shadowserver.org

Observed 2026-07-14T09:39:54.334Z (3h ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now

Runs onCloudflare

Registered withGoDaddy.com, LLC

Also usesGoogle Search Console

15 subdomains · tranco_20k

Every line above is a signed observation. Check the math at the bottom of the page.

INFRASTRUCTURE MAPwhat shadowserver.org actually stands on - every host below is a signed observation

shadowserver.org

A / AAAA

103.41.71.79

Cloudflareserves the site

ns2.shadowserver.orgns3.shadowserver.orgns1.shadowserver.org

shadowserver.organswers its DNS

mx2.shadowserver.orgmail.shadowserver.org

shadowserver.orgreceives its email

HTTPS probe

redirect Redirecting (3xx) 301 → https://www.shadowserver.org/

HTTP status301

Servercloudflare

TLS protocolHTTP/2

TLS issuernot observed

Behind Cloudflareyes

Response time27 ms

DNS resolutionNOERROR

Redirect chain

https://www.shadowserver.org/

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 1

103.41.71.79

MX 2

20mx2.shadowserver.org
10mail.shadowserver.org

TXT 6

google-site-verification=tiVxSpYg2xBbmxJY9KRvIqRhw4CN6v-Tw9cU5V04gJ4
v=spf1 ip4:154.9.2.12 ip4:65.49.51.50 ~all
v=DMARC1; p=quarantine; rua=mailto:dmarc@shadowserver.org; ruf=mailto:dmarc-stats@shadowserver.org; pct=100
MS=67DB28A53B2115CEBD50B67E69C7B086BDAFB8DA
v=DMARC1; p=quarantine; rua=mailto:dmarc@shadowserver.org; ruf=mailto:dmarc-stats@shadowserver.org; pct=100
v=STSv1; id=20250903001

NS 3

ns2.shadowserver.org
ns3.shadowserver.org
ns1.shadowserver.org

SOA 1

ns1.shadowserver.org root.shadowserver.org

TLS Certificates (0)

None.

Subdomains (15)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for shadowserver.org. It updates itself. It attests a signed observation - not that the site is safe.

<a href="https://domaindrift.io/t/shadowserver.org">
  <img src="https://domaindrift.io/badge/shadowserver.org.svg"
       width="300" height="64" alt="DomainDrift signed observations for shadowserver.org">
</a>

Ed25519 Receipt

Receipt ID: e87fa8ac-5088-43ef-b306-0c1752d2ba30
Output Hash: f31ea96f14aa65e15d7ce38b97861cfc3ca589a26c06b99717c107ef86ad752f
Signature: ed25519:d530bb570b0c40c226da6f2d94b55a21a5924357bf96b20b575d682b40043394be306c2ba9224ca19df2a814041c7664ba66973f995103126c6b9f2c9c664c0e
Public Key: ed25519:d610d74ef18f683e5beb859d241d5e67dff0c122e8928b06bec1c2476f4ba27b
Parent: (genesis)
Plane: fast

Verify this in your browser

Permalink: https://domaindrift.io/t/shadowserver.org