How detection works
What we read, how often, and what we can't see.
Coverage honesty is the thing serious buyers evaluate. So the gaps are on this page, not in a footnote.
Sources & cadence
| Source | Cadence | What it gives us |
|---|---|---|
| gTLD zone files | Nightly | Every registered domain across 1,022 gTLDs. The population, not a sample. |
| Certificate Transparency | Streaming | Every issued certificate — earliest sighting kept. Reveals hostnames and debut dates. |
| DNS records | Nightly snapshot + diff | MX, SPF, DMARC, DNSSEC, CAA and provider CNAMEs. Change is the product. |
How a Movement is formed
We store the earliest sighting of every fact (a ReplacingMergeTree keyed to keep the first date, not the latest). A Movement is the diff between two nightly states of a domain — a record added, removed, or changed — dated to the night we first saw it. Paired removes and adds inside a short window are classified as switches.
Confidence levels
Direct record evidence — SPF include, DMARC policy, MX, certificate. Stated as fact.
Composite or fingerprint inference — e.g. a provider identified by subdomain + CNAME pattern.
Best-effort clustering — ccTLD/operator linkage, analytics providers. Always labelled.
Known gaps — stated plainly
- ccTLD coverage is not complete. ccTLD signal is certificate-derived only, and any geography is inferred — we label it every time.
- Hosted-app surfaces (*.vercel.app, *.myshopify.com) are intentionally out of scope. We fire when a business is real enough to own a domain.
- Providers that route mail without a distinctive SPF include are under-counted; we flag categories where this bites.
- Analytics and tag providers are best-effort and marked Inferred — treat them as directional, not authoritative.
- We record infrastructure facts, never on-site behaviour, intent-browsing, or anything about a person.
Questions about a specific signal's method or confidence? Ask us — we'd rather over-explain coverage than oversell it.