MERLONIX

A natural history of the internet

Every domain is a living thing.Here is yours.

Type a domain. We audit its certificates, DNS, mail authentication and security headers live, and draw what we find as a creature on an engraved plate. Nothing on it is decoration: every spine, eye and tentacle is a fact about that domain, and every weakness shows.

From the bestiary:

Plate drawn from stripe.com’s public records, observed 2 Oct 2026. Yours takes about five seconds.

Digicertus stripensis — the Ancient Stripe Medusa, a specimen of stripe.comFigure 1, Halo: No halo — the zone is not DNSSEC-signed, so its DNS answers can be spoofed in transit. Figure 2, Carapace: 5 of 6 plates (grade B). Unarmoured: Permissions-Policy. Figure 3, Growth rings: 31 rings — one per year since registration on 12 Sept 1995 via SafeNames Ltd. Figure 4, Eyes: 4 eyes on the rim — one per nameserver, in the Route 53 shelf (AWS). Figure 5, Oral arms: 2 oral arms — one per address the name resolves to: 198.137.150.111, 198.202.176.111. Figure 6, Open fronds: SPF ~all: unlisted senders are only flagged; barbed by DMARC p=reject. Figure 7, Antennae: Antennae raised — /.well-known/security.txt names a contact, so researchers can report flaws. Figure 8, Crest: 4 crest spines — CAA records restrict which authorities may issue its certificates. Figure 9, Dorsal ridge: Spined — HSTS preloaded, max-age 2 yr, incl. subdomains. Browsers will never speak plain HTTP to it. Figure 10, Pulse: One beat every 4.2 s — the TLS certificate (DigiCert, EC-256) expires in 69 days. The nearer expiry, the faster it beats. Figure 11, Rim clasps: All three clasps shut — transfer, update & delete are locked at the registrar. Figure 12, Tentacles: 5 mail exchangers (Google Workspace). 4 DKIM suckers: google, s1, s2 and 1 more.A NATURAL HISTORY OF THE INTERNETMedusozoa RetisPLATE 1847Fig. 1. HaloNo halo — the zone is notDNSSEC-signed, so its DNSanswers can be spoofed intransit.Fig. 2. Carapace5 of 6 plates (grade B).Unarmoured: Permissions-Policy.Fig. 3. Growth rings31 rings — one per year sinceregistration on 12 Sept 1995via SafeNames Ltd.Fig. 4. Eyes4 eyes on the rim — one pernameserver, in the Route 53shelf (AWS).Fig. 5. Oral arms2 oral arms — one per addressthe name resolves to:198.137.150.111,198.202.176.111.Fig. 6. Open frondsSPF ~all: unlisted senders areonly flagged; barbed by DMARCp=reject.Fig. 7. AntennaeAntennae raised —/.well-known/security.txt namesa contact, so researchers canreport flaws.Fig. 8. Crest4 crest spines — CAA recordsrestrict which authorities mayissue its certificates.Fig. 9. Dorsal ridgeSpined — HSTS preloaded,max-age 2 yr, incl. subdomains.Browsers will never speak plainHTTP to it.Fig. 10. PulseOne beat every 4.2 s — the TLScertificate (DigiCert, EC-256)expires in 69 days. The nearerexpiry, the faster it beats.Fig. 11. Rim claspsAll three clasps shut —transfer, update & delete arelocked at the registrar.Fig. 12. Tentacles5 mail exchangers (GoogleWorkspace). 4 DKIM suckers:google, s1, s2 and 1 more.Digicertus stripensisTHE ANCIENT STRIPE MEDUSASpecimen of stripe.com, drawn from a live audit of its public infrastructureHabitat. the Route 53 shelf (AWS)Mail symbiont. Google WorkspaceAge. 31 yearsLifespan. renew by 11 Sept 2027Weaknesses. 2Observed. 2 Oct 2026, livemerlonix.com/specimenEngraved from live data. Every mark is a fact.

Digicertus stripensis

The Ancient Stripe Medusa

  1. Fig. 1. Halo — No halo — the zone is not DNSSEC-signed, so its DNS answers can be spoofed in transit.
  2. Fig. 2. Carapace — 5 of 6 plates (grade B). Unarmoured: Permissions-Policy.
  3. Fig. 3. Growth rings — 31 rings — one per year since registration on 12 Sept 1995 via SafeNames Ltd.
  4. Fig. 4. Eyes — 4 eyes on the rim — one per nameserver, in the Route 53 shelf (AWS).
  5. Fig. 5. Oral arms — 2 oral arms — one per address the name resolves to: 198.137.150.111, 198.202.176.111.
  6. Fig. 6. Open fronds — SPF ~all: unlisted senders are only flagged; barbed by DMARC p=reject.
  7. Fig. 7. Antennae — Antennae raised — /.well-known/security.txt names a contact, so researchers can report flaws.
  8. Fig. 8. Crest — 4 crest spines — CAA records restrict which authorities may issue its certificates.
  9. Fig. 9. Dorsal ridge — Spined — HSTS preloaded, max-age 2 yr, incl. subdomains. Browsers will never speak plain HTTP to it.
  10. Fig. 10. Pulse — One beat every 4.2 s — the TLS certificate (DigiCert, EC-256) expires in 69 days. The nearer expiry, the faster it beats.
  11. Fig. 11. Rim clasps — All three clasps shut — transfer, update & delete are locked at the registrar.
  12. Fig. 12. Tentacles — 5 mail exchangers (Google Workspace). 4 DKIM suckers: google, s1, s2 and 1 more.

2 weaknesses observed: 1 security header missing; zone not DNSSEC-signed. Each one is drawn on the plate — and each one can change silently. Merlonix watches all of it and tells you the day your specimen changes.

Key to the anatomy

Each specimen is drawn from one live, read-only audit of public records: TLS, DNS, RDAP and a single HTTPS request. Two domains with the same posture still differ: colour and posture are seeded by the name, so no two specimens are alike.

Pulse
Days until the TLS certificate expires. Healthy specimens drift slowly; one about to expire beats frantically. Expired: it fossilizes.
Bell shape
The certificate key. Elliptic-curve keys grow a round bell; RSA keys grow a tall one, taller with key size.
Carapace
Six plates, one per HTTP security header: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. A missing header is an empty plate.
Dorsal ridge
HSTS. Spined when the domain is on the browser preload list.
Growth rings
One ring per year since the domain was registered, read from RDAP.
Rim clasps
Registrar locks against transfer, update and deletion — the defence against domain hijacking.
Eyes and halo
One eye per nameserver. A golden halo when the zone is DNSSEC-signed.
Crest and antennae
Crest spines are CAA records (who may issue certificates). Antennae are security.txt (who to tell about a flaw).
Oral arms
A records — where the name actually points.
Tentacles and suckers
One tentacle per mail exchanger; suckers are the DKIM signing keys found on it.
Tentacle tips
SPF curls them shut (-all), leaves them open (~all) or frays them. DMARC reject adds barbs; quarantine a single hook.

Specimens change. Merlonix notices.

A certificate nears expiry, a header disappears in a deploy, a registrar lock gets lifted, DMARC is quietly relaxed. None of it throws an error. Merlonix re-audits your domains continuously and tells you the day your specimen changes.

Start free trialOr claim your free plan

No credit card required.