threatlocker.com

Observed 2026-07-18T05:38:23.649Z (3h ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now

Runs onCloudflare

Email byMicrosoft 365

Registered withNameCheap, Inc.

Also usesAtlassianHubSpot

IPv6 · 7 subdomains · tranco_5k

Every line above is a signed observation. Check the math at the bottom of the page.

INFRASTRUCTURE MAPwhat threatlocker.com actually stands on - every host below is a signed observation

threatlocker.com

A / AAAA

198.202.211.12620:cb:2000::1

Cloudflareserves the site

ns-1108.awsdns-10.orgns-524.awsdns-01.netns-153.awsdns-19.comns-1706.awsdns-21.co.uk

awsdns-10.org + awsdns-01.net + moreanswers its DNS

threatlocker-com.mail.protection.outlook.com

Microsoft 365receives its email

HTTPS probe

redirect Redirecting (3xx) 301 → https://www.threatlocker.com/

HTTP status301

Servercloudflare

TLS protocolHTTP/3

TLS issuernot observed

Behind Cloudflareyes

Response time199 ms

DNS resolutionNOERROR

Redirect chain

https://www.threatlocker.com/

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 1

198.202.211.1

AAAA 1

2620:cb:2000::1

MX 1

0threatlocker-com.mail.protection.outlook.com

TXT 4

atlassian-domain-verification=ARPb4rcy7KSqAUpJ2UGs3NfmJiUnCH6fFlG9PtA6G0AYzXKwhPzFe9abZFP5TTMm ~all
v=spf1 ip4:18.226.172.21 include:spf.protection.outlook.com include:docebosaas.com include:3949713.spf04.hubspotemail.net include:sendgrid.net include:cvent-planner.com -all
v=DMARC1; p=reject; rua=mailto:dmarc@threatlocker.com; ruf=mailto:dmarc@threatlocker.com; sp=reject;
v=DKIM1; (detected)

NS 4

ns-1108.awsdns-10.org
ns-524.awsdns-01.net
ns-153.awsdns-19.com
ns-1706.awsdns-21.co.uk

SOA 1

ns-153.awsdns-19.com awsdns-hostmaster.amazon.com

TLS Certificates (0)

None.

Subdomains (7)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for threatlocker.com. It updates itself. It attests a signed observation - not that the site is safe.

<a href="https://domaindrift.io/t/threatlocker.com">
  <img src="https://domaindrift.io/badge/threatlocker.com.svg"
       width="300" height="64" alt="DomainDrift signed observations for threatlocker.com">
</a>

Ed25519 Receipt

Receipt ID: bd3480d5-1cc0-422c-a41c-6cde4512cc16
Output Hash: 59c15cfb4a736e04800518d208b3fdc064f4c9fe826e8f11e8c9bca5fb2cc8e0
Signature: ed25519:394913ce72f8238c8c80bd2b7793dc8e4da8e7e62c3377014cab69de1763a3bb69f44d6499fdc7e6c616b48a7a893bba46df46f1d39820d003237c873eb62a06
Public Key: ed25519:7aad40f2d6399c207fe2fc15aade04a78324787a355d36725cc90687f9e10cff
Parent: (genesis)
Plane: fast

Verify this in your browser

Permalink: https://domaindrift.io/t/threatlocker.com