Written by a person from the record · 2026-07-25 12:00:00 UTC
A new domain with no inbound links received its first automated probe in under two minutes
agentshieldaidefense.com began serving at approximately 10:43 UTC on 25 July 2026 with no inbound links, no search index presence and no sitemap submitted anywhere. The first unsolicited request arrived at 10:44:54 UTC — roughly two minutes later — probing for a WordPress installation path. Four further independent sources followed within the hour.
What was observed
The domain was registered on 31 May 2026 but resolved to nothing until 25 July. DNS began answering at approximately 10:43 UTC. At that moment the site had no inbound links from anywhere, no presence in any search index, and no sitemap had been submitted to any service.
The first unsolicited request arrived at 10:44:54 UTC, from Germany, requesting /wp-admin/install.php — the setup path of an unconfigured WordPress installation.
| Time (UTC) | Origin | Requested |
|---|---|---|
| 10:44:54 | DE | /wp-admin/install.php |
| 10:56:40 | RU | /, /wp-json/, /readme.html (5 requests) |
| 11:22:49 | CN | / |
| 11:28:33 | US | /glossary/canary-token |
| 11:31:53 | CH | /questions |
Five independent sources across five countries within forty-nine minutes of first resolution.
What it means
Discovery of a new domain does not require anyone to link to it. Certificate transparency logs, passive DNS, and newly-registered-domain feeds all publish new hostnames continuously, and automated infrastructure consumes those feeds constantly. Being unknown to search engines and being unknown to the internet are different conditions.
The early arrivals were not reading the site. They were testing whether it was a WordPress installation worth attacking — /wp-admin/install.php on an unconfigured site allows an attacker to complete the setup themselves. This is the ambient background of the web, and it reached a two-minute-old domain before any human knew it existed.
Limits
- One domain, one launch, on one day. Time-to-first-contact will vary with registrar, TLD, nameserver and hosting provider, none of which this measures.
- The site is served through a CDN, so it appeared in that provider's infrastructure the moment DNS resolved. A directly hosted origin might be discovered on a different curve.
- Country codes are geolocations of the connecting address, not attributions. They say where a packet came from, not who sent it.
- Declared user agents in these requests are unverified and, for scanners, routinely falsified.
Why this was worth recording
The interval between a domain becoming reachable and the internet noticing is rarely published, because measuring it requires having instrumented the site before it went live. That ordering is easy to get wrong once and impossible to repeat afterwards.
Governed by
- I. Reality is not interpretation — Reality ≠ Interpretation
- IV. Replay guesses nothing — Every figure must be reproducible from the record
- VI. The record is honest about its size — Sample size is stated; absence is reported as absence
These are the standards this finding was held to, not a claim that it is beyond question. The constitution states them in full.