Catch a lookalike
the moment it arms.
A parked lookalike of your brand switches on a mail server and a fresh certificate, the setup a phishing run needs. DomainDrift reads ~809,000 domains and signs the moment one changes, so the switch-on is a dated event you catch first. Type a domain and look inside.
What changed on the internet today
Who gained and who lost across the internet.
Every reading is signed the second it is taken, and notarized on Base.
A signature proves who took a reading and that it stays unaltered. That is attribution and integrity, never a claim the reading is correct. Check one of our signatures yourself →
The sweep that watches your domain also publishes these.
Watch a domain, and keep the receipt.
A watch tells you the moment a domain changes, with signed evidence that it did.
The watch laneRe-checked as often as every five minutes
Nameservers, mail, certificate, DNSSEC, and whether it answers at all. A domain a human put their name against takes the fast lane; the survey sweep takes the rest.
Where you workMaterial moves land in Slack, Teams, Discord, a webhook, or your inbox
Routine churn stays quiet. Every change is scored before it is sent, so a rotating load-balancer address never wakes anyone and a nameserver move always does. See what arrives: sample reports and alerts.
Signed evidenceHand an auditor a bundle they can check at their own desk
The export carries the readings, their receipts and our published key, so the check runs offline at their desk and the timestamp comes from Base mainnet.
When a provider moves under everyone, you see it land across ~809,000 domains at once: what changed today.
Four teams buy this
Brand and impersonationCatch a lookalike domain before it arms. See the watch →
Name the lookalikes you worry about, resolving or not. DomainDrift watches each one from before it answers and dates the day it switches on.
Compliance and vendor riskA dated, signed reading of vendor posture. See the evidence →
What their posture was on the day, what it is now, and every change in between.
Agencies and MSPsEvery client domain in one place. See how it works →
One group per client, one alert destination, and a signed report you can hand over.
Infrastructure salesA leads list of who just switched. See who switched →
Who moved host, DNS or mail provider this week, dated the day the move was read.
More teams use it too: Small business, Domain portfolios, IT and security.
Everything DomainDrift sees, and everything it proves.
The whole surfaceWho hosts it, who handles its mail, who issues its certificate
Read across ~809,000 curated domains, along with whether the site answers at all. The certificate chain, the registration record and the nameserver set are all part of one reading, taken together so they can be compared to the last one.
And how it movesEvery change scored and timestamped, not just listed
Delivered as a daily feed, RSS or JSON, or a signed webhook the moment it is confirmed. The score is what separates a nameserver move from a load balancer rotating its address, so a quiet channel means a quiet week rather than a broken feed.
AgentsREST, SSE, OpenAPI and MCP through one public door
Priced per request, the same for everyone. An agent can read a domain keylessly to start, then carry an account key for the full record. Connect an agent over MCP.
Start with one domain.
Watch it, get the alert, keep the signed record. Plans raise how many you watch and how much you pull.