
Distinguish certificate, precertificate, SCT and proof. Associate object fingerprint, LogID, leaf index or tree size where available, and consultation time.
Corroborate across layers
Compare registration data, DNS, TLS and web content with their respective dates. Shared infrastructure can explain technical links without an organisational relationship.
Express uncertainty
Separate observations, inferences and points still requiring confirmation. Assign an owner and next check to any hypothesis that influences a decision.

Data: Google Chrome, documentary investigation and audit use under its usage policy. The snapshot is not a trust store and is not used for CT enforcement in a TLS client. Analysis tables, prose and fictional examples are CIE editorial synthesis; linked documents retain their own terms.

Google Chrome · CT Log Lists and usage policy · Consulted 2026-10-23

RDAP: registration, roles and redacted data

RDAP: qualify the role before naming an actor

Registrar, registrant and technical contact answer different questions. A public registration response is dated and may contain unpublished data.

Read declared roles instead of matching names alone.
Separate registration, change, synchronisation and collection dates.
Retain redactions and access limitations without inventing the missing identity.

Open the RDAP dossier and local reader →

IETF · RFC 9083 · RDAP JSON Responses · June 2021 · §§4–5, 9–10

Citation chains and social monitoring

Separate origin, repost and corroboration

A capture or provenance signature may document a record without proving its claim. Before citing multiple publications, check whether they reference the same document.

Keep the consulted version and its exact reference.
Name missing citations instead of assuming their contents.
Treat distinct documents as records to compare, without assuming independence.

Read the method and explore citation chains →

Government Communications · RESIST 3 · RESIST 3 · 2025 · consulted 2026-10-23

Government Communications · RESIST 3 quick reference · RESIST 3 · 2025 · consulted 2026-10-23

Official references

References consulted: 23/10/2026. The method and worksheet propose checks to adapt to your context; they do not constitute certification.