Methodology & Research Ethics

This page describes exactly how the exposure data on Transom is collected. It is written before the collection tooling, on purpose. If you represent a hosting provider, a company whose infrastructure appears in our data, or a journalist checking our work, this page is the short version of "who we are and what we actually do."

Summary in one sentence: Transom passively observes publicly reachable network services, records a small fingerprint that identifies the software, and publishes aggregate counts — we never authenticate, never invoke tools, and never read data held by a discovered server.

What we do

Passive banner and fingerprint collection only. We connect to services that are already listening on the public internet, read the response that any client would receive (HTTP headers, TLS certificate metadata, an unauthenticated landing response, a protocol handshake), and record enough of it to identify the software and version. This is the same class of activity performed by Shodan, Censys, and academic internet-measurement groups such as those at the University of Michigan and the Max Planck Institute.
A narrow, known signature list. We do not sweep the entire internet or every port. We target a small, explicitly maintained list of fingerprints for known MCP transports and LLM gateway software. The current signature list is published at /map/signatures/.
Low request volume. Each discovered host receives a small number of requests, rate-limited, from a fixed and disclosed IP range (see Identifying our traffic).
Aggregate publication. Public pages show counts, software-type breakdowns, geographic distribution at the country level, and first-seen dates. We do not publish a directly searchable list of individual IP addresses or hostnames on the free site.

What we deliberately do not do

No authentication attempts. We never submit credentials, API keys, tokens, or OAuth flows — not even default or blank ones.
No tool invocation or enumeration. For MCP servers specifically: we do not call tools/list, tools/call, resources/read, or any other method that would cause the server to act or to disclose its capabilities. We identify the transport and stop.
No data extraction. We do not read, copy, or store any application data, prompts, logs, model outputs, or user content from a discovered service.
No vulnerability exploitation. We do not send payloads designed to trigger a bug, bypass a control, or confirm an exploit. A fingerprint tells us "this is software X version Y"; we do not go further to prove it is exploitable.
No persistence. We do not install anything, open no reverse connections, and leave nothing behind.
No targeting of individuals. Findings are about software deployments, not people. We do not attempt to attribute a deployment to a named individual.

The line we hold: the moment a scan interacts with a discovered server rather than observing it, it has crossed from internet measurement into unauthorized access. Transom's tooling is built to make that crossing impossible, not merely discouraged.

Why this is lawful research

Passive observation of publicly listening services is well-established practice. Search engines, certificate-transparency monitors, and commercial attack-surface products all rely on it. The relevant distinction in computer-misuse law (the US CFAA, the UK Computer Misuse Act, and equivalents) is between accessing a system and observing that it exists and what software it runs. We stay firmly on the observation side of that line, and the "What we deliberately do not do" list above is the operational expression of it.

This is not legal advice, and we are not a law firm. If you believe our activity is nonetheless unlawful in your jurisdiction, contact us (below) and we will engage.

Identifying our traffic

All collection originates from a dedicated IP range, separate from this site's hosting:

Source IP range: TBD — publish before first scan
Reverse DNS: scan-1.transomsecurity.com etc. — TBD
User-Agent (HTTP): Transom/1.0 (+https://transomsecurity.com/map/methodology/)
We honor robots.txt for HTTP-based fingerprints.

If you see this traffic in your logs and want it to stop, use the opt-out below.

Opt-out

We will exclude any IP range or domain from all future collection, no questions asked, and remove existing findings for it from the public site.

Opt-out form: transomsecurity.com/map/opt-out/

Or email: optout@transomsecurity.com with the IP range(s) or domain(s) to exclude. Either way, include enough information for us to confirm you control the address space (a reply from a WHOIS/RDAP contact, a matching abuse contact, or a DNS TXT record we specify). Requests are actioned within 5 business days; scanning of the specified ranges is suspended immediately on receipt while we verify.

Abuse contact

abuse@transomsecurity.com — monitored for abuse complaints, law-enforcement inquiries, and provider escalations. We aim to respond within 2 business days.

PGP key and postal address: TBD — add before launch.

Responsible disclosure

Where a fingerprint indicates a deployment that is very likely exposing sensitive capability by default (for example, an MCP server reachable with no auth in front of it), we may attempt a good-faith notification to the network's abuse or security contact. We do not confirm exploitability first, we do not publish host-specific details, and we do not set disclosure deadlines for individual operators — aggregate figures are published on our own schedule regardless.

Data handling

Retention: raw fingerprint responses are kept for TBD (proposed: 90 days) for false-positive review, then reduced to the derived fields (software, version, first seen, last seen, country, ASN).
No PII target: we do not seek personal data. If a banner incidentally contains a personal email address or name, it is stripped before storage.
Corrections: if a finding about your infrastructure is wrong, email corrections@transomsecurity.com and we will re-check and fix or remove it.

Changelog

2026-09-08 — Opt-out web form live at /map/opt-out/.
2026-09-03 — abuse@, optout@, and corrections@ are live, monitored mailboxes (SPF/DKIM/DMARC verified).
2026-09-02 — Initial draft, published before any collection tooling exists.