CONTINUOUS INTERNET TELEMETRY24H DRIFT23,583 material changesacross 21,757 domains · 24h to ~2h agoROTATION57 domains moved DNS from koaladns.com to kirklanddc.com, 56 moved backa rotation loop, not a migration · 24hEMAIL DRIFT1 domain switched email providertop destination ~NOW605 curated domains not reachablelast probe, steadySITE ERRORS33,518 sites serving errorslast probe · 5xx / 404 / TLSBOT DEFENSEbot defense observed on 118,266 sites429 rate-limit / 403 bot-block, a posture signal

lilnymph.com

Observed Aug 8, 2026, 08:29 UTC (just now). Every field below was attested with an Ed25519 signature at scan time. Catalog observation, re-checked on rotation - watch it for 5-minute checks.

Verify this receipt yourself + Watch this domain
Not responding
Runs onCloudflare
Registered withNameSilo, LLC
104 subdomains · tranco
Every line above is a signed observation. Check the math at the bottom of the page.
EVIDENCE OF WILDCARD DNSobserved 2026-08-08 08:29 UTC

DomainDrift asked this domain for a TXT record at a name nobody registers, and got an answer back. A domain that answers a name that was never created is answering names in general, and that is wildcard DNS.

Wildcard DNS clusters around domain parking, dynamic DNS and catch-all hosting. It is also a real attack surface: if every invented hostname resolves, then a hostname an attacker invents resolves too, which is the ground state for subdomain takeover and for phishing hosted under a name that looks legitimate.

This is evidence of wildcard behaviour, not a proven fact. It rests on one control name: a domain could legitimately serve a TXT record at exactly that name for an unrelated reason, and a wildcard that answers address records but not TXT records would not be caught here at all. What this reading is and is not.

INFRASTRUCTURE MAPwhat lilnymph.com actually stands on - every host below is a signed observation
lilnymph.com
A / AAAA
172.237.129.236172.237.129.108172.237.129.242
Cloudflareserves the site
NS
ns2.ns306.parklogic.comns1.ns306.parklogic.com
parklogic.comanswers its DNS
MX
mail.eye-mail.net
eye-mail.netreceives its email

HTTPS probe

server_error Server error (5xx) 520 Server Error
HTTP status520
Servercloudflare
TLS protocolHTTP/2
TLS issuernot observed
Behind Cloudflareyes
Response time263 ms
DNS resolutionNOERROR
What this reading means

The site answered with a 5xx, so the edge and TLS are working and the application behind them is not.

It does NOT mean the domain or its DNS is misconfigured - the request got all the way to an application to fail there.

What produces this, in rough order of how often
  • The origin is erroring or mid-deploy.
  • An upstream in front of the origin cannot reach it.

These are the known causes, not a diagnosis of this domain. We recorded that nothing answered; we did not measure why.

MCP This domain advertises an AI service endpoint at _mcp._tcp.
v=spf1 ip6:fdec:ae16:fda7::/48 -all

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 3

  • 172.237.129.236
  • 172.237.129.108
  • 172.237.129.242

MX 1

  • 1mail.eye-mail.net

TXT 4

  • v=spf1 ip6:fdec:ae16:fda7::/48 -all
  • v=spf1 ip6:fdec:ae16:fda7::/48 -all
  • v=DKIM1; (detected)
  • v=spf1 ip6:fdec:ae16:fda7::/48 -all

NS 2

  • ns2.ns306.parklogic.com
  • ns1.ns306.parklogic.com

SOA 1

  • ns1.parklogic.com hostmaster.lilnymph.com

TLS Certificates (0)

None.

Subdomains (104)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; the only network request the check makes is for the published public keys.

Verify this receipt

Ed25519 Receipt

Receipt ID
rcpt_b89145c388b67cd0
Output Hash
6e081407191823a7e6a4b341727fd84da9bb77a21f6168e238e8370b01c092a6
Signature
ed25519:e33dd527d404bb1c6f6ac954bf45275c69d5c6dc669a8f2c74113326e48085647335387a925e8530c6f82d6f284f1f6bacd5c251fc64dc1401162565ed98c501
Public Key
ed25519:7aad40f2d6399c207fe2fc15aade04a78324787a355d36725cc90687f9e10cff
Parent
(genesis)
Plane
fast
Verify this in your browser