CONTINUOUS INTERNET TELEMETRY24H DRIFT27,060 material changesacross 26,158 domains · 24h to ~14h ago · -10,962 vs yesterdayROTATION57 domains moved DNS from kirklanddc.com to koaladns.com, 51 moved backa rotation loop, not a migration · 24hREGISTRAR DRIFT1 changed registrar24hNOW562 curated domains not reachable+31 vs yesterdaySITE ERRORS33,728 sites serving errorslast probe · 5xx / 404 / TLSBOT DEFENSEbot defense observed on 117,775 sites429 rate-limit / 403 bot-block, a posture signal

The internet is moving. Watch it move.

Provider migrations, adoption curves and churn spikes across 1,986,970 domains we scan continuously. Every observation is Ed25519-signed and anchored on Base, so every number below traces back to a receipt you can verify yourself.

Provable Every number here rolls up observations we continuously scan and Ed25519-sign, then anchor on Base - a signature proves attribution and integrity, added trust, not a claim that a number is beyond question. Open a domain's signed record, take a receipt id from it, then paste that id into the verifier: it checks the Ed25519 signature and resolves that window's root from Base. Both checks run in your own browser, against published keys.
Flagship · who's winning

Provider migration flows

Who is gaining and who is churning, drawn as net winners and losers with where the domains actually went.

+285 domains to parity.domains, 30d
 Flagship · state of the internet

The internet's infrastructure

Who runs DNS, email and certificates across the corpus, plus IPv6 adoption. The living baseline.

35.8% of scanned DNS on Cloudflare
 Early warning

Provider churn spikes

A provider gaining or losing far more domains than its own 28-day norm, z-scored and flagged as it happens.

 Entity resolution

Hidden portfolios

Cohorts of domains that made the identical move the same day. The bulk-operation and shared-owner tell.

 Leading indicators

What is about to move

Per-domain early signals: DNS moved but the stack has not followed, or several teardown signals in a row.

 Proof

Verify any of it

Follow any domain to its signed x-ray, open the receipt, and check it against the on-chain Base anchor.

The observatory publishes these findings too

The boards above are the internet moving. These are things the sweep can see because it asks every domain the same questions on every pass. Each one is a page with a measurement on it, not a capability we are claiming.

Finding

Domains that answer invented names

Wildcard DNS, read off a control question the scanner already fires. The ground state for subdomain takeover, and sometimes the opposite of a weakness.

 Finding

Who actually answers

What a probe of every tracked domain gets back: silent, guarded, erroring, or fine. Posture we observe, never an error of ours.

562 silent, 1,976,880 probed curated domains
 Finding

How concentrated the internet is

How much of the scanned corpus sits behind how few providers, per lane, each lane with its own denominator.

 Finding

Certificate and email posture

Expiry, issuer, SPF, DMARC, DKIM and MTA-STS, derived from the signed signal rather than asserted.

 Finding

The provider reverse index

Start from a provider instead of a domain: who is on it now, and what moved on or off it.

77 distinct services named
 Finding

Who speaks MCP

Domains serving a valid agent descriptor, counted against the domains actually asked for one and never against the catalog.

5 of 70,787 domains asked for an MCP descriptor

Counts are of the domains we continuously scan (a large sampled corpus, not the whole internet), the window is stated on each surface, and the latest day is a living, partial set. The full history, per-entity drill-down and programmatic pulls are on the signed API.