CONTINUOUS INTERNET TELEMETRY24H DRIFT3,778 material changesacross 3,106 domains · last 24h · +1,862 vs yesterdayDNS DRIFT54 domains changed DNS providertop destination cloudflare.com · +24 vs yesterdayEMAIL DRIFT9 domains switched email providertop destination google.comCERT DRIFT21 domains switched issuing CA24h

For Legal & IP Counsel · Evidence Kept Before The Dispute

Keep the exhibit,
not the invoice.

A Wayback screenshot gets excluded as hearsay and per-capture services bill $199+ a capture. DomainDrift keeps a domain’s DNS, mail, and ownership as a dated, signed record before the dispute, at $10 to $99 a month, built to travel the FRE 902(13)/(14) path with custodian certification available: a route for counsel, not a Rule 901 fight.

~2,050,000 domains under continuous signed watch Signed the moment it is observed Anchored daily to Base
What backs every line on this page

One working artifact: the signed evidence report.

Every reading DomainDrift takes is signed the moment it is observed and travels as a dated evidence report you can hand over: state, providers, registrar, expiry, email authentication, DNSSEC and subdomains, per domain, on one page. The recipient re-checks every reading themselves in the public verifier, with no account, years later. That artifact is the same on every page here. The persona only changes which part of it you foreground, on the same $10 / $29 / $99 ladder.

The return

The math, before the feature.

A domain dispute turns on what was true, and when. Opposing counsel moves to exclude the Wayback screenshot as hearsay and the exhibit is gone; the fallback is a capture bought after the complaint lands, $199+ a capture, for a page that still postdates the fight. DomainDrift reads the infrastructure continuously, so a dated, signed record already exists before the dispute does, at $10 to $99 a month: the exhibit that survives the challenge, not one assembled after it.

Kept early
Before anyone argued

the domain’s DNS, mail, certificate, and ownership read and signed on ordinary days, so the record predates the dispute rather than being built for it, and priced by the matter, not by the capture.

Built to travel
The 902 path

designed to move as a certified record under FRE 902(13)/(14), with custodian certification available: a route for counsel, not a Rule 901 fight over a screenshot.

Honest limit
Attribution, not correctness

a signature proves who observed a record and that it is unaltered, not that it is correct. Added trust a third party can check, never a substitute for the panel’s judgment.

Opposing counsel moves to exclude the screenshot. The case still turns on the date.
“the trend nevertheless appears to exclude such Wayback Machine evidence as hearsay.”
IP Legal Corner, on web captures in domain disputes (iplegalcorner.com)

A public statement, quoted verbatim. Not a customer, not affiliated with DomainDrift, and not an endorsement.

Your desk, real captures

The reading, and the featured exhibit

A signed infrastructure evidence report for a single domain: a dated summary, observation counts, and DMARC posture, with a print / save-as-PDF button.
The signed evidence report for one domain (coinbase.com shown): a dated summary - category, last scanned, 61 observations, 304 scans - and the security posture (DMARC p=reject, PASS), each line from an Ed25519-signed observation, with a print / save-as-PDF button for the file. Its header states the limit plainly: a signature proves who observed a record and that it has not been altered since, not that the observation is correct.
An IP-dispute (UDRP) watch group: the genuine facebook properties beside lookalikes, most not reachable at last probe, each row a signed observation with its own receipt.
An IP-dispute (UDRP) watch group of six domains: the genuine facebook properties beside lookalike spellings (facebook-login.com, faceboook.com, secure-facebook.com), most not reachable at last probe, each row a signed observation with its own receipt. A dated record kept before anyone is arguing over it. Captured July 26, 2026.
What you actually get

The product, pointed at your desk.

The lookalike, read and signed

A disputed domain read from the outside at a known moment, every line one signed observation a third party can re-check: what it did at scan (up, redirect, not responding, a TLS error), its nameservers and registrar, and where it actually resolves and sends mail. This is the reading kept on file before the case, not a picture taken after opposing counsel moved to exclude it.

A domain that goes dark still leaves a signed record of when it was last seen live.

The exhibit, with its receipts

Group the domains in a matter and DomainDrift produces a signed evidence report over the estate: state, providers, registrar, expiry, email authentication, DNSSEC, and subdomains per domain, on one dated page you print or save as a PDF for the file. Its own header states the limit plainly, then it is built to travel the FRE 902(13)/(14) path, custodian certification available.

Watch it before it rotates

A disputed domain often changes its infrastructure once the complaint lands. A live watch captures the move, dated and signed, so the record of what it looked like before is already on file. Approve today’s state as the baseline and an alert reads not “something changed” but “changed from what you documented.”

The site swaps its certificate the hour after you file; the pre-filing reading is already signed.

How it works
1Look one up free

Read any domain from the outside, dated and signed, with no account.

2Watch a matter

Group the domains in a dispute; a free account watches one, paid plans watch the caseload.

3Hand it over

Pull the signed evidence report for the file; the recipient re-verifies it against published keys.

The market
6,168
UDRP and ccTLD cases in 2024 (WIPO)
75,000+
UDRP cases over 25 years
$199+
per capture, the going rate for defensible web evidence

A dated, signed infrastructure record kept before anyone was arguing, built to travel the FRE 902(13)/(14) path with custodian certification available: a route for counsel, not a Rule 901 fight over whether a screenshot is what it claims to be.

An independent, signed record, now anchored to Base

Every reading is signed the moment it is taken and chained to the one before, against published keys, and each day's readings are rolled into a single root and anchored to Base, a public chain, so the date is confirmed by the chain and not only by us. That proves who took each reading, that nobody has altered it since, and when it was taken. It is attribution, integrity, and an independent timestamp, never a claim the reading is correct: a signature can sit on a wrong observation. Anyone re-checks any reading themselves at the verifier, no account, years later. The signature is the first-mover trust layer; the lasting advantage is the dated record itself, which compounds and cannot be recreated after a domain changes, or rewritten once it is anchored.

Start free

A free account puts one of your own domains under watch, keeps its history, and sends a signed alert the moment we see it change. Paid plans raise the dials; pricing is on its own page.

Free to start. No credit card. Your signed record is yours to keep and verify anywhere.