CONTINUOUS INTERNET TELEMETRY24H DRIFT5,066 material changesacross 4,792 domains · last 24h · -404 vs yesterdayDNS DRIFT112 domains changed DNS providertop destination cloudflare.com · -1 vs yesterdayEMAIL DRIFT14 domains switched email providertop destination google.comCERT DRIFT24 domains switched issuing CA24h · -2 vs yesterdayNOW579 curated domains not reachablelast probe, steadySITE ERRORS29,717 sites serving errorslast probe · 5xx / 404 / TLSBOT DEFENSEbot defense observed on 139,316 sites429 rate-limit / 403 bot-block, a posture signal
Docs / Live views

Live views

Every view is a different question asked of the same signed corpus. The analysis pages are public; the full list pages open completely with a free account, and show an honest top slice with the true total when you are signed out.

Change and drift

What changed todayThe daily drift, ranked by significance: provider moves, CA changes, posture shifts, outages. MigrationsWho moved provider, CA, or host - the flows between operators, drawn from real observed moves. ReachabilityThe live composition of probe verdicts across the corpus: what is up, blocked, or down right now.

The corpus

Who runs itProvider concentration: how much of the internet's DNS, mail, CDN, and hosting sits with how few operators. GeographyWhere domains are registered versus where they are served. Security postureEmail auth, DNSSEC, certificate health, and dangling records, rolled up by sector. DomainsSearch the corpus by name, IP, CA, or registrar. ServicesEvery fingerprinted provider, ranked by how many domains run it. CertificatesIssuers, expiry windows, and CA drift across the corpus.

The full index of views lives at Browse.

Per-domain surfaces

  • The latest record - /t/<domain> is the free, shareable, always-current page for any domain's latest signed snapshot.
  • The time machine - signed in, any historical snapshot at /t/<domain>/<timestamp>: the record as it stood then, from the archive, receipt included.
  • The full workbench - the signed-in domain page adds every plane, the change history, live probes you can run from your own browser to corroborate the scan, and the evidence exports.
  • The badge - /badge/<domain>.svg is an embeddable status badge, safe to hotlink.

Free tools

Eight single-purpose lookups, no account, live compute on the domain you type: WHOIS, DNS records, SSL check, email auth, DNSSEC, propagation, expiry, and blacklist. The hub is /tools.

The playground

The playground runs real, read-only API calls from the browser - on your own key when signed in, through the keyless preview lane when not. It is the fastest way to see the wire format before writing a line of code.

← The signed recordMonitoring & alerts →