Summary

  • A 17 September Internet Society Pulse guest study starts from the 1,000 most popular CrUX origins in each of ten Southeast Asian countries and reports four HHI ranges after identifying CDN and IP-infrastructure providers and jurisdictions.
  • CDN-by-jurisdiction, IP-infrastructure-by-jurisdiction, CDN-by-provider and IP-infrastructure-by-provider answer different questions. Their ranges cannot be collapsed into one claim about traffic, users, revenue, control or a complete market.
  • A public measurement-to-decision receipt should travel with any consequential use of the figures, recording the sample, period, layer, identification and reconciliation method, grouping, weights, exclusions, HHI, proposed action and the actor’s authority.

Four scoreboards sit inside the same release. Content-delivery networks grouped by registration jurisdiction produce HHI values from 8,950 to 10,000. IP infrastructure grouped by jurisdiction produces 5,150 to 7,550. Group the CDN observations by provider instead, and the range becomes 3,280 to 7,280. Group the IP-infrastructure observations by provider, and it falls to 1,800 to 4,060.

All four can be correct. They do not describe the same object.

The first denominator is the observed set

Yu Shing “Jason” Hung’s guest article says the study retrieved the top 1,000 most popular websites for each of Brunei Darussalam, Cambodia, Indonesia, Lao PDR, Malaysia, Myanmar, the Philippines, Singapore, Thailand and Viet Nam from the Chrome User Experience Report. It then used three different lookup approaches to identify the company and jurisdiction serving CDN or IP infrastructure.

That is a meaningful view of infrastructure attached to popular web origins. It is not a census of every website, service, connection or user in those countries. Chrome describes CrUX as field data from eligible users visiting publicly discoverable origins that meet an undisclosed popularity threshold. Its popularity rank is a relative measure based on navigations to an origin and is published in coarse bands.

An origin appearing in a popular set is therefore not a byte of traffic, a unique person, a contract, a unit of capacity or a dollar of revenue. The Pulse result should be described first as a distribution of identified service assignments in the declared sample. “Market share” without that sentence invites a different denominator into the reader’s mind.

Changing the layer changes the dependency

A CDN and IP infrastructure perform related but different work. The CDN can terminate, cache or distribute content while the underlying address and network path belong to a different provider. A site may use a global CDN in front of a locally operated network. A diverse set of access and hosting networks can therefore coexist with concentrated content delivery.

The release makes that split visible. For 2024–2026, CDN observations grouped by provider registration jurisdiction sit between 8,950 and 10,000. United States-registered providers account for 95.9% to 99.6% of the reported observation share; China-registered providers account for no more than 3.9%.

For IP infrastructure, the jurisdiction range is lower—5,150 to 7,550—and providers registered outside both the United States and China account for 14.2% to 30.8%. The reported IP series begins in March 2025 and runs to June 2026, while the CDN series begins in 2024. Even the clocks are not identical.

This does not mean the IP layer is unconcentrated or the CDN layer determines every packet path. It means the observed assignments distribute differently when the technical surface changes.

Changing the grouping changes the institution being counted

The jurisdiction score compresses many providers into legal-geographic groups. The provider score keeps those companies separate. The two readings serve different questions.

By provider, CDN HHI ranges from 3,280 to 7,280. Eight of the ten countries remain above 5,000 for most of the period. Cloudflare is the most common identified CDN, with 42.9% to 83.0% of the reported 2026 observation share. The guest author connects that concentration to single-point-of-failure risk and argues that a Cloudflare outage would cause severe disruption across the ten countries.

That is a risk inference, not an outage experiment. The public release does not provide traffic matrices, request shares, cache-hit ratios, failover configurations or a simulated withdrawal of one provider. The HHI can justify asking for those operational records; it cannot stand in for them.

By provider, IP-infrastructure HHI is 1,800 to 4,060. No country reaches 5,000 in any reported month, although six are described as highly concentrated. That result suggests a broader provider base at the IP layer. It does not prove independent failure domains, domestic ownership, spare capacity or effective substitution.

Registration jurisdiction adds another boundary. Pulse’s general methodology acknowledges that jurisdiction can be ambiguous when headquarters and parent ownership cross borders. A registration attribute can identify a legal exposure worth examining. It does not by itself establish who controls routing, contracts, infrastructure, subsidiaries or a response during an incident.

HHI preserves the shares put into it

HHI squares each share and sums the results. It is deliberately sensitive to large actors. But its force comes from the shares supplied to it, not from the letters HHI.

The U.S. Department of Justice treats concentration as a structural tool whose evidentiary value depends on defining a relevant market and choosing a share metric that reflects competitive reality. A top-origin service-assignment share can screen for dependency. It does not automatically define an antitrust market or prove market power, exclusion, coordination or harm.

The checked public Pulse article does not name the three lookup methods, disclose how often they disagreed or explain their reconciliation. It also does not specify weighting and cross-period deduplication in the prose. Those omissions do not invalidate the published ranges. They limit which decisions can safely rely on them without a fuller methods record.

Put the decision beside the denominator

Daniel Kade proposes a measurement-to-decision receipt. It should identify the source and capture date; country set; sample and period; CDN or IP layer; lookup tools and versions; disagreement and reconciliation rule; provider or jurisdiction grouping; weights, exclusions and deduplication; underlying shares; HHI and uncertainty; the proposed action; the responsible decision-maker; affected parties; and the statutory, contractual or operational authority being exercised.

The final fields matter because different scores point toward different powers. An operator considering resilience needs paths, traffic, caches, failover and tested recovery. A buyer considering procurement needs contracts, switching costs and substitutable services. A competition authority needs a relevant market and legally probative shares. A government examining jurisdictional exposure needs the legal entity and actual power it may invoke.

The release has produced a valuable regional warning. Its four figures become more useful, not less, when none is asked to carry the other three.

Sources