{ "generated_utc": "2026-09-26T19:20:02Z", "positive_control": { "ct": { "domain": "cloudflareresearch.com", "expect": "pq.cloudflareresearch.com", "pass": true, "names": [ "*.pq.cloudflareresearch.com", "*.pqtunnels.cloudflareresearch.com", "pq.cloudflareresearch.com", "pqtunnels.cloudflareresearch.com" ] }, "probe_controls": [ { "host": "pq.cloudflareresearch.com", "go_verdict": "hybrid_exposed", "openssl_verdict": "hybrid_exposed", "at": "2026-09-26T19:19:02Z" }, { "host": "www.cloudflare.com", "go_verdict": "hybrid_exposed", "openssl_verdict": "hybrid_exposed", "at": "2026-09-26T19:19:02Z" } ], "probe_clean_control": "Qtonic Quantum Corp hosts classified clean by both implementations (see qtonic_now)", "tokenization": "51/51 domains (50 peers + control) parse as a single tsquery token; mismatches: []", "limit_truncation": "max raw_count 36 (cloudflare.com) vs LIMIT 2000: never bound" }, "method": { "ct": "crt.sh Postgres, identities() tsquery on registered domain, NAME_TYPE in (san:dNSName, 2.5.4.3), regex = lead pattern OR anywhere-keywords (quantum|kyber|mlkem|ml-kem|postquantum|post-quantum|hybrid-kem|pqc|pqtls|x25519mlkem); <=2 concurrent; up to 5 attempts w/ backoff", "probe": "worker qtonic-worker (AWS us-west-2); Go go1.25.1 crypto/tls main.go (first IP) + OpenSSL 3.5.7 s_client on every IPv4; 4 handshakes each; strict clean = pq ok AND x25519/p256/tls12 all 'rejected'" }, "companies_total": 50, "companies_searched": 48, "companies_searched_list": [ "360.cn", "a10networks.com", "akamai.com", "alarum.io", "allot.com", "castellum.ai", "checkpoint.com", "cloudflare.com", "commvault.com", "corero.com", "crowdstrike.com", "cyansecurity.com", "cyberoo.com", "daj.jp", "f-secure.com", "f5.com", "fastly.com", "fortinet.com", "gendigital.com", "identiv.com", "intercede.com", "kudelskisecurity.com", "leidos.com", "mobilicom.com", "nccgroup.com", "netscout.com", "netskope.com", "okta.com", "onespan.com", "pagerduty.com", "paloaltonetworks.com", "qualys.com", "quickheal.com", "rapid7.com", "rubrik.com", "sangfor.com", "secunet.com", "sentinelone.com", "softcat.com", "telos.com", "tenable.com", "trendmicro.com", "varonis.com", "verimatrix.com", "wallix.com", "wisekey.com", "withsecure.com", "yubico.com" ], "companies_not_searched": [ { "domain": "sailpoint.com", "reason": "not searched (full CT keyword query): crt.sh server-side statement timeout on every completed attempt; 5 attempts total (2 in run 2, 3 in retry run; some attempts also hit connect timeouts). Only the partial 28-name exact dictionary check ran (0 CT hits, 0 DNS). Do NOT treat as zero.", "partial_fallback": { "method": "exact-name CT lookup + public DNS (1.1.1.1) over a fixed 28-name dictionary of pq-style first labels", "dictionary_size": 28, "ct_exact_hits": [], "ct_err": "", "dns_resolving": {} } }, { "domain": "zscaler.com", "reason": "not searched (full CT keyword query): crt.sh server-side statement timeout on every completed attempt; 6 attempts total (4 in run 2, 2 in retry run; some attempts also hit connect timeouts). Only the partial 28-name exact dictionary check ran (0 CT hits, 0 DNS). Do NOT treat as zero.", "partial_fallback": { "method": "exact-name CT lookup + public DNS (1.1.1.1) over a fixed 28-name dictionary of pq-style first labels", "dictionary_size": 28, "ct_exact_hits": [], "ct_err": "", "dns_resolving": {} } } ], "pq_named_hosts_on_ct_total": [ "fidopqc.intercede.com", "pq-02job02.corp.leidos.com", "pq-02job03.corp.leidos.com", "pq-02job04.corp.leidos.com", "pq-02job05.corp.leidos.com", "pqaiq4-2016.dsi.apps.leidos.com", "pqaserver2.dsi.apps.leidos.com", "pqc.psdo.leidos.com", "pqcresearch.demo.paloaltonetworks.com", "pqt.sil.leidos.com", "trackvia-pqs.leidos.com" ], "already_in_measured_set": [ { "domain": "intercede.com", "host": "fidopqc.intercede.com", "replicate_verdict": "classical", "replicate_status": { "p256": "ok", "pq": "rejected", "tls12": "ok", "x25519": "rejected" } } ], "candidates": [ { "domain": "leidos.com", "host": "pq-02job02.corp.leidos.com", "source": "ct", "resolves": false, "ipv4": [], "ipv6": [], "resolve_err": "[Errno -2] Name or service not known", "go_verdict": "unresolved", "openssl_verdict": "unresolved", "go_ip": "", "go_status": {}, "openssl_ip": null, "openssl_status": {}, "openssl_per_ip": {}, "at": "2026-09-26T19:19:02Z" }, { "domain": "leidos.com", "host": "pq-02job03.corp.leidos.com", "source": "ct", "resolves": false, "ipv4": [], "ipv6": [], "resolve_err": "[Errno -2] Name or service not known", "go_verdict": "unresolved", "openssl_verdict": "unresolved", "go_ip": "", "go_status": {}, "openssl_ip": null, "openssl_status": {}, "openssl_per_ip": {}, "at": "2026-09-26T19:19:02Z" }, { "domain": "leidos.com", "host": "pq-02job04.corp.leidos.com", "source": "ct", "resolves": false, "ipv4": [], "ipv6": [], "resolve_err": "[Errno -2] Name or service not known", "go_verdict": "unresolved", "openssl_verdict": "unresolved", "go_ip": "", "go_status": {}, "openssl_ip": null, "openssl_status": {}, "openssl_per_ip": {}, "at": "2026-09-26T19:19:02Z" }, { "domain": "leidos.com", "host": "pq-02job05.corp.leidos.com", "source": "ct", "resolves": false, "ipv4": [], "ipv6": [], "resolve_err": "[Errno -2] Name or service not known", "go_verdict": "unresolved", "openssl_verdict": "unresolved", "go_ip": "", "go_status": {}, "openssl_ip": null, "openssl_status": {}, "openssl_per_ip": {}, "at": "2026-09-26T19:19:02Z" }, { "domain": "leidos.com", "host": "pqaiq4-2016.dsi.apps.leidos.com", "source": "ct", "resolves": false, "ipv4": [], "ipv6": [], "resolve_err": "[Errno -2] Name or service not known", "go_verdict": "unresolved", "openssl_verdict": "unresolved", "go_ip": "", "go_status": {}, "openssl_ip": null, "openssl_status": {}, "openssl_per_ip": {}, "at": "2026-09-26T19:19:02Z" }, { "domain": "leidos.com", "host": "pqaserver2.dsi.apps.leidos.com", "source": "ct", "resolves": false, "ipv4": [], "ipv6": [], "resolve_err": "[Errno -2] Name or service not known", "go_verdict": "unresolved", "openssl_verdict": "unresolved", "go_ip": "", "go_status": {}, "openssl_ip": null, "openssl_status": {}, "openssl_per_ip": {}, "at": "2026-09-26T19:19:02Z" }, { "domain": "leidos.com", "host": "pqc.psdo.leidos.com", "source": "ct", "resolves": false, "ipv4": [], "ipv6": [], "resolve_err": "[Errno -2] Name or service not known", "go_verdict": "unresolved", "openssl_verdict": "unresolved", "go_ip": "", "go_status": {}, "openssl_ip": null, "openssl_status": {}, "openssl_per_ip": {}, "at": "2026-09-26T18:58:41Z" }, { "domain": "leidos.com", "host": "pqt.sil.leidos.com", "source": "ct", "resolves": false, "ipv4": [], "ipv6": [], "resolve_err": "[Errno -2] Name or service not known", "go_verdict": "unresolved", "openssl_verdict": "unresolved", "go_ip": "", "go_status": {}, "openssl_ip": null, "openssl_status": {}, "openssl_per_ip": {}, "at": "2026-09-26T19:19:02Z" }, { "domain": "leidos.com", "host": "trackvia-pqs.leidos.com", "source": "ct", "resolves": false, "ipv4": [], "ipv6": [], "resolve_err": "[Errno -5] No address associated with hostname", "go_verdict": "unresolved", "openssl_verdict": "unresolved", "go_ip": "", "go_status": {}, "openssl_ip": null, "openssl_status": {}, "openssl_per_ip": {}, "at": "2026-09-26T19:19:02Z" }, { "domain": "paloaltonetworks.com", "host": "pqcresearch.demo.paloaltonetworks.com", "source": "ct", "resolves": true, "ipv4": [ "34.58.75.16" ], "ipv6": [], "resolve_err": "", "go_verdict": "unmeasured", "openssl_verdict": "unmeasured", "go_ip": "34.58.75.16", "go_status": { "p256": "timeout", "pq": "timeout", "tls12": "timeout", "x25519": "timeout" }, "openssl_ip": "34.58.75.16", "openssl_status": { "pq": "timeout", "x25519": "timeout", "p256": "timeout", "tls12": "timeout" }, "openssl_per_ip": { "34.58.75.16": { "status": { "pq": "timeout", "x25519": "timeout", "p256": "timeout", "tls12": "timeout" }, "detail": { "pq": { "s": "timeout" }, "x25519": { "s": "timeout" }, "p256": { "s": "timeout" }, "tls12": { "s": "timeout" } }, "verdict": "unmeasured" } }, "at": "2026-09-26T19:20:02Z" } ], "candidate_counts": { "total": 10, "resolving": 1, "go_verdicts": { "unmeasured": 1, "unresolved": 9 }, "openssl_verdicts": { "unmeasured": 1, "unresolved": 9 } }, "peer_harvest_proof_found": [], "qtonic_now": [ { "host": "qtonicquantum.com", "openssl_verdict": "clean", "go_verdict": "clean", "openssl_status": { "pq": "ok", "x25519": "rejected", "p256": "rejected", "tls12": "rejected" }, "ipv4": [ "35.86.38.103" ], "at": "2026-09-26T19:19:02Z" }, { "host": "www.qtonicquantum.com", "openssl_verdict": "clean", "go_verdict": "clean", "openssl_status": { "pq": "ok", "x25519": "rejected", "p256": "rejected", "tls12": "rejected" }, "ipv4": [ "35.86.38.103" ], "at": "2026-09-26T19:19:02Z" }, { "host": "api.qtonicquantum.com", "openssl_verdict": "clean", "go_verdict": "clean", "openssl_status": { "pq": "ok", "x25519": "rejected", "p256": "rejected", "tls12": "rejected" }, "ipv4": [ "35.86.38.103" ], "at": "2026-09-26T19:19:02Z" }, { "host": "lab.qtonicquantum.com", "openssl_verdict": "clean", "go_verdict": "clean", "openssl_status": { "pq": "ok", "x25519": "rejected", "p256": "rejected", "tls12": "rejected" }, "ipv4": [ "35.86.38.103" ], "at": "2026-09-26T19:19:02Z" }, { "host": "stream.qtonicquantum.com", "openssl_verdict": "clean", "go_verdict": "clean", "openssl_status": { "pq": "ok", "x25519": "rejected", "p256": "rejected", "tls12": "rejected" }, "ipv4": [ "35.86.38.103" ], "at": "2026-09-26T19:19:02Z" }, { "host": "mx.qtonicquantum.com", "openssl_verdict": "clean", "go_verdict": "clean", "openssl_status": { "pq": "ok", "x25519": "rejected", "p256": "rejected", "tls12": "rejected" }, "ipv4": [ "35.86.38.103" ], "at": "2026-09-26T19:19:02Z" }, { "host": "qstrike.qtonicquantum.com", "openssl_verdict": "clean", "go_verdict": "clean", "openssl_status": { "pq": "ok", "x25519": "rejected", "p256": "rejected", "tls12": "rejected" }, "ipv4": [ "35.86.38.103" ], "at": "2026-09-26T19:19:02Z" }, { "host": "demo.qtonicquantum.com", "openssl_verdict": "hybrid_exposed", "go_verdict": "hybrid_exposed", "openssl_status": { "pq": "ok", "x25519": "ok", "p256": "ok", "tls12": "rejected" }, "ipv4": [ "104.21.28.97", "172.67.145.82" ], "at": "2026-09-26T19:19:02Z" } ], "notes": [ "No peer server found harvest-proof: 0 candidates clean in either implementation.", "Leidos: 9 unique pq-named hosts (plus wildcard *.pqc.psdo.leidos.com whose base is one of them); 8 NXDOMAIN and trackvia-pqs.leidos.com NODATA at 1.1.1.1 and 8.8.8.8 and the worker resolver.", "pqcresearch.demo.paloaltonetworks.com resolves to 34.58.75.16 but TCP 443/80/8443 time out from qtonic-worker and qtonic-aws (both AWS us-west-2; not a fully independent vantage). CT shows only 2 certs, latest notAfter 2025-10-21 (expired). Verdict unmeasured, not clean.", "fidopqc.intercede.com is pq-named but already in replicate.jsonl: classical (pq rejected; p256+tls12 ok) in both published runs and the OpenSSL pass.", "sailpoint.com and zscaler.com: full keyword search hit crt.sh's server-side statement cap every time (the SET statement_timeout is not honored above ~1-2 min). A prefix tsquery fallback also timed out on the control. They are NOT counted as zero: only a 28-name exact dictionary check was done (0 CT hits, 0 DNS).", "Earlier hunt_retry.log positive control [] predates the san:dNSName fix; the control passes now (3 separate runs today).", "Qtonic Quantum Corp now: 7 clean + demo.qtonicquantum.com hybrid_exposed (Cloudflare 104.21.28.97/172.67.145.82: pq, x25519, p256 ok; tls12 rejected) in both OpenSSL and Go, matching the published 7 of 8.", "Limit: CT only reveals names that got public certs; hosts behind wildcard certs or with non-pq names are outside this hunt." ] }