Method

Everything here comes from endpoints each server already publishes to any client. No accounts, no authenticated requests, no user content.

What is fetched

/.well-known/nodeinfo and the document it points to; the software's own instance API; published rules, terms and privacy policy; and, where the software offers one, a twelve-week activity series.

We never request /api/v1/instance/domain_blocks: Mastodon's default robots.txt disallows it. We never request /api/v1/announcements or the profile directory — the first needs an account, and the second is personal data this project does not collect.

Politeness

robots.txt is fetched first for every host and obeyed.
Crawl-delay is honoured. Lemmy ships Crawl-delay: 60, so a Lemmy server gets one request a minute and a longer budget — not a faster crawler.
One request at a time per host, at least a second apart.
Endpoints are chosen by software: asking a Lemmy server six Mastodon-only endpoints would cost six minutes of its rate limit to learn nothing.
A host that fails to connect is marked dead and not asked again that run.
The user agent names the project and carries a contact URL.

Jurisdiction is a relation, not a column

Each server gets a row per (country, basis, reason). A server whose domain is .de, whose origin resolves to France and whose terms submit to English law produces three links and no pretence that one is the answer. 385 servers link to more than one country and 14 have no single strongest link.

basis	weight	what it means
names its law	5	the operator named a jurisdiction's law in its own policies
named legal entity	5	a company or charity form implies where it can be sued
registry record	4	RDAP publishes a registrant country
origin resolves there	3	our own DNS and IP-range resolution
presents as of there	3	the server describes itself as a place's community
domain suffix	2	a ccTLD or geoTLD asserts it
language offered	1	a distinctive regional language
tracker claim	1	a third party says so, unverified

Generic ccTLDs assert nothing and are excluded: .io is British Indian Ocean Territory and .ai is Anguilla, but nobody using them is there. Reading those as country signals would be the largest single error in the dataset.

Hosting country

Resolved independently — DNS, then two offline IP-range datasets — and kept alongside the tracker's claim so the disagreement is visible (49 servers). Behind a CDN the country is recorded as unknown, never as the CDN's: the address belongs to the CDN's anycast estate, not the operator. 315 servers are in that state.

AS registration country and IP block country are stored separately because they routinely differ: an IONOS AS registered in Germany routes blocks that geolocate to London.

Registration and certificates

RDAP is queried through the rdap.org bootstrap, one domain at a time, a second apart, and only when the last good record is over 90 days old. Certificate Transparency names come from a scanner following the CT logs directly.

CT coverage begins when that scanner was switched on and does not predate 2026. A domain with no names has not been observed, which is not the same as having no certificates. Absence is never evidence.

The stock privacy policy

254 servers publish their software's shipped privacy policy unchanged. It says "If this server is in the US...", "If this server is in the EU or the EEA...", and concedes that "Law requirements can be different if this server is in another jurisdiction."

An early cut of this classifier read those conditionals as declarations and reported 116 servers as governed by non-UK law; the real figure was 5. The template is now identified by fingerprint — three or more verbatim phrases — and excluded from every policy-derived signal.

These are not legal findings

Section 4(5)-(6) of the UK's Online Safety Act, Article 3 of the EU's DSA and their equivalents elsewhere turn on user numbers, target market and risk of harm. None of that is observable from outside. Every weight here is attached to a named, checkable reason so a reader can disagree and recompute — the per-link evidence is in the downloads.

Cadence

Weekly. Jurisdiction moves slowly, but age gates, geo-blocks, rule changes and closures move in days. Every run is stored append-only under its own run id, so the tables are a time series rather than a snapshot that overwrites itself.