CONTINUOUS INTERNET TELEMETRY24H DRIFT2,235 material changesacross 2,035 domains · +276 vs yesterdayDNS DRIFT19 domains changed DNS providertop destination cloudflare.comEMAIL DRIFT8 domains switched email providertop destination outlook.com · +5 vs yesterdayNOW5,290 curated domains not answering+1,861 vs yesterdayERRORS8,524 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED2,335 throttled or blocked our scanner429 rate-limit / 403 bot-block24H DRIFT2,235 material changesacross 2,035 domains · +276 vs yesterdayDNS DRIFT19 domains changed DNS providertop destination cloudflare.comEMAIL DRIFT8 domains switched email providertop destination outlook.com · +5 vs yesterdayNOW5,290 curated domains not answering+1,861 vs yesterdayERRORS8,524 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED2,335 throttled or blocked our scanner429 rate-limit / 403 bot-block

legit.security

Observed 2026-07-13T19:51:52.002Z (2d ago). Every field below was attested with an Ed25519 signature at scan time.

Not responding
Runs onTucows.com
96 subdomains · cybersecurity_expanded
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat legit.security actually stands on - every host below is a signed observation
legit.security
A / AAAA
216.40.34.41
Tucows.comserves the site
NS
ns2.hover.comns1.hover.com
hover.comanswers its DNS
MX
mx.hover.com.cust.hostedemail.com
hostedemail.comreceives its email

HTTPS probe

timeout No response within the timeout Connection timed out - no response within 3s
HTTP status0
Servernot observed
TLS protocolnot observed
TLS issuernot observed
Behind Cloudflareno
Response time6200 ms
DNS resolutionNOERROR

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 1

  • 216.40.34.41

MX 1

  • 10mx.hover.com.cust.hostedemail.com

NS 2

  • ns2.hover.com
  • ns1.hover.com

SOA 1

  • ns1.hover.com dnsmaster.hover.com

TLS Certificates (0)

None.

Subdomains (96)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for legit.security. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for legit.security <a href="https://domaindrift.io/t/legit.security"> <img src="https://domaindrift.io/badge/legit.security.svg" width="300" height="64" alt="DomainDrift signed observations for legit.security"> </a>

Ed25519 Receipt

Receipt ID
d0114241-310f-4c17-a259-adfe36f6ecba
Output Hash
ec5688eb23d0209f86bc3f73ac95c5ee3ad73ff3974a39a3076096f09339cae9
Signature
ed25519:870726cd2920d884afcd14588df81325d88177b2bfb2cc663da201468902b322e7a553a8e7467c3c56369a52afb20e1d1e9c68244ec5bde16c5d828cdcd57d08
Public Key
ed25519:d610d74ef18f683e5beb859d241d5e67dff0c122e8928b06bec1c2476f4ba27b
Parent
(genesis)
Plane
fast
Verify this in your browser