CONTINUOUS INTERNET TELEMETRY24H DRIFT1,998 material changesacross 1,810 domains · +39 vs yesterdayDNS DRIFT21 domains changed DNS providertop destination parity.domains · +2 vs yesterdayEMAIL DRIFT6 domains switched email providertop destination google.com · +3 vs yesterdayCERT DRIFT2 domains switched issuing CA24hNOW3,451 curated domains not answeringlast probe, steadyERRORS8,552 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED2,329 throttled or blocked our scanner429 rate-limit / 403 bot-block24H DRIFT1,998 material changesacross 1,810 domains · +39 vs yesterdayDNS DRIFT21 domains changed DNS providertop destination parity.domains · +2 vs yesterdayEMAIL DRIFT6 domains switched email providertop destination google.com · +3 vs yesterdayCERT DRIFT2 domains switched issuing CA24hNOW3,451 curated domains not answeringlast probe, steadyERRORS8,552 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED2,329 throttled or blocked our scanner429 rate-limit / 403 bot-block

canva.com

Observed 2026-07-14T01:23:29.199Z (1d ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onCloudflare
Email byGoogle Workspace
Registered withGandi SAS
Also usesGoogle Search ConsoleDocuSignDockerHubSpotStripeZoomAtlassian1Password
IPv6 · 7 subdomains · dev_tools
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat canva.com actually stands on - every host below is a signed observation
canva.com
A / AAAA
18.155.202.1718.155.202.3918.155.202.10518.155.202.40+8 more
Cloudflareserves the site
NS
ns-1851.awsdns-39.co.ukns-730.awsdns-27.netns-1421.awsdns-49.orgns-253.awsdns-31.com
awsdns-39.co.uk + awsdns-27.net + moreanswers its DNS
MX
alt2.aspmx.l.google.comaspmx.l.google.comalt4.aspmx.l.google.comalt1.aspmx.l.google.com+1 more
Google Workspacereceives its email

HTTPS probe

redirect Redirecting (3xx) 301 → https://www.canva.com/
HTTP status301
Servercloudflare
TLS protocolHTTP/2
TLS issuernot observed
Behind Cloudflareyes
Response time31 ms
DNS resolutionNOERROR
Redirect chain
https://www.canva.com/

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 4

  • 18.155.202.17
  • 18.155.202.39
  • 18.155.202.105
  • 18.155.202.40

AAAA 8

  • 2600:9000:24bc:4800:b:add6:7500:93a1
  • 2600:9000:24bc:1000:b:add6:7500:93a1
  • 2600:9000:24bc:1400:b:add6:7500:93a1
  • 2600:9000:24bc:6200:b:add6:7500:93a1
  • 2600:9000:24bc:da00:b:add6:7500:93a1
  • 2600:9000:24bc:ba00:b:add6:7500:93a1
  • 2600:9000:24bc:3c00:b:add6:7500:93a1
  • 2600:9000:24bc:b600:b:add6:7500:93a1

MX 5

  • 5alt2.aspmx.l.google.com
  • 1aspmx.l.google.com
  • 10alt4.aspmx.l.google.com
  • 5alt1.aspmx.l.google.com
  • 10alt3.aspmx.l.google.com

TXT 72

  • google-site-verification=vGYy48g7sb4flIluKql8BFp3_6lKKjbQEUGHUDSxCdA
  • mgverify=34d839e7ad9cdafaaccc77da386dcff2c46e4a628449d8e434cd13b032c82201
  • wiz-domain-verification=7fe44deeceff62c6c3011ccf4b4ddae2fd6e94b39ec8cb2cb7e3343dc624d9c3
  • gauntlet-domain-verification=H9sUOdHq/SMDoMyBvXJiKkoNcY9g+3uSQ17NNxJ/kY37wSJe8i7D9x50SuXPMSV0T8mxcFjDlUX+EVhpt+99Gg==
  • have-i-been-pwned-verification=b633a4fdd0ff3575f1580524a28c9c7d
  • google-site-verification=TwtsJNfrmc2RPw6q28QiKM-wnDaowIdVWWX7VhmTDvA
  • openai-domain-verification=dv-X62J0FmW8lDn4eDouDTtdvnm
  • docusign=4c293e32-cbde-4ddf-bec8-79108891d648
  • google-site-verification=JqtkyfjBz-Uq1Xqk7REatNCxZnlo4gYFis8EdI_gVQ0
  • status-page-domain-verification=fgb6hyksgk8x

NS 4

  • ns-1851.awsdns-39.co.uk
  • ns-730.awsdns-27.net
  • ns-1421.awsdns-49.org
  • ns-253.awsdns-31.com

SOA 1

  • ns-1851.awsdns-39.co.uk awsdns-hostmaster.amazon.com

TLS Certificates (0)

None.

Subdomains (7)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for canva.com. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for canva.com <a href="https://domaindrift.io/t/canva.com"> <img src="https://domaindrift.io/badge/canva.com.svg" width="300" height="64" alt="DomainDrift signed observations for canva.com"> </a>

Ed25519 Receipt

Receipt ID
8930a220-9f8d-4c11-9485-05ea351c582d
Output Hash
411c73e8c322855c0a3ffcb93516bc83958d59ea6ebef95a0139f57498e73a41
Signature
ed25519:db44e24bdc805fc6ad6a8870e32768c8dd2a38072611f329b925d2752fd791da7f59dd795cc6342c8a276486c2cca3187fecfc0413b8451ead8ac25cfdd6ca0f
Public Key
ed25519:d610d74ef18f683e5beb859d241d5e67dff0c122e8928b06bec1c2476f4ba27b
Parent
(genesis)
Plane
fast
Verify this in your browser