CONTINUOUS INTERNET TELEMETRY24H DRIFTat least 33,164 material changesacross 32,594+ domains · 24h to ~5h ago · a floor, 19h of 24 walkedNOW566 curated domains not reachablelast probe, steadySITE ERRORS34,433 sites serving errorslast probe · 5xx / 404 / TLSBOT DEFENSEbot defense observed on 156,712 sites429 rate-limit / 403 bot-block, a posture signal

zyno.cloud

Observed Aug 2, 2026, 09:45 UTC (1h ago). Every field below was attested with an Ed25519 signature at scan time. Catalog observation, re-checked on rotation - watch it for 5-minute checks.

Not responding
Secured byLet's Encrypt
Also usesGoogle Search Console
2 subdomains · tranco
Every line above is a signed observation. Check the math at the bottom of the page.
EVIDENCE OF WILDCARD DNSobserved 2026-08-02 09:45 UTC

DomainDrift asked this domain for a TXT record at a name nobody registers, and got an answer back. A domain that answers a name that was never created is answering names in general, and that is wildcard DNS.

Wildcard DNS clusters around domain parking, dynamic DNS and catch-all hosting. It is also a real attack surface: if every invented hostname resolves, then a hostname an attacker invents resolves too, which is the ground state for subdomain takeover and for phishing hosted under a name that looks legitimate.

This is evidence of wildcard behaviour, not a proven fact. It rests on one control name: a domain could legitimately serve a TXT record at exactly that name for an unrelated reason, and a wildcard that answers address records but not TXT records would not be caught here at all. What this reading is and is not.

INFRASTRUCTURE MAPwhat zyno.cloud actually stands on - every host below is a signed observation
zyno.cloud
A / AAAA
51.77.194.82
unattributedserves the site
NS
ns2.dondominio.comns1.dondominio.com
dondominio.comanswers its DNS
MX
mail.zyno.cloud
zyno.cloudreceives its email
TLS
zyno.cloud
Let's Encryptissued its certificate

DNS Records

A 1

  • 51.77.194.82

MX 1

  • 10mail.zyno.cloud

TXT 2

  • google-site-verification=vN_v1KQwzRjbes3DZjTqognKbEUjp8EW2k5z9dnIBOM
  • v=spf1 include:_spf.zyno.cloud -all

NS 2

  • ns2.dondominio.com
  • ns1.dondominio.com

SOA 1

  • ns1.dondominio.com dnsadmin.dondominio.com

MCP_RECORDS 2

  • google-site-verification=vN_v1KQwzRjbes3DZjTqognKbEUjp8EW2k5z9dnIBOM
  • v=spf1 include:_spf.zyno.cloud -all

DMARC_RECORDS 1

  • v=DMARC1; p=none

BIMI_RECORDS 2

  • google-site-verification=vN_v1KQwzRjbes3DZjTqognKbEUjp8EW2k5z9dnIBOM
  • v=spf1 include:_spf.zyno.cloud -all

MTA_STS_RECORDS 2

  • google-site-verification=vN_v1KQwzRjbes3DZjTqognKbEUjp8EW2k5z9dnIBOM
  • v=spf1 include:_spf.zyno.cloud -all

TLS Certificates (3)

Common NameIssuerExpires
zyno.cloud C=US, O=Let's Encrypt, CN=YR1 Fri, 11 Sep 2026 11:50:01 +0000
YR1 C=US, O=ISRG, CN=Root YR Sat, 02 Sep 2028 23:59:59 +0000
Root YR C=US, O=Internet Security Research Group, CN=ISRG Root X1 Thu, 02 Sep 2032 23:59:59 +0000

Subdomains (2)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for zyno.cloud. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for zyno.cloud <a href="https://domaindrift.io/t/zyno.cloud"> <img src="https://domaindrift.io/badge/zyno.cloud.svg" width="300" height="64" alt="DomainDrift signed observations for zyno.cloud"> </a>

Ed25519 Receipt

Receipt ID
rcpt_64bbd34a46c59aed
Output Hash
c3093210bdc52b0edc4994cc5a6e87c42b2beb4580021f9c06eca1ac5c5367de
Signature
ed25519:6480840fbf2eb1ada468a4eba77ecc54ece257dbf016040b7a7c82bbcff7a03702385de039d23b03c42d164110fb82c6810fe7328c8fb2d3850aa700a0c52004
Public Key
ed25519:4859bb613d650e12dd7478cc307c73a8712fabc115a9dc59f65534ed3c09a8f9
Parent
(genesis)
Plane
fast
Verify this in your browser