cheapflights.com

Observed 2026-07-17T12:37:17.572452962+00:00 (7h ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now

Runs onFastly

Email byProofpoint

Secured byLet's Encrypt

Registered withMarkMonitor Inc.

IPv6 · push_legacy

Every line above is a signed observation. Check the math at the bottom of the page.

INFRASTRUCTURE MAPwhat cheapflights.com actually stands on - every host below is a signed observation

cheapflights.com

A / AAAA

151.101.1.29151.101.129.29151.101.193.29151.101.65.29+4 more

Fastlyserves the site

blue.foundationdns.comblue.foundationdns.netblue.foundationdns.org

foundationdns.com + foundationdns.net + moreanswers its DNS

mxa-009e5101.gslb.pphosted.commxb-009e5101.gslb.pphosted.com

Proofpointreceives its email

TLS

cheapflights.com

Let's Encryptissued its certificate

DNS Records

A 4

151.101.1.29
151.101.129.29
151.101.193.29
151.101.65.29

AAAA 4

2a04:4e42:600::285
2a04:4e42:400::285
2a04:4e42::285
2a04:4e42:200::285

MX 2

10mxa-009e5101.gslb.pphosted.com
10mxb-009e5101.gslb.pphosted.com

TXT 5

MS=ms68273412
v=DMARC1; p=none; rua=mailto:dmarc@cheapflights.com; ruf=mailto:dmarc@cheapflights.com;fo=1
v=spf1 include:cheapflights.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all
v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email
v=BIMI1; l=https://amplify.valimail.com/bimi/kayak/fTQ4of63cCm-momondo_group_limited_1349937297.svg; a=https://amplify.valimail.com/bimi/kayak/fTQ4of63cCm-momondo_group_limited_1349937297.pem

NS 3

blue.foundationdns.com
blue.foundationdns.net
blue.foundationdns.org

SOA 1

blue.foundationdns.com dns.cloudflare.com

CAA 11

iodef "mailto:ops@kayak.com"
issue "comodoca.com"
issue "digicert.com; cansignhttpexchanges=yes"
issue "letsencrypt.org"
issue "pki.goog; cansignhttpexchanges=yes"
issue "ssl.com"
issuewild "comodoca.com"
issuewild "digicert.com; cansignhttpexchanges=yes"
issuewild "letsencrypt.org"
issuewild "pki.goog; cansignhttpexchanges=yes"

TLS Certificates (3)

Common Name	Issuer	Expires
`cheapflights.com`	C=US, O=Let's Encrypt, CN=YR2	Mon, 28 Sep 2026 04:58:06 +0000
`YR2`	C=US, O=ISRG, CN=Root YR	Sat, 02 Sep 2028 23:59:59 +0000
`Root YR`	C=US, O=Internet Security Research Group, CN=ISRG Root X1	Thu, 02 Sep 2032 23:59:59 +0000

Subdomains (0)

None observed.

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for cheapflights.com. It updates itself. It attests a signed observation - not that the site is safe.

<a href="https://domaindrift.io/t/cheapflights.com">
  <img src="https://domaindrift.io/badge/cheapflights.com.svg"
       width="300" height="64" alt="DomainDrift signed observations for cheapflights.com">
</a>

Ed25519 Receipt

Receipt ID: f0f6c3f9-55ae-4d38-a6c2-e118773d3d82
Output Hash: f7a18e67573feba48eeb9d20c63ffc2b6cc74e967b69599021e57fe4d692154c
Signature: ed25519:f3d1064076ad913782f7d4bbf5fe7526da9face38d2c6be5e0fa148a7db9c04576c89a246a13dd325878d47c2f6d30d57f61644cf1fa33897988a1ba585fd10c
Public Key: ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent: (genesis)
Plane: fast

Verify this in your browser

Permalink: https://domaindrift.io/t/cheapflights.com