CONTINUOUS INTERNET TELEMETRY24H DRIFT3,243 material changesacross 2,868 domains · -155 vs yesterdayDNS DRIFT23 domains changed DNS providertop destination cloudflare.com · -4 vs yesterdayEMAIL DRIFT5 domains switched email providertop destination 365cool.com · -1 vs yesterdayCERT DRIFT7 domains switched issuing CA24hNOW3,306 curated domains not answering-6,412 vs yesterdayERRORS10,964 responded with an errorlast probe · 5xx / 404 / 429 / 40324H DRIFT3,243 material changesacross 2,868 domains · -155 vs yesterdayDNS DRIFT23 domains changed DNS providertop destination cloudflare.com · -4 vs yesterdayEMAIL DRIFT5 domains switched email providertop destination 365cool.com · -1 vs yesterdayCERT DRIFT7 domains switched issuing CA24hNOW3,306 curated domains not answering-6,412 vs yesterdayERRORS10,964 responded with an errorlast probe · 5xx / 404 / 429 / 403

rf.gd

Observed 2026-07-13T05:11:52.034Z (3h ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onCloudflare
Also usesGoogle Search Console
88 subdomains · tranco_20k
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat rf.gd actually stands on - every host below is a signed observation
rf.gd
A / AAAA
31.22.4.234
Cloudflareserves the site
NS
ns1.rf.gdns5.byet.orgns2.byet.orgns1.byet.org+3 more
rf.gd + byet.organswers its DNS
MX
sv62.ifastnet11.org
ifastnet11.orgreceives its email

HTTPS probe

ok Responding normally (2xx) 200 OK
HTTP status200
Servercloudflare
TLS protocolHTTP/2
TLS issuernot observed
Behind Cloudflareyes
Response time614 ms
DNS resolutionNOERROR

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 1

  • 31.22.4.234

MX 1

  • 10sv62.ifastnet11.org

TXT 1

  • google-site-verification=bzpldra_k1onajwemu1kldgqnr-p9koma5rum30rhho

NS 7

  • ns1.rf.gd
  • ns5.byet.org
  • ns2.byet.org
  • ns1.byet.org
  • ns2.rf.gd
  • ns4.byet.org
  • ns3.byet.org

SOA 1

  • ns1.rf.gd support.rf.gd

CAA 20

  • issue buypass.com
  • issue trust-provider.com
  • issue microsoft.com
  • issue usertrust.com
  • issue globalsign.com
  • issue swisssign.com
  • issue sectigo.com
  • issue digicert.com
  • issue certum.pl
  • issue identrust.com

TLS Certificates (0)

None.

Subdomains (88)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for rf.gd. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for rf.gd <a href="https://domaindrift.io/t/rf.gd"> <img src="https://domaindrift.io/badge/rf.gd.svg" width="300" height="64" alt="DomainDrift signed observations for rf.gd"> </a>

Ed25519 Receipt

Receipt ID
0b758c0e-6da6-42ba-89bc-087223cd8c4a
Output Hash
2f93db0072ab0c2c424df8f892284203d0c172a424299e1e930210450b1af0d7
Signature
ed25519:654a2b51cfd87c647b9cb7e6f7a185da9fb37abf7bf8d315b3a0a13dbd51737dee5b5e9c34bc419ee8c9c3167da688f0fcff2fc4063a43a40721f753b87ce20c
Public Key
ed25519:d610d74ef18f683e5beb859d241d5e67dff0c122e8928b06bec1c2476f4ba27b
Parent
(genesis)
Plane
fast
Verify this in your browser