CONTINUOUS INTERNET TELEMETRY24H DRIFT2,514 material changesacross 2,285 domains · -884 vs yesterdayDNS DRIFT16 domains changed DNS providertop destination cloudflare.com · -11 vs yesterdayEMAIL DRIFT5 domains switched email providertop destination google.com · -1 vs yesterdayCERT DRIFT5 domains switched issuing CA24h · -2 vs yesterdayNOW3,327 curated domains not answering-6,391 vs yesterdayERRORS10,916 responded with an errorlast probe · 5xx / 404 / 429 / 40324H DRIFT2,514 material changesacross 2,285 domains · -884 vs yesterdayDNS DRIFT16 domains changed DNS providertop destination cloudflare.com · -11 vs yesterdayEMAIL DRIFT5 domains switched email providertop destination google.com · -1 vs yesterdayCERT DRIFT5 domains switched issuing CA24h · -2 vs yesterdayNOW3,327 curated domains not answering-6,391 vs yesterdayERRORS10,916 responded with an errorlast probe · 5xx / 404 / 429 / 403

runbox.com

Observed 2026-07-13T10:06:25.778Z (13h ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onCloudflare
Registered witheNom, LLC
Also usesGoogle Search Console
96 subdomains · tranco_40k
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat runbox.com actually stands on - every host below is a signed observation
runbox.com
A / AAAA
185.226.149.25
Cloudflareserves the site
NS
dns62.copyleft.nodns63.copyleft.nodns61.copyleft.no
copyleft.noanswers its DNS
MX
mx.runbox.com
runbox.comreceives its email

HTTPS probe

ok Responding normally (2xx) 200 OK
HTTP status200
Servercloudflare
TLS protocolHTTP/2
TLS issuernot observed
Behind Cloudflareyes
Response time2865 ms
DNS resolutionNOERROR

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 1

  • 185.226.149.25

MX 1

  • 10mx.runbox.com

TXT 5

  • v=spf1 include:spf.runbox.com -all
  • google-site-verification=fcQSXdsUMQ8FBKgOgrsTP2TvSnXN974zsfz5J63wQVg
  • v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@runbox.com
  • v=STSv1; id=20190605;
  • v=DNSSEC1; (detected)

NS 3

  • dns62.copyleft.no
  • dns63.copyleft.no
  • dns61.copyleft.no

SOA 1

  • dns61.copyleft.no hostmaster.copyleft.no

CAA 4

  • iodef mailto:hostmaster@runbox.com
  • issuewild letsencrypt.org
  • issue letsencrypt.org
  • issue buypass.no

TLS Certificates (0)

None.

Subdomains (96)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for runbox.com. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for runbox.com <a href="https://domaindrift.io/t/runbox.com"> <img src="https://domaindrift.io/badge/runbox.com.svg" width="300" height="64" alt="DomainDrift signed observations for runbox.com"> </a>

Ed25519 Receipt

Receipt ID
b0c39608-a58d-449f-977f-ea7845762930
Output Hash
d8040c3a88714444000c86fc509d3849699e8cdc1fad43d89a7ec48cdd4c1e4e
Signature
ed25519:b03effbfadce483645b8162ab13d38de298a4ce282153794cef528491dc53798f930651897e48a3d2cc3e934147516488e062099e83feebb1abda7d56cf9fc0f
Public Key
ed25519:d610d74ef18f683e5beb859d241d5e67dff0c122e8928b06bec1c2476f4ba27b
Parent
(genesis)
Plane
fast
Verify this in your browser