leonardo-hotels.de
Observed Aug 2, 2026, 21:09 UTC (7d ago). Every field below was attested with an Ed25519 signature at scan time.
leonardo-hotels.de is on the survey sweep, which works its way across the whole catalog rather than returning to one name on a schedule. Putting leonardo-hotels.de under watch moves it to the fast lane, where DomainDrift re-checks it about every 5 minutes and signs each reading, so a change becomes a dated event within minutes instead of waiting for the sweep to come round.
Watch leonardo-hotels.de Watching a domain needs a DRM3 account. The reading above stays free and public either way.DomainDrift asked this domain for a TXT record at a name nobody registers, and got an answer back. A domain that answers a name that was never created is answering names in general, and that is wildcard DNS.
Wildcard DNS clusters around domain parking, dynamic DNS and catch-all hosting. It is also a real attack surface: if every invented hostname resolves, then a hostname an attacker invents resolves too, which is the ground state for subdomain takeover and for phishing hosted under a name that looks legitimate.
This is evidence of wildcard behaviour, not a proven fact. It rests on one control name: a domain could legitimately serve a TXT record at exactly that name for an unrelated reason, and a wildcard that answers address records but not TXT records would not be caught here at all. What this reading is and is not.
DNS Records
A 2
99.83.192.18166.117.30.247
MX 2
10de-smtp-inbound-1.mimecast.com10de-smtp-inbound-2.mimecast.com
TXT 4
MS=ms76769849google-site-verification=jfk7ji8qY8UBIjpX8sTwK9SCAW2SDgig59UnMsg8KFkv=spf1 include:de._netblocks.mimecast.com include:spf.protection.outlook.com ip4:194.29.235.180 ip4:176.95.1.20 include:spf.nl2go.com -allwqmYOLOzCLl7Z14Sha6lt1qf7IuBLDcv1LHgTdSqBFXsHpPLluWvJburgQm6a6ENI+PEYci19DS0wYwhAfb0wQ==
NS 4
ns-1200.awsdns-22.orgns-1908.awsdns-46.co.ukns-489.awsdns-61.comns-772.awsdns-32.net
SOA 1
ns-1200.awsdns-22.org awsdns-hostmaster.amazon.com
SRV 1
autodiscover.leonardo-hotels.com:443 p1
MCP_RECORDS 1
dgfi1sdcmqd.cloudfront.net
DMARC_RECORDS 1
dgfi1sdcmqd.cloudfront.net
BIMI_RECORDS 1
dgfi1sdcmqd.cloudfront.net
MTA_STS_RECORDS 1
dgfi1sdcmqd.cloudfront.net
TLS Certificates (3)
| Common Name | Issuer | Expires |
|---|---|---|
leonardo-hotels.com |
C=US, O=Amazon, CN=Amazon ECDSA 256 M04 | Thu, 19 Nov 2026 23:59:59 +0000 |
Amazon ECDSA 256 M04 |
C=US, O=Amazon, CN=Amazon Root CA 3 | Fri, 23 Aug 2030 22:34:28 +0000 |
Amazon Root CA 3 |
C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Services Root Certificate Authority - G2 | Thu, 31 Dec 2037 01:00:00 +0000 |
Subdomains (0)
None observed.
Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; the only network request the check makes is for the published public keys.
Verify this receiptEd25519 Receipt
- Receipt ID
rcpt_fe7af7afb11c7484- Output Hash
fdf51dc9e103374eb6e520fd3b7178ddebf3860f4526b315ce92cb9f6beb53e5- Signature
ed25519:76486f5b7ad10f248ae624e41a38562a09a50951cad4e177aed27991107f10dc0a7c1fc99ecd2a44b76d0f35966fb5a7e7258d8f1811cde364af7c3e087b160c- Public Key
ed25519:4859bb613d650e12dd7478cc307c73a8712fabc115a9dc59f65534ed3c09a8f9- Parent
(genesis)- Plane
- fast