CONTINUOUS INTERNET TELEMETRY24H DRIFT55,932 material changesacross 50,731 domains · 24h to ~50m ago · -6,144 vs yesterdayROTATION51 domains moved DNS from koaladns.com to magpiedns.com, 51 moved backa rotation loop, not a migration · 24hNOW532 curated domains not reachablelast probe, steadySITE ERRORS33,869 sites serving errorslast probe · 5xx / 404 / TLSBOT DEFENSEbot defense observed on 120,346 sites429 rate-limit / 403 bot-block, a posture signal

zalando-lounge.ro

Observed Aug 2, 2026, 14:46 UTC (4d ago). Every field below was attested with an Ed25519 signature at scan time.

This reading of zalando-lounge.ro was taken 4d ago

zalando-lounge.ro is on the survey sweep, which works its way across the whole catalog rather than returning to one name on a schedule. Putting zalando-lounge.ro under watch moves it to the fast lane, where DomainDrift re-checks it about every 5 minutes and signs each reading, so a change becomes a dated event within minutes instead of waiting for the sweep to come round.

Watch zalando-lounge.ro Watching a domain needs a DRM3 account. The reading above stays free and public either way.
Verify this receipt yourself + Watch this domain
Up right now
Email byGoogle Workspace
Secured byAmazon
Also usesFacebook/MetaGoogle Search Console
1 subdomain · tranco
Every line above is a signed observation. Check the math at the bottom of the page.
EVIDENCE OF WILDCARD DNSobserved 2026-08-05 23:21 UTC

DomainDrift asked this domain for a TXT record at a name nobody registers, and got an answer back. A domain that answers a name that was never created is answering names in general, and that is wildcard DNS.

Wildcard DNS clusters around domain parking, dynamic DNS and catch-all hosting. It is also a real attack surface: if every invented hostname resolves, then a hostname an attacker invents resolves too, which is the ground state for subdomain takeover and for phishing hosted under a name that looks legitimate.

This is evidence of wildcard behaviour, not a proven fact. It rests on one control name: a domain could legitimately serve a TXT record at exactly that name for an unrelated reason, and a wildcard that answers address records but not TXT records would not be caught here at all. What this reading is and is not.

INFRASTRUCTURE MAPwhat zalando-lounge.ro actually stands on - every host below is a signed observation
zalando-lounge.ro
A / AAAA
3.65.64.1518.159.152.10518.157.252.251
unattributedserves the site
NS
ns-102.awsdns-12.comns-1355.awsdns-41.orgns-2006.awsdns-58.co.ukns-594.awsdns-10.net
awsdns-12.com + awsdns-41.org + moreanswers its DNS
MX
aspmx.l.google.comalt3.aspmx.l.google.comalt4.aspmx.l.google.comalt1.aspmx.l.google.com+1 more
Google Workspacereceives its email
TLS
cert06.zlounge.org
Amazonissued its certificate

DNS Records

A 3

  • 3.65.64.15
  • 18.159.152.105
  • 18.157.252.251

MX 5

  • 1aspmx.l.google.com
  • 10alt3.aspmx.l.google.com
  • 10alt4.aspmx.l.google.com
  • 5alt1.aspmx.l.google.com
  • 5alt2.aspmx.l.google.com

TXT 5

  • facebook-domain-verification=rbwv32fo5ll36lri29de3kcsokrzba
  • google-site-verification=ZGpup6JgmuMJbKSIFrnDr5J9xR2u32lXeCux7ItF3QM
  • google-site-verification=wpe8_ftN3wt3bNq7IVu-OZ7jZFGFb6CBbEcJhcFWG1Y
  • google-site-verification=z263GH0wNjUkTwKjAGjXtfJB4wzRFRANRSIz5Brt6RA
  • v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all

NS 4

  • ns-102.awsdns-12.com
  • ns-1355.awsdns-41.org
  • ns-2006.awsdns-58.co.uk
  • ns-594.awsdns-10.net

SOA 1

  • ns-1355.awsdns-41.org awsdns-hostmaster.amazon.com

MCP_RECORDS 5

  • facebook-domain-verification=rbwv32fo5ll36lri29de3kcsokrzba
  • google-site-verification=ZGpup6JgmuMJbKSIFrnDr5J9xR2u32lXeCux7ItF3QM
  • google-site-verification=wpe8_ftN3wt3bNq7IVu-OZ7jZFGFb6CBbEcJhcFWG1Y
  • google-site-verification=z263GH0wNjUkTwKjAGjXtfJB4wzRFRANRSIz5Brt6RA
  • v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all

DMARC_RECORDS 1

  • v=DMARC1; p=reject; pct=100; rua=mailto:dmarc_reports@zalando-lounge.ro; ruf=mailto:dmarc_auth@zalando-lounge.ro; fo=1;

BIMI_RECORDS 5

  • facebook-domain-verification=rbwv32fo5ll36lri29de3kcsokrzba
  • google-site-verification=ZGpup6JgmuMJbKSIFrnDr5J9xR2u32lXeCux7ItF3QM
  • google-site-verification=wpe8_ftN3wt3bNq7IVu-OZ7jZFGFb6CBbEcJhcFWG1Y
  • google-site-verification=z263GH0wNjUkTwKjAGjXtfJB4wzRFRANRSIz5Brt6RA
  • v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all

MTA_STS_RECORDS 5

  • facebook-domain-verification=rbwv32fo5ll36lri29de3kcsokrzba
  • google-site-verification=ZGpup6JgmuMJbKSIFrnDr5J9xR2u32lXeCux7ItF3QM
  • google-site-verification=wpe8_ftN3wt3bNq7IVu-OZ7jZFGFb6CBbEcJhcFWG1Y
  • google-site-verification=z263GH0wNjUkTwKjAGjXtfJB4wzRFRANRSIz5Brt6RA
  • v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all

TLS Certificates (3)

Common NameIssuerExpires
cert06.zlounge.org C=US, O=Amazon, CN=Amazon RSA 2048 M04 Tue, 22 Dec 2026 23:59:59 +0000
Amazon RSA 2048 M04 C=US, O=Amazon, CN=Amazon Root CA 1 Fri, 23 Aug 2030 22:26:35 +0000
Amazon Root CA 1 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Services Root Certificate Authority - G2 Thu, 31 Dec 2037 01:00:00 +0000

Subdomains (1)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; the only network request the check makes is for the published public keys.

Verify this receipt

Ed25519 Receipt

Receipt ID
rcpt_8347a2c444d63fc9
Output Hash
e94eb18eb347f6b5dbd89f583930cadddc13a28852d270b1caff464ff7e9b9d6
Signature
ed25519:6e3116e6189e7fd70c03714ff8a38b45505048404099eb5996b46d314e95b590c91966b53e1f9c224868dc324e01c8102f7d4ccfc937ded62350d6bfb09bb502
Public Key
ed25519:4859bb613d650e12dd7478cc307c73a8712fabc115a9dc59f65534ed3c09a8f9
Parent
(genesis)
Plane
fast
Verify this in your browser