Census of — · — domains in — generic top-level zones · nameservers read daily · web sample observed —One pixel per /24 · Hilbert order
Preview. This page is drawing a sample slice of the census while the first full generation is built. Every number is real; the coverage is not yet the whole internet.
Development findings. The findings below come from a development file named in the address bar, not from this generation's published findings.json.
The internet has 4,294,967,296 IPv4 addresses, and this plate shows every one of them.1 The map is cut into blocks of 256 addresses called a /24, and each block is one pixel when you zoom all the way in. A block is coloured by how many domains keep a nameserver there. Grey blocks are assigned to someone but hold none. Hatched blocks are reserved and can never hold anything.
The blocks are not laid out in rows. They follow a Hilbert curve, a path that visits every block once and never jumps.2 On a curve like this, addresses that are close in number stay close on the page, so a whole network sits together as a patch instead of being smeared across a row. That is why the map has shapes you can read.
This diagram is drawn in your browser from the map's own Hilbert function.
The same 16 blocks, laid out two ways. In rows they are a strip; on the curve they are a square. Every network on the plate is a square or a 2:1 oblong for the same reason.
When you look up a domain, your computer asks its nameservers where the site is. Those nameservers are machines with addresses, and this map counts them. Every address is announced to the rest of the internet by a network with a number, an autonomous system.3 “Announces” means “tells the world how to reach it”. It does not mean the machine is in that network's country, or in any one place at all.
This diagram is drawn in your browser.
Each step down is 256 times smaller. A /24 is three steps below the whole plate.
So this map never says where a server stands. It says who announces the block and where that network is registered, and it names a city or region only when a cloud provider publishes one for every occupied address in the block.4Anycast addresses, which answer from many cities at once, are marked “not a place”. They hold — of the nameserver incidences on this plate, more than any tier the map can place.
Every number below is computed each night from the same tables that draw the map. The margin says where each one comes from. These are measurements of the — generic top-level zones, not of the whole internet.0
Findings for this generation have not been published yet. The map above is current; the cards will fill when findings.json lands.
01
Most domains keep every nameserver in one network.
—
A domain usually has two or more nameservers, so that if one fails the other still answers. The old advice, written in 1997, is to put them on different networks, so that one outage cannot take both.5 Of the — domains whose nameservers this census can all see, — have every nameserver announced by the same network. The spare depends on the same network as the original.
Networks per domain
Drawn in your browser from this generation's findings.json. With scripts off, read that file directly: data.ipcensus.org/current.json names the generation.
Each bar is 100% of the classifiable domains. Right: the three different “domain” totals on this page.
Why a security researcher should care
This is the correlated-failure number. For — of these domains, a route leak, a hijack of their own provider's prefixes, or an outage at that one network removes every nameserver at once; the redundancy in the zone file is nominal. Each provider takes down only its own share, which is the Blast Radius table, whose denominator is all the classifiable domains. This number is its ceiling: the — not dark under any single network cannot appear under any one row.
02
Two networks are the only nameserver home of — of the domains we can fully see.
—
Cloudflare alone is the sole nameserver network of — of classifiable domains. GoDaddy's DNS network is the sole network of another —.6 After those two the curve flattens fast: — networks reach 80%, and all — networks that host any nameserver reach the ceiling of —. The ceiling is Finding 1: the rest of the domains are spread across networks, or rely on an unrouted address, and cannot be “under” any one of them.
Concentration curve
Drawn in your browser from this generation's findings.json. With scripts off, read that file directly: data.ipcensus.org/current.json names the generation.
A rank-ordered concentration curve, not a Lorenz curve: networks are taken largest first and plotted against their rank, not against a cumulative population share.
Why a security researcher should care
Blast radius. Everything that can go wrong with one autonomous system, a BGP hijack of its DNS prefixes, a route leak that blackholes them, a sustained DDoS on its anycast addresses, a sanctions order, a takedown, a mis-pushed config, has a measurable share of the namespace behind it, and that share is printed here with its denominator. The flat tail means that diversification by the long tail of small providers is real but does not move the headline: the — networks beyond the top 100 that are the only nameserver network for at least one domain add — points.
A hundred blocks, 25,600 addresses, carry — of the map.
—
Each block on the plate is 256 addresses. Take the 100 densest. Together they are 25,600 addresses, six millionths of IPv4,7 and they hold — of every nameserver incidence this census counts. All — of the densest are Cloudflare anycast blocks, with about — to — million domains each. On the full plate they are smaller than a pixel. Turn on “Ring the 100 densest” under the map to see where they are.
The sliver, to scale
Drawn in your browser from this generation's findings.json. With scripts off, read that file directly: data.ipcensus.org/current.json names the generation.
At this size the hundred blocks together cover about — of one pixel. The rings are there so you can find them.
Where the incidence sits
Drawn in your browser from this generation's findings.json. With scripts off, read that file directly: data.ipcensus.org/current.json names the generation.
All — blocks that hold a nameserver, densest first, on a log axis: a cliff, not a slope.
Why a security researcher should care
DDoS and hijack targets do not get smaller than this: a /24 is the longest IPv4 prefix most networks will accept into the global routing table, and these hundred are the ones whose loss or capture would be felt by the most names. The caveat matters just as much: anycast means those 256 addresses are served from hundreds of sites, so the physical sliver is not a physical single point of failure. It is a routing single point: one more-specific announcement from the wrong place captures all of it.
04
The map can honestly place one block in —. The rest is paperwork or anycast.
—
Of the — inhabited blocks, — sit entirely inside a region their cloud provider has published. Those are the only blocks this map will put on a map of the world.8— carry only a registration country, the country where the block is registered with its RIR. — are anycast or “global” ranges, and they hold — of all nameserver incidences: — of the blocks carrying — of the weight.
Mass and area
Drawn in your browser from this generation's findings.json. With scripts off, read that file directly: data.ipcensus.org/current.json names the generation.
Same four tiers, same order, same colours as the map's ramp. Thin lines join each tier's boundaries so the eye can follow it from area to mass.
Why a security researcher should care
Measurement bias. Any study that geolocates nameservers from a commercial IP-to-country database inherits the T4 problem for — of blocks and the anycast problem for the blocks that matter most. Jurisdiction analysis (“which country can compel this server”) needs the registration fact; latency and resilience analysis needs the location fact; most papers use one number for both.
05
“Registered in” is not “located in”. Germany shows why.
—
Group the single-network domains by the country where their network is registered: United States —, Germany —, China —.9 Germany's figure is almost entirely one network: AS44273, the one that carries GoDaddy's DNS, is registered to Host Europe GmbH, a German company. It alone is — of the German number. The nameservers are wherever GoDaddy runs them; the registry record is in Germany. China's figure is the same shape: — of it is Alibaba's AS37963.
Country of registration
Drawn in your browser from this generation's findings.json. With scripts off, read that file directly: data.ipcensus.org/current.json names the generation.
Bolder tone: the country's largest network. Fainter: all its other networks. The outlined bar is a remainder, not a country.
Why a security researcher should care
Jurisdiction and sanctions analysis starts from registry country, and here it would put — of the generic namespace under German law by paperwork alone. Conversely, “Chinese nameserver share” in the gTLD space is — by this measure, and most of that is one Alibaba ASN. Whoever quotes a country share of DNS without naming the method is quoting one of several possible numbers.
06
In the newest generic zones, one network is nearly everything.
— of .—
Across all — zones with at least — classifiable domains, the biggest single-network share is —'s —. In .com it is —. Among zones with at least — domains we can fully see, in .— it is —; in .——; .——; .——; .——; .——; .——.10 These are zones launched in ICANN's new-gTLD programme, and the numbers say only what they say: in these zones, nearly every domain's every nameserver is in one network.
One network per zone
Drawn in your browser from this generation's findings.json. With scripts off, read that file directly: data.ipcensus.org/current.json names the generation.
One mark per zone; area grows with the zone's size. Boldest tone: Cloudflare is the top network; middle tone: GoDaddy DNS (AS44273); faintest: any other. Dashed: all zones together.
Why a security researcher should care
Two uses. First, a TLD-level chokepoint map: for an incident responder, “what fraction of .click goes dark if AS13335's DNS prefixes are hijacked” is a number here, with its denominator. Second, sampling bias: a study that draws its domains from new gTLDs will measure one network's share far above the .com figure: — in .com against — in .—. Zone choice is a confound.
— networks host a nameserver. The median hosts — domains.
— domains, the median network
— networks announce at least one nameserver address. Half of them host — domains or fewer. — of them, —, host fewer than a hundred.11 That tail is the self-hosted internet: universities, companies running their own DNS, small hosts. It is where the diversity is. It is also small enough that the headline numbers above would not change if it vanished.
Rank and size
Drawn in your browser from this generation's findings.json. With scripts off, read that file directly: data.ipcensus.org/current.json names the generation.
Every network that hosts a nameserver, largest first, on log–log axes. A reader who knows Zipf plots reads the slope.
Why a security researcher should care
Two opposite risks live in the tail. Its many small operators are the only real topological diversity in the system, and they are also where unpatched, single-homed, unmonitored nameservers live. For measurement, the tail is why “number of ASNs” is a useless diversity metric: — networks and a — top-two share are the same dataset.
08
The Web and IPv6 layers come from a sample observed on —.
— domains
Nameservers are read from the zone files every day, complete. Web addresses are not in zone files; they have to be looked up, and this generation's web layer is a —-domain sample looked up on —, — days before this census.12 In that sample, — of the domains with an address have an IPv6 address. Under the “every address in one network” rule, Amazon's AS16509 is the sole web network of — of them and Cloudflare's AS13335 of —. Treat the web numbers as a dated sample. Treat the nameserver numbers as the census.
Freshness ruler
Drawn in your browser from this generation's findings.json. With scripts off, read that file directly: data.ipcensus.org/current.json names the generation.
The gap between the web sample and the census day is the finding.
Why a security researcher should care
Staleness is a bias with a direction: hosting moves toward large clouds over time, and — days of drift on — million domains is enough to shift a share by a point. Any comparison between the web layer and the nameserver layer on this site compares a sample to a census and one season to another, and the dates are printed so nobody has to guess.
Blast radius
If one network vanished, what share of the domains we can fully see would go dark? A domain counts only when every one of its servers is announced by that network. These are the top networks behind Finding 2, as blast.json publishes them.