A domain list, not a search engine, with peptide-specific sources read first

ON THIS PAGE

1. Key findings
2. What the domain list actually is
3. When walking the list in order was the bug
4. How the queue is ordered now
5. What one screening pass actually checks
6. What this tier cannot tell a reader
7. Limitations and open questions
8. Sources

A search engine orders storefronts by marketing spend, which is a different thing than ordering them by how many actually exist. This registry is built the other way: from a domain list, read in a fixed order, checked the same way every time. Reading the screening script itself, rather than describing it from memory, is what this piece does.

What the domain list actually is

The registry's Tier 0 domain list, read directly from this site's own screening script on 2026-09-19, holds 46,435 domains. 46,139 of them, 99.4 percent, came from a single source: a rogue online-pharmacy not-recommended list, which is a watchlist for illegal pharmacy operations generally, not a peptide-specific list of any kind. The remaining fraction came from peptide community and vendor lists, brand-name litigation, and FDA warning letters naming specific sellers. A domain list built this heavily from one pharmacy-focused source needed a reading order that did not simply walk it start to finish, and an early run found out why the hard way.

When walking the list in order was the bug

An early pilot screened that list in plain alphabetical order and got through 3,800 domains before the pattern became clear: 545 came back alive, and only 18 of those, 3.3 percent, carried any peptide signal at all. Every one of those 18 turned out to be a steroid or generic-pharmacy site that happened to use the word peptide somewhere on its page, and none of the 18 carried research-use-only language, the phrase this registry actually uses to identify a research-peptide storefront rather than an unrelated pharmacy operation. The corpus was not the problem. A pharmacy watchlist read in alphabetical order surfaces pharmacy sites first, because that is what the list mostly is, and a peptide storefront sitting somewhere in that same list does not get read any sooner for being one.

How the queue is ordered now

The fix reorders the same list rather than filtering anything out of it. Every domain still gets read eventually; the script's own priority function decides which ones get read first. Domains discovered through a peptide-specific source, community lists, testing-lab mentions, and similar, are read first. Domains named in brand-name litigation or a telehealth or compounding lawsuit come next. FDA letters and any other discovery route follow. The pharmacy watchlist itself comes last, and even within that tail, a domain whose own name reads peptide-adjacent, carrying a word like pept, bio, chem, or lab, is read sooner than the rest of the watchlist, a heuristic the script's own comments describe as exactly that, a heuristic, changing when a domain is read rather than whether it is read at all.

What one screening pass actually checks

The check itself is deliberately minimal. Before anything else, the script reads the domain's robots.txt file, identifying itself with a named user agent, and if that file disallows the path being requested, the domain is recorded as alive but declining to be read, not as dead; nothing past that point is fetched. Where robots.txt allows it, the script makes exactly one request to the homepage and tests the page's own text against eight fixed signals: whether it mentions a certificate of analysis or the letters COA, whether it carries research-use-only or laboratory-use-only language, whether it uses the word peptide at all, whether it names a specific GLP-class compound, whether it accepts card payment, whether it accepts only cryptocurrency, whether it uses manufactured-urgency phrasing warning a visitor that stock is running out or a purchase window is closing, and whether it carries human-use marketing language like weight loss or muscle growth. That is the entire first pass: two requests at most, one robots check and one homepage fetch, against a fixed and published set of checks.

What this tier cannot tell a reader

None of the eight signals above is a judgment, and the script's own opening comment states that plainly: observation only, nothing ranks, endorses, or accuses at this tier. A page carrying a certificate-of-analysis mention has not been shown to publish an actual certificate, only text matching that phrase. A page returning alive and readable has been shown to exist and answer, not to be an operating business still fulfilling orders. That gap, between a domain answering today and a business actually running behind it, is exactly where this registry's deeper dossier work begins, and it is a different and slower process than the first pass this piece describes.

Limitations and open questions

This piece describes the screening script as it read directly from this site's own source on 2026-09-19; the script, its domain list, and its signal patterns can all change after that date, and a reader checking this description later should verify it against the current source rather than this piece. The 3,800-domain pilot and its 3.3 percent finding describe one specific run against one specific slice of the list, read from the script's own code comments documenting an owner directive dated 2026-08-23, not a claim about the registry's current alive rate or its current signal distribution, which this piece does not measure.

A search engine tells a reader what ranks. This registry's first pass tells a reader only what a page's own text says about itself, which is a smaller claim and, for this purpose, a more honest one.

Sources

This publication's own screening script, screen.js, read directly on 2026-09-19, for the domain-list composition, the pilot-run finding, the reordering logic, and the eight signal patterns described above; located in the source by its own code comments rather than by line number, since line numbers move as the codebase changes.