CONTINUOUS INTERNET TELEMETRY24H DRIFT1,969 material changesacross 1,775 domains · -109 vs yesterdayDNS DRIFT16 domains changed DNS providertop destination alidns.com · +1 vs yesterdayEMAIL DRIFT8 domains switched email providertop destination google.comCERT DRIFT46 domains switched issuing CA24hNOW1,867 curated domains not answering+741 vs yesterdayERRORS13,402 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED35,757 throttled or blocked our scanner429 rate-limit / 403 bot-block24H DRIFT1,969 material changesacross 1,775 domains · -109 vs yesterdayDNS DRIFT16 domains changed DNS providertop destination alidns.com · +1 vs yesterdayEMAIL DRIFT8 domains switched email providertop destination google.comCERT DRIFT46 domains switched issuing CA24hNOW1,867 curated domains not answering+741 vs yesterdayERRORS13,402 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED35,757 throttled or blocked our scanner429 rate-limit / 403 bot-block

hotelplanner.com

Observed Jul 18, 2026, 13:32 UTC (19h ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onCloudflare
Email byZendesk
Registered withGoDaddy.com, LLC
Also usesGoogle Search ConsoleAtlassian
IPv6 · 95 subdomains · tranco_40k
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat hotelplanner.com actually stands on - every host below is a signed observation
hotelplanner.com
A / AAAA
104.16.160.115104.16.161.1152606:4700::6810:a0732606:4700::6810:a173
Cloudflareserves the site
NS
osmar.ns.cloudflare.comlovisa.ns.cloudflare.com
cloudflare.comanswers its DNS
MX
me3.cfdynamics.comme2.cfdynamics.comsmtp.hotelplanner.comme.cfdynamics.com
Zendeskreceives its email

HTTPS probe

redirect Redirecting (3xx) 301 → https://www.hotelplanner.com
HTTP status301
Servercloudflare
TLS protocolHTTP/2
TLS issuernot observed
Behind Cloudflareyes
Response time122 ms
DNS resolutionNOERROR
Redirect chain
https://www.hotelplanner.com
MCP This domain advertises an AI service endpoint at _mcp._tcp.
v=spf1 ip4:216.223.188.0/24 ip4:216.117.4.0/24 ip4:216.117.5.0/24 ip4:3.230.214.68/32 ip4:3.213.114.62/32 ip4:52.23.43.58/32 ip4:54.163.145.215/32 ip4:54.166.2.11/32 ip4:52.204.91.137/32 a mx include:mail.zendesk.com ~all

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 2

  • 104.16.160.115
  • 104.16.161.115

AAAA 2

  • 2606:4700::6810:a073
  • 2606:4700::6810:a173

MX 4

  • 20me3.cfdynamics.com
  • 20me2.cfdynamics.com
  • 10smtp.hotelplanner.com
  • 10me.cfdynamics.com

TXT 9

  • MS=ms34035730
  • ca3-5eb08ee37ab546de857e79bd0b54ab58
  • google-site-verification=yMTL6TIvoaEbd3QnGNMyznEgboe2Rd9s3vKSo_H_Eeo
  • atlassian-domain-verification=v40dOsNUndSvfn3bHOsl0y4D00GL3nnBpMd2aoPBr8aJCx625VCw5aVjaEN/e2Vk
  • v=spf1 ip4:216.223.188.0/24 ip4:216.117.4.0/24 ip4:216.117.5.0/24 ip4:3.230.214.68/32 ip4:3.213.114.62/32 ip4:52.23.43.58/32 ip4:54.163.145.215/32 ip4:54.166.2.11/32 ip4:52.204.91.137/32 a mx include:mail.zendesk.com ~all
  • 6z2xd1y9x9rd8yph3mvjzx6fw5w1l31w
  • v=DMARC1; p=none; pct=100; rua=mailto:re+lndggoqyqqb@dmarc.postmarkapp.com; sp=none; aspf=r;
  • v=DKIM1; (detected)
  • v=spf1 ip4:216.223.188.0/24 ip4:216.117.4.0/24 ip4:216.117.5.0/24 ip4:3.230.214.68/32 ip4:3.213.114.62/32 ip4:52.23.43.58/32 ip4:54.163.145.215/32 ip4:54.166.2.11/32 ip4:52.204.91.137/32 a mx include:mail.zendesk.com ~all

NS 2

  • osmar.ns.cloudflare.com
  • lovisa.ns.cloudflare.com

SOA 1

  • lovisa.ns.cloudflare.com dns.cloudflare.com

CAA 15

  • issuewild globalsign.com
  • issuewild amazon.com
  • issue pki.goog; cansignhttpexchanges=yes
  • 0 iodef "\"mailto:report-abuse@globalsign.com\""
  • issue globalsign.com
  • issuewild digicert.com; cansignhttpexchanges=yes
  • issuewild letsencrypt.org
  • issue letsencrypt.org
  • issue digicert.com; cansignhttpexchanges=yes
  • issuewild pki.goog; cansignhttpexchanges=yes

TLS Certificates (0)

None.

Subdomains (95)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for hotelplanner.com. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for hotelplanner.com <a href="https://domaindrift.io/t/hotelplanner.com"> <img src="https://domaindrift.io/badge/hotelplanner.com.svg" width="300" height="64" alt="DomainDrift signed observations for hotelplanner.com"> </a>

Ed25519 Receipt

Receipt ID
ff7277fc-4a8a-439d-ab28-41b1fd8f8045
Output Hash
4c8331ae65bc2562dcc61286a60c7948836051338bd743a885336adfd571de67
Signature
ed25519:f6770b4f1687dd50b477efe9e705ae86b9d2a36a4bcee7acfc27583f6dfedcb20e654dd57a47f4b9b4aef6debafb5d9056d50ef57baea972678e2bec868d940a
Public Key
ed25519:7aad40f2d6399c207fe2fc15aade04a78324787a355d36725cc90687f9e10cff
Parent
(genesis)
Plane
fast
Verify this in your browser