Loading content
Infrastructure
Where the web that matters actually lives — a name resolved down to the physical ground it sits on, and who owns that ground.
A website is a name that must be resolved, hop by hop, into a physical machine in a building in a country owned by a company — and every hop is a place it can be watched or bent.
The live graph
Search any domain and walk the web by authority — who hosts it, and the other top sites that host shares with it. 40M domains, live from the graph.
First principles
A domain name is not a location — it is a promise to be resolved into one.
Every website terminates in physical infrastructure someone owns and some state can reach.
The web is centralised: a handful of networks carry most of what appears to be everywhere.
Names lie, machines do not. When a claim and a DNS record disagree, weight the record.
The layers
Websites, IP & Hosting decomposed from surface to foundation. Each layer rests on the one beneath it, and control of a lower layer reaches every layer above.
The library
The systems in this domain, explained in full — each with every type described.
How a typed name becomes a connection to one specific machine — hop by hop, each a link of delegated trust and a place it can break.
Explore Resolution ChainBelow the name is the backbone: independent networks announcing what they can reach, and trusting each other by default.
Explore Network LayerUnderneath the routing is concrete and fibre: the buildings, edges and cables the web physically runs on — and the few players who own most of it.
Explore InfrastructureThe transport and application protocols that carry every request — and why each one exists.
Explore Web ProtocolsKey concepts
A network of IP prefixes under one administrative control, identified by an AS number — the unit of ownership on the internet backbone.
Web infrastructure is interconnected: a domain resolves to an IP, an IP hosts other domains, and shared certificates or registrants tie properties to one operator.
Public append-only logs of every issued TLS certificate — a global feed of who is standing up which infrastructure.
Announcing routes for prefixes you do not own so traffic flows through you — a network-level man-in-the-middle.
How one domain links to its infrastructure
Each artifact resolves to the next; shared attributes reveal siblings.
| From | Resolve to | Reveals |
|---|---|---|
| Domain | IP address (DNS) | Where it is served |
| IP | ASN + other domains | Who hosts it, what neighbours it |
| Certificate | Shared cert / SAN list | Related properties |
| ASN | Prefixes + peers (BGP) | The owning network |
Findings, with confidence
Every claim carries its confidence — fact, inference, or projection — and the reasoning behind it. Nothing here is asserted beyond what the evidence supports.
A small set of ASNs (hyperscalers + CDNs) sit behind a large share of the top-1M websites.
basis · Top-site → hosting rollups; strong inductive pattern.
A domain’s hosting ASN is a more reliable owner signal than its WHOIS registrant.
basis · Machine-generated routing data vs. often-privacy-masked WHOIS; deductive.
Shared TLS certificates reliably cluster properties run by the same operator.
basis · Holds often; shared CDNs create false positives.
Going deeper
A single domain resolves to an IP; that IP often serves other domains too; those may share a TLS certificate or registrant; the IP sits inside a prefix owned by an ASN, which peers with other networks over BGP. Following those links shows how one name is embedded in a wider web of shared infrastructure — the structure of the whole layer.
Cost, performance and DDoS protection pushed hosting toward a handful of CDNs and hyperscalers — Cloudflare, Amazon, Google, Akamai. As a result a small number of ASNs now front a large share of the top-1M sites. What looks like an infinitely distributed web actually terminates in a few networks, which is both an efficiency and a chokepoint.
Networks announce which IP prefixes they can carry, and other networks believe them by default. A more-specific or simply false announcement can pull a prefix’s traffic through an attacker (a hijack) or leak routes across the internet. RPKI signs announcements to blunt this, but adoption is partial — so the internet still routes, fundamentally, on trust.
DNS, ASN, certificate-transparency and peering data are machine-generated and hard to fake — high confidence. Registrant identity, by contrast, is usually privacy-masked, so the human owner behind a shell-hosted site often can’t be read from the web layer alone and has to be resolved through the ownership graph. A record has no agenda; a WHOIS field does.
Data provenance
This page is a view over the same intelligence graph the rest of Tricellix runs on. Where the graph is thin, we say so; the live interactive view mounts here as each source is wired in.
Take this system from reference to decision.