CONTINUOUS INTERNET TELEMETRY24H DRIFT154 material changesacross 106 domains · +8 vs yesterdayEMAIL DRIFT1 domain switched email providertop destination xn----8sbafg9clhjcp.bgCERT DRIFT1 domains switched issuing CA24hNOW4,351 curated domains not answeringlast probe, steadyERRORS28,433 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED85,471 throttled or blocked our scanner429 rate-limit / 403 bot-blockMOVERgov.brAll nameservers removed (domain is dark)24H DRIFT154 material changesacross 106 domains · +8 vs yesterdayEMAIL DRIFT1 domain switched email providertop destination xn----8sbafg9clhjcp.bgCERT DRIFT1 domains switched issuing CA24hNOW4,351 curated domains not answeringlast probe, steadyERRORS28,433 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED85,471 throttled or blocked our scanner429 rate-limit / 403 bot-blockMOVERgov.brAll nameservers removed (domain is dark)

southwest.com

Observed Jul 18, 2026, 12:09 UTC (3d ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onSouthwest Airlines
Secured byIdenTrust
Registered withMarkMonitor Inc.
Also usesFacebook/Meta
1 subdomain · fortune_500
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat southwest.com actually stands on - every host below is a signed observation
southwest.com
A / AAAA
66.150.1.229208.94.155.99
Southwest Airlinesserves the site
NS
ns-w21.southwest.comns-w11.southwest.com
southwest.comanswers its DNS
MX
mail02.wnco.comoutgoing.wnco.com
wnco.comreceives its email
TLS
www.southwest.com
IdenTrustissued its certificate

DNS Records

A 2

  • 66.150.1.229
  • 208.94.155.99

MX 2

  • 10mail02.wnco.com
  • 10outgoing.wnco.com

TXT 11

  • facebook-domain-verification=5tg9b0fpw4l87zy4ga4hqxzrgjnbu7
  • tsktdktn7wq710fh3lqrrx391kfjwv0y
  • apple-domain-verification=AVqb7df_lh4ZY0IFN-xHTHCQfzRorhFBV0YJIEi3dMk
  • klaviyo-site-verification=TvuiSP
  • identrust_validate=BvULH7j+tFTCcJxzas5YCHn9MFM82G99zGdJ3Nx7OIJy
  • _4euyjhh2akthszptxyklufk2g4nm1jj
  • identrust_validate=fXNA1Qb3CuyBMtCOpRZyaKbIaisaX1CBZMlJX+K8Q2KE
  • _xpn3qn98olo03xr8hj4zxmc12tab31i
  • v=spf1 include:luv.southwest.com include:spf.messagelabs.com include:cmail1.com include:amadeus.com ~all
  • pardot886213=5f9176871506272b28c41f1ddffd6a99f50aae6f7c1540d03a7e4474746e820f

NS 2

  • ns-w21.southwest.com
  • ns-w11.southwest.com

SOA 1

  • sdcscadnsgmavip.swacorp.com domainrequest.wnco.com

TLS Certificates (3)

Common NameIssuerExpires
www.southwest.com C=US, O=IdenTrust, 2.5.4.11=HydrantID Trusted Certificate Service, CN=HydrantID Server CA O1 Fri, 15 Jan 2027 15:01:11 +0000
HydrantID Server CA O1 C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1 Wed, 12 Dec 2029 16:56:15 +0000
IdenTrust Commercial Root CA 1 C=US, O=IdenTrust, CN=IdenTrust Commercial Root CA 1 Mon, 16 Jan 2034 18:12:23 +0000

Subdomains (1)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for southwest.com. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for southwest.com <a href="https://domaindrift.io/t/southwest.com"> <img src="https://domaindrift.io/badge/southwest.com.svg" width="300" height="64" alt="DomainDrift signed observations for southwest.com"> </a>

Ed25519 Receipt

Receipt ID
7f897451-6de4-47a7-845a-9214a4a3f28d
Output Hash
38e41161399bdbb11eb692f27986966875bc9735be309c30b4dd669a9e601d31
Signature
ed25519:4077a1e61de24d7692849b181677549404e8486379bca7776d9203407ab65a51fe01b0509bb984d4c97ce51288c4f722ce3c18c18e825075f0f8fad821294205
Public Key
ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent
(genesis)
Plane
fast
Verify this in your browser