Team Cymru (the company the article is about) has a response to the coverage: <a href="https://www.team-cymru.com/post/team-cymru-myth-vs-fact" rel="nofollow">https://www.team-cymru.com/post/team-cymru-myth-vs-fact</a><p>In short, they claim that:<p>- The "PCAP" data, email addresses, etc that they sell comes from them running malware samples on their own infrastructure. It's not based on captured Internet data.<p>- The web page addresses etc that they sell are the results of automated vulnerability scans and honeypots, not captured Internet data.<p>- The netflow data they sell <i>is</i> captured from real ISP traffic, but it is a small sample (only 1 in 10,000 netflows is captured), and it can't identify individual websites if they use a CDN or shared hosting infrastructure (which most websites do).<p>I have no clue how true these claims are, but those are the claims.