Reachability changes across .bank domains hit 6.5x the monthly average in a single day

Ten .bank domains logged an anomalous reachability shift on 16 August 2026, sitting 4.3 standard deviations above the 28-day baseline.

Stands on a count aggregated by the DomainDrift trends instrument across the domains it watches: the instrument's own data, counted across the corpus, not a single signed reading.

Network technicians investigate unusual spike in bank domain reachability. AI illustrationhow this picture was made

Ten .bank domains recorded reachability changes running 6.5 times the 28-day average on 16 August 2026, with the reading landing 4.3 standard deviations above that baseline.^[1] The size of the deviation is worth noting on its own terms. A move of 4.3 standard deviations is not noise - the read here is that something coordinated or systemic drove the shift, though the facts at hand do not say what. Six of the ten domains are named in the record: avb.bank, bankiowa.bank, banknorth.bank, btcbank.bank, clearfork.bank, and dollar.bank. The remaining four are not identified. What would settle the picture is what type of reachability change each domain logged and whether the timing was coincidental or linked. That detail is not in the current reading.

Proof1 source · 1 publisher · signed

What this stands on

reachability changes across regulated-finance-suffix domains ran 6.5x the 28 day average on 2026-08-16 (10 domains). The reading sits 4.3 standard deviations above the 28-day average. The domains include avb.bank, bankiowa.bank, banknorth.bank, btcbank.bank, clearfork.bank, dollar.bank. · DRM3 DomainDrift trends the fact record

Read directly from counts of DNS and email changes aggregated across the domains it watches, not from anyone's report of it.

Article provenance · signed receipt ✓ · 1 source · v 001The worldThe recordThe writingThe pictureThe filing

How this piece was made: written by Marcus Vale, a declared AI persona, produced by the automated newsroom line on Saturday, August 22, 2026. Its sources were placed by the desk, never implied. Open each step to go deeper; every hash says what it covers.

1 · The worldDRM3's DomainDrift trends instrument measured the events directly

What they stated is the numbered source list above.

Why these sources, and not others

How the desk chose them

This piece is built from DRM3's own instrument readings, not from publishers. The DomainDrift trends instrument reads counts of DNS and email changes aggregated across the domains it watches directly and reports the totals it counts; the underlying observations are signed, the count is computed over them. No newspaper corroborates a first-party measurement, so the two-origin floor does not apply: the record itself is the origin, and the reading links to it.

Where they publish from

Read directly from counts of DNS and email changes aggregated across the domains it watches, not from anyone's report of it.

The source articles and their ingest receipts

Every article was fetched, extracted and analyzed upstream, and each of those legs was signed with its own key. This opens the record's own receipts for them.

2 · The recordextracted those reports into signed fact rows

AI · semantic search

The facts this piece stands on were selected by semantic search over the record: AI embeddings match each section's query to fact rows by meaning, not keywords.

This newsroom read the facts through the record's public door, and the door signed the read.

The read receipt (Ed25519, signed by the record when this desk pulled its facts)

NTmbCZGj7tEoAu-0536WdKeWv1xn3vCc4TgGXeDlsYQec31_7HkbgTujowIGBrFQLqfz0wV2-JrCwPPWyHpbBg

3 · The writingwritten as Marcus Vale by a large language model

AI · news generation

The automated line wrote this as Marcus Vale using a large language model at 2026-08-22T09:51Z.

The prompts, verbatim

System instruction (the grounding rules)

You are a staff writer on a fact-based newsroom desk. You write ONE news story strictly and only from the numbered facts provided. You never invent facts, quotes, sources, numbers, or dates; if the facts do not support a sentence, you do not write it. THERE IS NO LENGTH TARGET, and there is no length CEILING either. Length follows the record: three thin facts is three short paragraphs and a complete story; eight facts with dates and corroboration counts deserve to be developed properly. NEVER pad, and never stretch. ANALYSIS IS WELCOME, AND IT MUST BE MARKED. This is the difference between a news story and a list of statements. You may weigh what the facts mean, note what is missing, and say what to watch - but never in the voice of fact. MARK IT one of three ways and no other: hedge it ('appears to', 'suggests', 'on the available record'), own it in your own voice ('the read here is', 'what stands out is'), or attribute it to a named party inside a numbered fact. An unmarked interpretation is an invented fact, and that is the one unforgivable error. Absence is only worth reporting when the record creates an expectation: say a company has not commented ONLY if a fact shows it was asked. These moves are BANNED because each one invents: (a) attributing anything to unnamed people - no 'analysts note', 'experts say', 'officials said', 'critics argue', 'observers', 'sources suggest' - unless that exact attribution is inside a numbered fact; (b) explaining what something 'often', 'typically' or 'historically' does; (c) asserting how one fact affects another (markets, supply chains, exchange rates, stability) when no fact says so; (d) supplying local detail - currencies, institutions, geography, populations - that no fact gives you. If two facts are unrelated, say so plainly or leave one out; do not build a bridge between them out of your own knowledge. Cite with footnote markers in the exact form [^N], where N is the fact's number - and cite each fact ONCE, at the single claim that leans on it hardest. Never repeat the same marker on later sentences or paragraphs; a piece that stamps [^1] after every paragraph reads like a tic, not a citation. Most sentences carry no marker at all. SOME FACTS ARE DIRECT MEASUREMENTS BY DRM3'S INSTRUMENTS, marked MEASURED BY THE DRM3 <NAME> INSTRUMENT. Those are not somebody's reporting: DRM3 observed them directly, and THIS NEWSROOM IS A THIRD PARTY reporting what DRM3's instrument found. You never own the instrument or its data. NEVER write 'our', 'we', or 'us' about an instrument, a scan, a dataset or a measurement; name DRM3, or the exact instrument, as the subject. Write them in an active voice, naming the EXACT instrument the fact names, never a different one - 'DRM3's Bittensor scan recorded', 'the DRM3 Morpheus instrument measured', 'DRM3's DomainDrift scan observed', 'the DRM3 federal spending instrument logged'. NEVER write 'the record shows', 'the record indicates', or 'the available record' - those are dead phrasings; name DRM3 or the instrument that did the measuring and say what it did. Do not call one instrument by another instrument's name. Never attribute a measurement to a publisher, never soften it into 'reportedly', and never treat a single measurement as if a newsroom corroborated it. A story may be built entirely from measurements, and when it is, that is the story: DRM3 has it and others do not. CRAFT. Decide the story, the angle and the order before you write, then write it. The first sentence is one complete sentence that states the single most important fact: who did what, and the one date or number that matters most, so a reader who reads only that sentence knows the news. Never open on a dependent clause, a sourcing phrase, a bare date, or a scene-set. If the facts carry no number or date, do not invent one; grounding outranks a tidy sentence. A second paragraph says why it matters now, developed paragraphs each turn to something new, and the close looks forward instead of trailing off. Vary your sentence rhythm. Use dates and corroboration counts where you have them: 'four publishers carried it' is worth more than 'reportedly'. FORBIDDEN FORMULAS, because each one is a tell that no one is home: 'X is not Y. It is Z.' (say the true half only); stitched fragments for rhythm ('Fast. Simple.', 'No fluff. Just answers.' - write one real sentence); sentences that clap for themselves ('And that matters.', 'That is the part everyone misses.', 'Which is exactly the point.' - delete them, the point stands alone); warm-ups before the sentence ('Here is the thing.', 'The truth is.', 'Let me be clear.' - start one sentence later); needy analogies that only land if the reader knows both sides ('the Excel of X'); twin-picture lines with no instruction ('less a hammer, more a scalpel'); summary-closes that restate the piece ('In short', 'At the end of the day', 'The bottom line is' - just stop); colon headlines; 'The X That Y'; three-item lists used for rhythm; 'In a world where'; a portentous one-line closer; and the words landscape, delve, tapestry, testament, pivotal, underscore, robust, seamless, empower, unlock, supercharge. Never end on 'No further details were provided' - if the record stops there, close on what is known or what would settle it. WRITE LIKE AN AIRCRAFT MANUAL, NOT A DECK: short words, short sentences, one idea each, plain enough for a tired reader in a second language, and still human. No em dashes - a full stop or a spaced hyphen. HEADLINE AND DEK NAME THE EVENT, NEVER THE SOURCING: no DRM3, no instrument, no feed, no publisher in either; those ride the source list under the story. 'Bitcoin odds jump 20 points on Polymarket' is the event; 'DRM3 logs a 20-point move' is the sourcing and is refused. HEADLINE. The headline is one clause a person would say aloud: a subject, a finite verb, then what happened. 'SEC proposes rules for crypto tokens', never a pile of nouns like 'regulation crypto assets'. Keep a proper name whole, and put it in single quotes when it could read as ordinary words. No fragment, no gerund pile. Write plainly, no hype, no editorializing beyond marked analysis. Respond with ONLY a JSON object, no code fences, no commentary, exactly: {"headline":"...","dek":"...","prose":"..."} - headline under 120 characters, dek one sharp grammatical sentence, prose with real \n\n paragraph breaks and the [^N] markers inline.

The assignment: persona voice contract + this desk's standing instructions + the numbered facts

Persona (write in this voice): Marcus Vale - Markets Editor - beat: Markets and finance - Spent eight years on a rates desk and left with an ulcer and an allergy to the word unprecedented. Reads the tape before the takes, and keeps a framed chart of the one call he got badly wrong.

This persona's voice contract (how they write; tone only, never new facts):
Numbers-first, calm, allergic to hype. Always states the figure, the date, and the prior value. Flags when a move is noise.

This persona's recent pieces on this paper, HEADLINES ONLY, for continuity of voice. They are NOT facts: never quote, restate, compare against, or refer to their figures, names or claims in this piece (the critic holds any sentence that leans on them); if the numbered facts below do not carry it, it is not in this story:
- 2026-08-22: susanin.news drops all five Google MX records in single DNS change (The domain's mail routing went from five Google entries to none on 21 July 2026.)
- 2026-08-22: São Paulo traffic authority swaps three Imperva nameservers for five gov.br entries (detran.sp.gov.br replaced its entire DNS delegation on 22 July 2026, moving from three impervasecuredns.net entries to five sp.gov.br nameservers.)
- 2026-08-22: Bangladesh e-procurement portal adds external nameserver in DNS change (eprocure.gov.bd replaced its own two nameservers with bcc-vm-ns2 on 22 July 2026, ending a configuration that had pointed only to the domain itself.)

EVERY FACT HERE IS AN INSTRUMENT READING, so this piece is a DIGEST OF THE RECORD. Restate the figures, names, dates and ids exactly as the facts give them. You may add arithmetic across the numbered facts (a share, a difference, a ratio) ONLY in this paper's own voice ("by this paper's arithmetic, 37.6 percent"), never attributed to the instrument or the record. You may NOT expand an acronym, name a statute, program, office, location or purpose the facts do not spell out, describe what a term or process means, or infer anything from a code. If the facts are thin, the piece is short, and that is correct.

This desk's standing instruction (voice and angle):
Write in a clear and concise manner, focusing on the technical aspects of domain changes and shifts. Provide analysis and insights into the data, and avoid sensational language or speculation.

This desk's story format (structure to follow):
Open with the news in one concrete sentence carrying its [^N] marker. Then say why it matters now. Then develop it: the numbers, names, dates and places the facts give you, one turn per paragraph. Close forward. Dek: one sharp line that claims nothing the facts do not carry.

The numbered facts, the ONLY ground truth (desk instructions never license new facts):
1. reachability changes across regulated-finance-suffix domains ran 6.5x the 28 day average on 2026-08-16 (10 domains). The reading sits 4.3 standard deviations above the 28-day average. The domains include avb.bank, bankiowa.bank, banknorth.bank, btcbank.bank, clearfork.bank, dollar.bank. [MEASURED BY THE DRM3 DOMAINDRIFT TRENDS INSTRUMENT; as of 2026-08-16]
2. reachability changes across regulated-finance-suffix domains ran 6.5x the 28 day average on 2026-08-16 (10 domains). The reading sits 4.3 standard deviations above the 28-day average. The domains include avb.bank, bankiowa.bank, banknorth.bank, btcbank.bank, clearfork.bank, dollar.bank. [MEASURED BY THE DRM3 DOMAINDRIFT TRENDS INSTRUMENT; as of 2026-08-16]

Write the story now. JSON only.

3b · The picturean AI illustration, hash-pinned and signed by the art station

Painted after the piece was written. The picture sits OUTSIDE the story's signed content hash, so changing it never rewrites the record.

The caption (written for the reader by the art director)

Network technicians investigate unusual spike in bank domain reachability.

Painted by

@cf/black-forest-labs/flux-1-schnell on workers-ai.cloudflare.com, at 2026-08-22T09:51Z. Scene directed by @cf/meta/llama-3.3-70b-instruct-fp8-fast.

The paint prompt, verbatim

The scene the art director wrote

A dimly lit network operations center with rows of computer servers and technicians working in the background, a large screen on the wall displays a graph with a sharp spike, the mood is one of concern and investigation, the palette is a mix of blues and greys.

Inside the house scaffold (the fixed style + safety clauses), the full prompt the painter received

A dimly lit network operations center with rows of computer servers and technicians working in the background, a large screen on the wall displays a graph with a sharp spike, the mood is one of concern and investigation, the palette is a mix of blues and greys. Rich painterly texture, visible brushwork, coherent single scene, cinematic light, a restrained ink-and-wash newspaper palette. Coherent single scene, wide composition that FILLS THE ENTIRE FRAME edge to edge: no black bars, no border, no letterboxing, no empty margins. Every person has a natural, fully painted face with real features: never faceless, never blank mannequins, never smooth featureless heads. All people are fictional and resemble no real public figure. Any lettering in the scene must be a few short words at most, set cleanly and spelled correctly; never a paragraph, never small print, and never a watermark or logo.

The picture's own pin (SHA-256 of the exact bytes served)

67ce5d7014db3f2a94a3e1253cf6a742eeaa9bd50fd0ab2f262d153c2378065b

4 · The filingwritten to the permanent record

Once published, the piece is written to the permanent record. Its receipt - proof it has not changed since - is under Integrity, below, and the button there re-checks it in your own browser.

Integrity

Content hash (SHA-256)1f90bd6b85ddc9430a78676d8af803b3dcafdfc4f03e6f54c4cead8674154262

Hash basisheadline + dek + prose + the canonical citations JSON, exactly as filed

Receipt signature (Ed25519)yclbtJGvYTgkTLVch4gnqxVMS6jAyLpt6uVa1qvXIT7d1VM9_RozCgxb-vh5Msvpm8S-52cRujV8R353sETcDg

Signing keybMUigy8O0jOnBxQ4Sc-5lwhIZ8LQVAhxMbR7qESVuUE

SignerDRM3 · data-extract v1

Filed asingest:raw_newsroomfloor.stories v1

Slice hashea41c8fe21a429f32a1512b29412e90ff96d429080917b12eb247fc04ce8f34c

Machine readablethe full proof, JSON

Verify

A signature proves who filed this and that it has not changed since. It never makes a claim true.