CONTINUOUS INTERNET TELEMETRY24H3,398 material changesacross 2,935 domains · -449 vs yesterdayMOVES27 domains changed DNS providertop destination brainydns.com · -11 vs yesterdayMOVES6 domains switched email providertop destination 365cool.com · -3 vs yesterdayTLS7 domains switched issuing CA24h · -3 vs yesterdayNOW9,718 curated domains not answeringlast probe, steady24H3,398 material changesacross 2,935 domains · -449 vs yesterdayMOVES27 domains changed DNS providertop destination brainydns.com · -11 vs yesterdayMOVES6 domains switched email providertop destination 365cool.com · -3 vs yesterdayTLS7 domains switched issuing CA24h · -3 vs yesterdayNOW9,718 curated domains not answeringlast probe, steady

globalwitness.org

Observed 2026-07-12T12:03:21.112Z (12h ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onCloudflare
Email byMicrosoft 365
Also usesGoogle Search Console
IPv6 · 13 subdomains · tranco_40k
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat globalwitness.org actually stands on - every host below is a signed observation
globalwitness.org
A / AAAA
172.66.135.199172.66.139.1622606:4700:10::ac42:87c72606:4700:10::ac42:8ba2
Cloudflareserves the site
NS
reza.ns.cloudflare.comaragorn.ns.cloudflare.com
cloudflare.comanswers its DNS
MX
globalwitness-org.mail.protection.outlook.com
Microsoft 365receives its email

HTTPS probe

redirect Redirecting (3xx) 302 → /en/
HTTP status302
Servercloudflare
TLS protocolHTTP/3
TLS issuernot observed
Behind Cloudflareyes
Response time682 ms
DNS resolutionNOERROR
Redirect chain
/en/

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 2

  • 172.66.135.199
  • 172.66.139.162

AAAA 2

  • 2606:4700:10::ac42:87c7
  • 2606:4700:10::ac42:8ba2

MX 1

  • 0globalwitness-org.mail.protection.outlook.com

TXT 13

  • v=spf1 include:spf.protection.outlook.com mx:in.mx.trendmicro.eu include:spf.hes.trendmicro.com include:_spf.e-activist.com include:amazonses.com include:_spf.salesforce.com ~all
  • _globalsign-domain-verification=40yTTfd1cO167Ehgsg5xEM_PMhnKykeMHTdbj2M2m0
  • apple-domain-verification=1qFZUkHsBxjCjRFg
  • google-site-verification=MnNrYrgAv6gP8aBVr9Aa88sQaDvJjVDRpRulR8LtlRQ
  • MS=BB82B97A53F593D93CB680DE486BF1477F23F9C9
  • MS=AA86ABA989BC7412555CEF783E7344B9FF612F74
  • MS=15E633756B4A30D46E44227443CFEF2684AD1CED
  • Security code/TXT record: <11/13/2020>
  • MS=A0A490B14853235FABDC032E1BAFFBDCD7D48A4F
  • RVVWFK1IYMFQWEVI3LE5XDPP0QQK5V3Z8A19AP3V

NS 2

  • reza.ns.cloudflare.com
  • aragorn.ns.cloudflare.com

SOA 1

  • aragorn.ns.cloudflare.com dns.cloudflare.com

TLS Certificates (0)

None.

Subdomains (13)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what Connor observes and signs for globalwitness.org. It updates itself. It attests a signed observation - not that the site is safe.

Connor signed-observation badge for globalwitness.org <a href="https://domaindrift.io/t/globalwitness.org"> <img src="https://domaindrift.io/badge/globalwitness.org.svg" width="300" height="64" alt="Connor signed observations for globalwitness.org"> </a>

Ed25519 Receipt

Receipt ID
23dfa0c4-a7ca-4b1d-900d-c5ebcb3147fa
Output Hash
063fede95aae664f813e40eed5c306d1755cf8c4404c4cdf978a20b044ad6a86
Signature
ed25519:7511d072f3ba83f4a43c0300bf8d535dc119b4e8c8819441d52f346af5daa36d28aa4b8cc36f205a85492b05bff5dcc8635de5c20a9f8659f92e707894497502
Public Key
ed25519:d610d74ef18f683e5beb859d241d5e67dff0c122e8928b06bec1c2476f4ba27b
Parent
(genesis)
Plane
fast
Verify this in your browser