readme: snipe-curve 3.49h datapoint + per-log throughput characterization

9d569c7faf202da2943b0d70a978ebf287aa79e7 · 2026-05-12 17:07:40 -0700 · steve

Spot-check 3.49h slice 0-1 re-check: 0/10 (no late snipes between 3.08h
and 3.49h on the first slice). Curve still flat across all four spot-
checks: 40 of 50 baits touched at least once, 0 confirmed snipes.

Per-log throughput documented: Google/DigiCert logs deliver ~100 emit/min
steady; Sectigo logs (elephant/tiger) burst-batch with quiet windows.
Not a bug — characteristic of how each operator ingests certs.

Files touched

M README.md

Diff

commit 9d569c7faf202da2943b0d70a978ebf287aa79e7
Author: steve <steve@designerwallcoverings.com>
Date:   Tue May 12 17:07:40 2026 -0700

    readme: snipe-curve 3.49h datapoint + per-log throughput characterization
    
    Spot-check 3.49h slice 0-1 re-check: 0/10 (no late snipes between 3.08h
    and 3.49h on the first slice). Curve still flat across all four spot-
    checks: 40 of 50 baits touched at least once, 0 confirmed snipes.
    
    Per-log throughput documented: Google/DigiCert logs deliver ~100 emit/min
    steady; Sectigo logs (elephant/tiger) burst-batch with quiet windows.
    Not a bug — characteristic of how each operator ingests certs.
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index da74e47..98990d0 100644
--- a/README.md
+++ b/README.md
@@ -54,6 +54,8 @@ Spot-checks via DoH at increasing intervals to find where the snipe window close
 | ~3.1h  | A/B/C/D/E (2 ea, slice 0-1) | 0 / 10 |
 | ~3.2h  | A/B/C/D/E (2 ea, slice 2-3) | 0 / 10 |
 | ~3.24h | A/B/C/D/E (2 ea, slice 4-5) | 0 / 10 — **30 of 50 baits checked, all 0** |
+| ~3.49h | A/B/C/D/E (2 ea, slice 0-1 re-check) | 0 / 10 — no late snipes between 3.08h and 3.49h |
+| ~4h    | full 50-bait sweep (queued)  | — |
 | ~6h    | _pending_        | — |
 | ~24h   | full batch       | — |
 | ~48h   | full batch (final) | — |
@@ -78,6 +80,8 @@ State of the world for **free** real-time CT-log access, as of 2026-05-12 ~23:05
 
 **RESOLVED 2026-05-12 23:13 UTC** — bypassed all middlemen by talking directly to CT logs per RFC 6962. `ct-source-ctlog.js` polls `get-sth` against currently-active 2026 logs (Argon2026h1 / Xenon2026h1 / Wyvern2026h1 — Nimbus2026 seems CDN-cached, skip it), fetches `get-entries`, parses MerkleTreeLeaf, extracts SAN DNS names from each X.509 cert via Node 22 `crypto.X509Certificate`. Smoke run: **8 emitted cert events in 25s** from Argon (14 X509 parsed, 43 precerts skipped — precert ASN.1 parse is TODO).
 
+**EXPANDED 2026-05-13 00:00 UTC** — fan-out grew from 3 → 6 logs (added Sphinx/DigiCert + Elephant/Tiger/Sectigo). Sustained throughput on the brand-typo-watcher: **~25 cert events/sec** (was ~14/sec on 3 logs). Per-log breakdown in minute summary confirms all 6 logs producing. Throughput skew is real: Google logs (Argon, Xenon) and DigiCert logs (Wyvern, Sphinx) deliver ~100 emit/min steady; Sectigo logs (Elephant, Tiger) burst-batch with quiet windows between (~5-50/min, irregular).
+
 Meanwhile the **honeypot + DoH spot-check** path (the actual aggregator-attribution experiment) is unaffected — that runs on Cloudflare 1.1.1.1 DoH and Node `child_process whois`, neither of which depends on CT logs.
 
 ## YOLO loop notes

← f8c440d brand-typo-watcher: per-log breakdown in minute summary · back to Domain Sniper · inspect.js: pretty-print snipe-timing curve from honeypot-sp 94015c2 →