in the snort source, it looks like it grabs online ones from nostr.watch and randomly picks a few to looks at. https://git.v0l.io/Kieran/snort/src/branch/main/packages/app/src/Login/Functions.ts#L66