CONTINUOUS INTERNET TELEMETRY24H DRIFT228 material changesacross 148 domains · +82 vs yesterdayEMAIL DRIFT1 domain switched email providertop destination xn----8sbafg9clhjcp.bgNOW4,697 curated domains not answering+363 vs yesterdayERRORS30,474 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED88,605 throttled or blocked our scanner429 rate-limit / 403 bot-blockMOVERgov.brNo nameservers in the latest observation24H DRIFT228 material changesacross 148 domains · +82 vs yesterdayEMAIL DRIFT1 domain switched email providertop destination xn----8sbafg9clhjcp.bgNOW4,697 curated domains not answering+363 vs yesterdayERRORS30,474 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED88,605 throttled or blocked our scanner429 rate-limit / 403 bot-blockMOVERgov.brNo nameservers in the latest observation

eham.net

Observed Jul 19, 2026, 08:12 UTC (2d ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onCloudflare
Email byGoogle (SPF sender)
IPv6 · 6 subdomains · tranco_100k
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat eham.net actually stands on - every host below is a signed observation
eham.net
A / AAAA
104.21.46.53172.67.223.2252606:4700:3031::6815:2e352606:4700:3032::ac43:dfe1
Cloudflareserves the site
NS
karina.ns.cloudflare.comjerome.ns.cloudflare.com
cloudflare.comanswers its DNS
MX
eham-net.p20.spamhero.neteham-net.p10.spamhero.comeham-net.p30.spamhero.neteham-net.p40.spamhero.net
Google (SPF sender)receives its email

HTTPS probe

redirect Redirecting (3xx) 302 → http://www.eham.net/
HTTP status302
Servercloudflare
TLS protocolHTTP/2
TLS issuernot observed
Behind Cloudflareyes
Response time56 ms
DNS resolutionNOERROR
Redirect chain
http://www.eham.net/

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 2

  • 104.21.46.53
  • 172.67.223.225

AAAA 2

  • 2606:4700:3031::6815:2e35
  • 2606:4700:3032::ac43:dfe1

MX 4

  • 20eham-net.p20.spamhero.net
  • 10eham-net.p10.spamhero.com
  • 30eham-net.p30.spamhero.net
  • 40eham-net.p40.spamhero.net

TXT 5

  • v=spf1 mx ip4:198.137.202.182/27 ip6:2607:7c80:54:10::/64 a:driftwood.eham.net include:spf.spamhero.com include:_spf.google.com ~all
  • brave-ledger-verification=fb6870d4001fdbc7bffb6b48487dfa12bd03add1a1680279f56cda5ec6730e71
  • v=DMARC1;p=quarantine;sp=quarantine;pct=100;adkim=r;aspf=r;ruf=mailto:webmaster@eham.net;ri=86400;fo=1; rua=mailto:e5bc770e90384a35bf6dce14af5c7391@dmarc-reports.cloudflare.net;
  • v=DKIM1; (detected)
  • v=DNSSEC1; (detected)

NS 2

  • karina.ns.cloudflare.com
  • jerome.ns.cloudflare.com

SOA 1

  • jerome.ns.cloudflare.com dns.cloudflare.com

TLS Certificates (0)

None.

Subdomains (6)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for eham.net. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for eham.net <a href="https://domaindrift.io/t/eham.net"> <img src="https://domaindrift.io/badge/eham.net.svg" width="300" height="64" alt="DomainDrift signed observations for eham.net"> </a>

Ed25519 Receipt

Receipt ID
db480a4f-dd2e-45ed-a34c-d4e59051bcc7
Output Hash
a694001a1de79a1244029c697c5bb1c460299006bb014bae77e7e7aa2a732082
Signature
ed25519:9f401d3881abe2a874971fb3744122efd04b6732c377ccfee7ca93d05e66f87e0aa654e9677661ef83967d4b8f4058bea7718cb8860173ace291503bb76c990f
Public Key
ed25519:7aad40f2d6399c207fe2fc15aade04a78324787a355d36725cc90687f9e10cff
Parent
(genesis)
Plane
fast
Verify this in your browser