attackers.net

Observed Jul 24, 2026, 12:53 UTC (9h ago). Every field below was attested with an Ed25519 signature at scan time. Catalog observation, re-checked on rotation — watch it for 5-minute checks.

Verify this receipt yourself + Watch this domain

Up right now

Email byGoogle Workspace

Secured byAmazon

Also usesGoogle Search Console

tranco

Every line above is a signed observation. Check the math at the bottom of the page.

INFRASTRUCTURE MAPwhat attackers.net actually stands on - every host below is a signed observation

attackers.net

A / AAAA

52.196.47.13713.159.123.8813.196.69.237

unattributedserves the site

ns-1053.awsdns-03.orgns-1748.awsdns-26.co.ukns-213.awsdns-26.comns-529.awsdns-02.net

awsdns-03.org + awsdns-26.co.uk + moreanswers its DNS

aspmx.l.google.comalt3.aspmx.l.google.comalt4.aspmx.l.google.comalt1.aspmx.l.google.com+1 more

Google Workspacereceives its email

TLS

attackers.net

Amazonissued its certificate

DNS Records

A 3

52.196.47.137
13.159.123.88
13.196.69.237

MX 5

1aspmx.l.google.com
10alt3.aspmx.l.google.com
10alt4.aspmx.l.google.com
5alt1.aspmx.l.google.com
5alt2.aspmx.l.google.com

TXT 2

google-site-verification=oXbWZkC6vhjoFeYhvuQGrFhTKAQhhp0LCygcmjndqgA
v=spf1 include:_spf.google.com ~all

NS 4

ns-1053.awsdns-03.org
ns-1748.awsdns-26.co.uk
ns-213.awsdns-26.com
ns-529.awsdns-02.net

SOA 1

ns-529.awsdns-02.net awsdns-hostmaster.amazon.com

TLS Certificates (3)

Common Name	Issuer	Expires
`attackers.net`	C=US, O=Amazon, CN=Amazon RSA 2048 M04	Fri, 13 Nov 2026 23:59:59 +0000
`Amazon RSA 2048 M04`	C=US, O=Amazon, CN=Amazon Root CA 1	Fri, 23 Aug 2030 22:26:35 +0000
`Amazon Root CA 1`	C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Services Root Certificate Authority - G2	Thu, 31 Dec 2037 01:00:00 +0000

Subdomains (0)

None observed.

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for attackers.net. It updates itself. It attests a signed observation - not that the site is safe.

<a href="https://domaindrift.io/t/attackers.net">
  <img src="https://domaindrift.io/badge/attackers.net.svg"
       width="300" height="64" alt="DomainDrift signed observations for attackers.net">
</a>

Ed25519 Receipt

Receipt ID: rcpt_471ec2a659b8f601
Output Hash: b0ca396e342b1812dedd76cdcca005519dc9c9ab3f992a646f2a3a4f91d495f2
Signature: ed25519:fe6bad8aae17780eb22275ff75131ab0b77e3c9560c7f805da5fef7a5414a04e958186e7d6e22f01c1c2ae49e673b4ad5671829097925064bdbe80bbd5f27b06
Public Key: ed25519:4859bb613d650e12dd7478cc307c73a8712fabc115a9dc59f65534ed3c09a8f9
Parent: (genesis)
Plane: fast

Verify this in your browser

Permalink: https://domaindrift.io/t/attackers.net