{"slug": "ai-service-indicators", "title": "AI Service Indicators", "summary": "A community-maintained dataset of DNS hostnames for generative-AI applications and APIs has been published to let organizations measure observed AI-service access from DNS, proxy and firewall logs. Each row maps a hostname pattern to a service, vendor, category and role — distinguishing chat use from API calls, agents, sign-in, CDN and telemetry — and marks app, api and agent roles as counts_as_usage=1 while portal, web, auth, cdn, telemetry, download and other roles count as 0. The maintainers caution that a DNS lookup shows a device contacted a service, not that anyone submitted a prompt, and advise reporting results as observed access, counting distinct devices rather than queries.", "body_md": "A community-maintained list of DNS hostnames for generative-AI applications and APIs, for measuring **observed AI-service access** from DNS, proxy or firewall logs.\n\nEach row maps a hostname pattern to a service, vendor, category and role, so you can tell chat use from API calls, agents, sign-in, CDN, telemetry and plain website visits. Where a vendor publishes the hostname, the row links to that page.\n\n**A DNS lookup shows a device contacted a service, not that anyone submitted a prompt.** Report results as observed access, count distinct devices rather than queries, and remember that devices are not people.\n\n| Column | Meaning | \n|---|---|\n| `host_pattern` | Lowercase hostname; `*` matches any run of characters, including dots | \n| `service` | Product, e.g. `ChatGPT` ,`Codex` ,`OpenAI API` ,`GitHub Copilot` ; a vendor name (`OpenAI` ) for names shared across its products | \n| `vendor` | Company operating the service | \n| `category` | `Chat assistant` ,`Coding assistant` ,`AI platform` (APIs and cloud model hosting),`AI browser` ,`Research` ,`Creative` | \n| `role` | What the hostname does; see below | \n| `counts_as_usage` | `1` for`app` ,`api` and`agent` roles;`0` otherwise | \n| `source` | Vendor documentation or application URL; blank where the vendor publishes none | \n| `confidence` | How the role was established; see below | \n| `notes` | Interpretation caveats | \n\n| `role` | Meaning | Usage? | \n|---|---|---|\n| `app` | The interactive product: web app, its live-response and voice endpoints, mobile and desktop app backends, coding-assistant service endpoints | yes | \n| `api` | Public programmatic inference endpoint | yes | \n| `agent` | Coding-agent, connector and MCP endpoints | yes | \n| `portal` | Developer console (keys, billing) | no | \n| `web` | Marketing site, docs, help, status, community, email links | no | \n| `auth` | Sign-in, SSO, bot checks | no | \n| `cdn` | Static assets, user content, CDN alias (CNAME) targets | no | \n| `telemetry` | Analytics, metrics, experiments and feature flags | no | \n| `download` | Installers and updates | no | \n| `other` | A vendor's catch-all for subdomains not yet classified; review these rather than count them | no | \n\n| `confidence` | The role comes from | \n|---|---|\n| `documented` | The vendor's documentation, linked in `source` | \n| `evidence` | DNS answers or the server's own responses, described in `notes` (for example a CNAME to a billing or help-desk provider, or a redirect) | \n| `hostname` | The hostname alone | \n| `low` | The hostname or weak evidence; treat as a hypothesis | \n\n`confidence` describes the role. A `source` on a catch-all or `hostname` row shows that the domain belongs to the vendor, not what each subdomain does. Corrections backed by vendor documentation are especially welcome.\n\nUsing `role`, you can tell, for example, ChatGPT chat (` chatgpt.com`, `ws.chatgpt.com`) apart from OpenAI API calls (` api.openai.com`), Codex agents (` codex-cloud-backend.chatgpt.com`), and someone reading `openai.com` or `help.openai.com`.\n\nNo field contains a comma or quote, so any CSV reader, `awk -F,`, or a SIEM lookup can load the file as-is.\n\n1. Lowercase the queried hostname and strip any trailing dot.\n2. Try rows **in file order** ; the**first** matching row wins. Specific names come before their wildcard catch-alls (`api.openai.com` before`*.openai.com` ).\n3. A pattern matches the **whole** hostname:`*.chatgpt.com` matches`ab.chatgpt.com` but not`fakechatgpt.com` or`chatgpt.com.example.net` . Apex domains are listed separately.\n4. A hostname matching no row is not in scope.\n\nThese are the semantics of a Splunk `WILDCARD` lookup with `max_matches=1`.\n\n- **Report by `role`, not by domain.** Telemetry and experiment names (for example`ab.chatgpt.com` ) fire on page load and are often queried by more devices than the app itself. There is no blanket \"all`openai.com` = ChatGPT\" rule.\n- **An API hostname identifies the service contacted, not the application, person, model or billing account behind it.**`api.anthropic.com` , for example, is used by Claude Code as well as by custom applications.\n- **A usage role shows that a service was in use on a device, not what the person did with it.** DNS cannot show whether someone generated an image, ran an agent or only opened the app.\n- **Some vendor names are reached from other companies' websites.**`bzr.openai.com` , for example, is OpenAI's ad-measurement pixel, embedded in advertisers' sites, and is queried by devices that never use ChatGPT.\n- **Keep non-usage roles out of usage counts.**`auth` ,`cdn` ,`telemetry` and`web` names can corroborate activity, but browsers prefetch them, and they are reached by people who never use the product.\n- **Count distinct devices per service per day or week, not queries.** Caching, retries, background refresh and prefetching distort query counts.\n- **Classify the name the client asked for** , not CDN alias (CNAME) targets in the response.\n\nDNS-based measurement misses:\n\n- off-network devices;\n- clients using encrypted DNS (DoH/DoT) to outside resolvers;\n- locally run models;\n- AI features embedded in other SaaS products, which share the host application's hostnames;\n- calls made from a vendor's backend.\n\nSome services (OpenRouter, Azure AI Foundry, Bedrock, Vertex AI) front many models, and DNS cannot tell which model was used.\n\nImplement the matching rules above. For each pattern, a regex of `^` + the pattern with `*` replaced by `.*` (everything else escaped) + `$` is enough. In Splunk, load the CSV as a lookup with `match_type = WILDCARD(host_pattern)` and `max_matches = 1`.\n\nOn high-volume DNS indexes, filter on indexed terms before classifying: `python3 scripts/splunk_terms.py` prints a keyword filter that covers every pattern.\n\nNew services, endpoints and corrections are welcome. See [CONTRIBUTING.md](https://github.com/synapticcybersecurity/ai-service-indicators/blob/main/CONTRIBUTING.md). Every change must pass `python3 scripts/validate.py`, which also runs automatically on pull requests.", "url": "https://wpnews.pro/news/ai-service-indicators", "canonical_source": "https://github.com/synapticcybersecurity/ai-service-indicators", "published_at": "2026-10-17 01:44:49+00:00", "updated_at": "2026-10-17 01:56:47.646436+00:00", "lang": "en", "topics": ["ai-tools", "ai-products", "ai-infrastructure", "structured-data"], "entities": ["ChatGPT", "Codex", "OpenAI API", "GitHub Copilot", "OpenAI", "Splunk"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ai-service-indicators", "markdown": "https://wpnews.pro/news/ai-service-indicators.md", "text": "https://wpnews.pro/news/ai-service-indicators.txt", "jsonld": "https://wpnews.pro/news/ai-service-indicators.jsonld"}}