DomainDrift

A continuous record of the internet's surface: who hosts a domain, who handles its mail, who issues its certificate, whether it is up and why. A 2,050,978 domain catalog under continuous scan across every plane: DNS across nine record types, TLS from certificate transparency, WHOIS, subdomains, DNSSEC, ASN, and robots.txt.

Every observation is Ed25519-signed the moment it is made and chained to the one before it. The data is not just collected. It is attested at the time of collection, so a downstream consumer can verify what was observed, when, and by whom, and hand a signed evidence bundle to an auditor, an underwriter, or a court, verifiable offline against DomainDrift's published keys.

Each new observation is also notarized on Base mainnet within about 15 minutes. Every signed receipt in a 15-minute window is rolled into one Merkle root, and that root is written to a public contract, so the block's own timestamp is an independent record of when the reading already existed and it cannot be backdated afterward. Anyone can trace a single receipt to that on-chain root in their browser, from the receipt to its 15-minute window to the root to the transaction on Base.

That check runs end to end, on published inputs, with nothing to take on faith beyond the signature itself. The leaf set behind any published window is served openly at domaindrift.io/anchor/leafset/PERIOD, so you can rebuild the window's root from the receipts and confirm your receipt is one of the leaves, then compare that root against the transaction on Base.

The record from before that lane opened is committed too, in one transaction rather than backdated one window at a time. On 2026-07-29, 9,129 window roots covering 18,183,009 signed readings taken between 2026-04-14 and 2026-07-28 were written to Base as a single commitment, and the full set of window roots is published openly at domaindrift.io/anchor/commitment/archive-2026-04-14-2026-07-28 so anyone can rebuild the commitment root and check it against the chain. A reading from that archive proves itself in two hops, into its window's root and that root into the commitment; a reading from the going-forward lane takes one. The commitment is dated the day it was made, because a block timestamp records when we committed, never when the reading was taken.

Change is scored in-stream and published as a daily feed you can read or pull as RSS or JSON. A universal search answers the reverse questions: who sits on this IP, who uses this certificate authority, who this registrar holds. Agents reach the same signed data over REST, a live stream, MCP discovery, or per-call x402 payment.

Paired with RunsWith for deeper infrastructure fingerprinting across 80+ provider categories. Together they form the scanner tier of DRM3 intelligence.

Plans, limits, and prices live on DomainDrift's own pricing page at domaindrift.io/pricing, which reads them from the billing ledger. There is a free tier, and anything beyond the published plans goes through inquiries@drm3.io.