# One Server, Many Domains: Rotation a Domain List Cannot See A family of unrelated-looking domains, retired and replaced on a schedule, all sitting on one server the whole time. Provenance: Observed in Report URI report telemetry. Published: 2026-08-24. Updated: 2026-08-24. The domains in this cluster do not look related. They are registered months apart, through more than one registrar, and their names read like ordinary analytics endpoints — the kind of hostname that survives a review because nothing about it invites a second look. They are related. Every one of them resolves into the same small block of servers, and has done for as long as we have telemetry covering them. ## What the rotation looks like An operator runs two or three domains at a time. Each carries a share of the traffic for weeks or months, and then, on a single day, they stop and are replaced. Not tapered — stopped. The two we watched most closely were still on sixty-odd sites the day before they went quiet. The replacements tend to go live the same day they are bought. One was registered just before one in the afternoon and was being blocked on more than a dozen unrelated sites by that evening. Nothing had to be deployed for that to happen. Whatever is running in the visitor's browser already knew where to look, and the only thing that changed was the address it looked at. Which tells you what the domain actually is. Not the operation — a setting in the operation, and one that costs about as much to replace as a cup of coffee. A few do sit and wait. One was registered in May, generated nothing at all for twelve weeks, then came up in the August changeover alongside the rest. Those are the ones worth hunting for: a domain resolving into the same block but barely showing up in reports is not a straggler winding down, it is the next rotation waiting to start. ## Why a domain list is always a cycle behind Every defence keyed to the registered domain has the same problem: it can only describe domains that have already been used. A blocklist entry is a record of the last rotation. A reputation score is a judgement about a domain's history, and the replacement has none — it is a clean name on a dirty server, and the score has no way to express that. So the new domain arrives unflagged, runs for weeks, accumulates enough of a history to be judged, and is retired around the time anything catches up with it. None of this requires the operator to react to defenders. It is a schedule, and the schedule is shorter than the loop that would catch it. ## What stays still The server does. Domains are cheap and disposable. A server is neither: it is rented, it is paid for monthly, and moving means rebuilding. So while the names churn, the address underneath them tends not to, and one address can sit under an entire family across several rotations. Pivoting on it takes a resolver and nothing else. Resolve the hosts your reports have shown you, group them by address, and look at the groups holding more than one domain. Most will be a CDN and uninteresting. What is left is short. Two corroborating signals usually sit alongside it. The registration timestamps cluster — domains bought in the same minute, sometimes the same second, are one purchase. And the registrar and nameservers repeat across the family, because whoever is running it has an account somewhere and keeps using it. ## What the blocklists say You do not have to take our word for any of this. Point a filtering resolver at some of these domains and it will not answer you — no address, nothing. Someone else looked at them and came to the same conclusion we did, without ever seeing our reports. Which ones, though, is the interesting part. They are the old domains, retired a rotation or two back. The two doing the work today resolve fine everywhere. That is not a dig at the blocklists — it is the same lag as before, seen from the other side. ## The judgement it requires Grouping by address is only meaningful when the address belongs to one tenant. A CDN edge fronts thousands of unrelated sites and tells you nothing; so does budget shared hosting. The distinction is a lookup rather than a guess — the allocation's registered holder and its size say plainly whether you are looking at a provider's shared estate or a single small block that one customer rents. Where it is the second, the network is the durable indicator and the domain list is a description of history. Where it is the first, stay with the hosts. ## What it means when you see it Where the delivery mechanism is a browser extension, and it often is, none of this indicates that your site has been compromised. The requests come from software the visitor installed, running on whatever page they happen to be on. Your policy reporting them is the system working. It is still worth knowing. An extension with permission to run on your pages can read what the visitor reads, and that includes everything behind their login. The site is fine; the session may not be. ## Indicators - *.duertry.com - *.everydaysi.com - *.fivestat.com - *.gadstat.com - *.gresta.cloud - *.hipodi.com - *.junklip.com - *.luselucky.com - *.motramby.com - *.nutrifunc.com - *.paradosto.com - *.singleview.site - *.tstats.online - overbridgenet.com - statsdata.online ## Questions ### How is this different from rotating subdomains? Rotating subdomains change the label under one registered domain, so covering the domain catches them. Here the registered domain itself is replaced, which a domain entry cannot anticipate. The thing that stays still is one level further down: the server. ### Why does a reputation score miss this? Reputation is a judgement about a registered domain, and a replacement domain has no history to judge. A fresh domain on a server that has been serving the same operation for months scores like any other new domain, because the score has no way to see the server. ### Is my site compromised if these hosts appear in my reports? Usually not. Where the delivery is a browser extension, the requests come from software the visitor installed and your pages can be entirely clean. It still matters, because an extension with page access can read whatever the visitor can, including what is behind their login. ### Can I pivot on the server myself? Yes, and it needs nothing but a resolver. Resolve the hosts your reports show you and group them by address. Two unrelated-looking domains on one address is the whole signal. ### Isn't blocking by network too broad? It would be on shared hosting or a CDN, where one address fronts thousands of unrelated sites. This only holds where the allocation is small and single-tenant, and checking which one you are looking at is a lookup, not a guess.