Trends

Nepal Internet Observatorypublic infrastructure

Reading the observatory store…

Longitudinal

Each day is aggregated once from the observation store and kept permanently. Aggregates are derived, never authoritative: every figure here can be rebuilt from the underlying rows, and if a rollup ever disagrees with them, the rollup is wrong.

Window7d 30d 90d 365d

Not yet a trend

Only 1 day of aggregates exists so far, so no chart is drawn: a single reading is a measurement, not a direction. The composition below is what is actually known today.

Past days reconstruct "open" as "present during the day" from firstSeen/lastSeen. Today is still being written to and is provisional.

Open services

353

Services present on 22 Sep 2026.

Assets with an open service

105

Distinct addresses with at least one service recorded.

New services in 30d

353

First observed inside the window. Additive, so summing across days is sound.

Changes in 30d

976

Excludes 139,496 one-time inventory-ingest events.

Open services

Stock measure: how many services were present on each day, reconstructed from firstSeen and lastSeen. A service counts for every day it spans, so this line does not sum.

single reading

353servicespeak 353

22 Sep 2026single reading — not a trend22 Sep 2026

Newly observed services

Flow measure: services seen for the first time on each day. This one does sum across the window.

single reading

353newpeak 353

22 Sep 2026single reading — not a trend22 Sep 2026

Composition by service type

What the open services actually are, as of the most recent aggregate. Shown instead of a time series where history is too short to plot one.

http78

https71

ssh30

dns23

pop321

smtp-submission20

imaps19

pop3s19

other (12)72

What changed

Change events inside the window, by kind. The one-time inventory ingest is excluded — it is a property of loading the dataset, not of the network changing.

NEW SERVICE560

SERVICE DISAPPEARED254

TECHNOLOGY CHANGED111

DNS CHANGED40

PRODUCT CHANGED7

CERTIFICATE CHANGED2

TLS CHANGED1

VERSION CHANGED1

Ports over the window

New counts are additive across days. Open counts are a stock, so the latest day is shown rather than a sum, which would double-count every service that stayed up.

20 ports

Port	Service	Open today	Peak open	New in window
80/tcp	http	78	78	78
443/tcp	https	71	71	71
22/tcp	ssh	30	30	30
53/tcp	dns	23	23	23
110/tcp	pop3	21	21	21
587/tcp	smtp-submission	20	20	20
993/tcp	imaps	19	19	19
995/tcp	pop3s	19	19	19
143/tcp	imap	18	18	18
21/tcp	ftp	17	17	17
465/tcp	smtps	17	17	17
8080/tcp	http-alt	6	6	6
23/tcp	telnet	3	3	3
445/tcp	smb	2	2	2
3389/tcp	rdp	2	2	2
5432/tcp	postgresql	2	2	2
8443/tcp	https-alt	2	2	2
1433/tcp	mssql	1	1	1
3306/tcp	mysql	1	1	1
6379/tcp	redis	1	1	1

TLS posture at the latest aggregate

Counted from stored certificates: whether each validity window had already ended as of that day, not as of now. A backfilled day therefore reflects the certificates as they were, where they were observed.

With a certificate

174

Services presenting a certificate.

Expired

Validity window already ended.

Expiring within 30d

Renewal still possible.

Self-signed

Issuer identical to subject.

Negotiated protocol

TLSv1.3141

TLSv1.233

Method and limits

What these aggregates are, and what they are not.

Derived, not authoritative. Every row is computed from observations, services and change events. Deleting the whole rollup table loses nothing that cannot be recomputed.
Recomputed, not frozen. A trailing window is rebuilt on every run, because jobs for a given day keep arriving after it ends. The most recent day is provisional.
Stock versus flow. Open services and assets are stocks — a service present on ten days is counted on each of them. New services and change events are flows, and may be summed.
Reconstruction, not recall. For a past day, “open” means “present during that day”, inferred from the first and last time the service was seen. The observatory did not store a daily snapshot, so a service that was briefly down and back up inside one day is indistinguishable from one that stayed up.
Absent is not zero. Days before the observatory existed have no row. The chart draws them as nothing, not as a fall to zero.

RequestGET https://observatory.nirajp.com.np/api/v1/trends/overview?days=30

Aggregates exist from

22 Sep 2026

The depth of this window bounds every longitudinal claim the dataset can support.

Newest aggregate day

22 Sep 2026

Closed.

Last recomputed

22 Sep 2026 22:30 UTC

30m ago