Counted, not scanned.
Every registered domain under the 1,074 top-level zones whose files ICANN publishes is read every day, complete, not sampled. Each domain names its nameservers; the census knows those nameservers' addresses, and — on a rolling pass of about six weeks — the addresses of every domain's website. This map places each of those addresses on the IPv4 plane and counts what lives there. No address is ever probed. Nothing here comes from scanning anyone's network.
What one pixel is
The whole IPv4 space — 2³² addresses — is laid along a Hilbert curve on a 4,096 × 4,096 grid, so one pixel is one /24 (256 addresses) and addresses that are numerically close stay close on the page. Zoomed out, a pixel is an aligned prefix: /16, /18, /20, /22. 0.0.0.0/8 is the top-left corner. IPv6 is drawn the same way over 2000::/3, one pixel per /27 at full zoom.
A block's colour is how many domains have a nameserver (or a website) there. A domain whose servers sit in two blocks counts once in each, so the counts are domain–prefix incidences, not unique domains.
Measured, and how fresh
| Layer | Source | Fresh |
|---|---|---|
| Nameserver hosting | zone files + the census's nameserver address map (glue records and the busiest nameservers looked up slowly through a public resolver) | daily, complete; IPv4 only — nameserver IPv6 is not yet observed |
| Web hosting | each domain's A / AAAA answers from the census's public-resolver passes, receipt-checked | every domain re-observed about every six weeks; the page shows the observation window |
| Who announces a block | iptoasn.com routing tables (public domain, PDDL) | weekly |
| Where a block is registered | the five Regional Internet Registries' delegation files, via the NRO | weekly |
| Cloud regions | the IP-range lists AWS, Google Cloud, Cloudflare, Oracle and DigitalOcean publish | weekly |
Location: four tiers, never a guess
- Cloud region
- Every occupied address in the block sits in one range that its cloud provider publishes for one region. This is the only tier that names a place.
- Not a place
- Anycast, “global” and edge-zone ranges: one address answers from many cities. No point is drawn. (AWS Local Zones are here too: AWS says they sit away from their parent region.)
- Registry country
- Only the country where the block is registered with its RIR — assigned or allocated blocks only. That is a legal fact about the holder, not where a server stands.
- Unknown
- Mixed signals or no data. Nothing is guessed.
Every label comes from the addresses actually occupied in a block, never from its first address: 257 IPv4 delegations are smaller than a /24, and cloud providers publish ranges down to single addresses.
Blast radius
A domain is “dark under network X” only when every address of every one of its nameservers (or every one of its web addresses) is announced by X. One server elsewhere, or one we cannot see, and it is not counted. Shares are of the domains whose servers we can fully see — that denominator is printed with every number. A network is an autonomous system, not a company: Amazon, for instance, announces from several.
What this map will not do
- Place a home or mobile connection anywhere more precise than its registry country.
- Name people. Organisations and networks only.
- List the domains on an address in bulk. A block shows counts; the census keeps at most a handful of example names per network, privately.
- Scan, probe or ping anything.
Data and licences
The map's data is published at data.ipcensus.org: current.json names the latest generation, tiles.json explains every tile, and the per-block and per-network stores answer one lookup with one range request. Reference sources are public-domain or freely usable; zone files are used under ICANN's Centralized Zone Data Service terms, which permit derived statistics and forbid redistributing the zones themselves — so none are redistributed here. Instruments for single domains, addresses and networks live at dns.pizza.
A dnscensus.org project. Corrections: abuse@dnscensus.org.