CONTINUOUS INTERNET TELEMETRY24H DRIFT1,079 material changesacross 883 domains · -999 vs yesterdayDNS DRIFT2 domains changed DNS providertop destination kirklanddc.com · -13 vs yesterdayNOW2,520 curated domains not answering+1,394 vs yesterdayERRORS16,935 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED43,140 throttled or blocked our scanner429 rate-limit / 403 bot-block24H DRIFT1,079 material changesacross 883 domains · -999 vs yesterdayDNS DRIFT2 domains changed DNS providertop destination kirklanddc.com · -13 vs yesterdayNOW2,520 curated domains not answering+1,394 vs yesterdayERRORS16,935 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED43,140 throttled or blocked our scanner429 rate-limit / 403 bot-block

thw.de

Observed Jul 19, 2026, 16:16 UTC (4h ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onCloudflare
Email bySalesforce
Also usesGoogle Search Console
95 subdomains · tranco_100k
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat thw.de actually stands on - every host below is a signed observation
thw.de
A / AAAA
80.245.145.123
Cloudflareserves the site
NS
dns14.netcologne.dedns13.netcologne.dedns12.netcologne.dedns11.netcologne.de
netcologne.deanswers its DNS
MX
mx2.bund.demx1.bund.de
Salesforcereceives its email

HTTPS probe

redirect Redirecting (3xx) 303 → /error_path/400.html?al_req_id=alz4d_A7C1gmpxDAof9D0QAAApE
HTTP status303
Servercloudflare
TLS protocolHTTP/2
TLS issuernot observed
Behind Cloudflareyes
Response time1244 ms
DNS resolutionNOERROR
Redirect chain
/error_path/400.html?al_req_id=alz4d_A7C1gmpxDAof9D0QAAApE

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 1

  • 80.245.145.123

MX 2

  • 10mx2.bund.de
  • 10mx1.bund.de

TXT 7

  • v=spf1 include:_spf1.bund.de ip4:81.173.209.69/32 ip4:91.24.7.70/32 ip4:91.26.2.6/32 include:_spf.salesforce.com include:spf.init.de include:databayhosting.de ~all
  • canva-site-verification=gPaVfNn_90bueVK2K8aWxg
  • google-site-verification=qsJXFb7bgS9m2wKv40EcRifxUfqsDJ_HNy29RDhSCfQ
  • cisco-ci-domain-verification=5c01719bcf78410e55d15bfeb65544da2dd25da7da1fd89d12764dd0f96df76b
  • apple-domain-verification=oh9Hyqyg81gWlzZq
  • 00D2X000000sFcp=1TBVi00000005fd
  • v=DMARC1; p=reject; rua=mailto:thw.de@dmarc.reports.bund.de;

NS 4

  • dns14.netcologne.de
  • dns13.netcologne.de
  • dns12.netcologne.de
  • dns11.netcologne.de

SOA 1

  • dns11.netcologne.de hostmaster.routing.net

TLS Certificates (0)

None.

Subdomains (95)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for thw.de. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for thw.de <a href="https://domaindrift.io/t/thw.de"> <img src="https://domaindrift.io/badge/thw.de.svg" width="300" height="64" alt="DomainDrift signed observations for thw.de"> </a>

Ed25519 Receipt

Receipt ID
dd48c5b7-482e-4104-9172-01468e2e6ba1
Output Hash
9dc84421d2048a7310a24069355fa8c3cdac87be510964cabf581851a237ec25
Signature
ed25519:995d92cbb82a82e5ba9c310ce7ffb440446e5502c056cebeb2ddd0608a128004c2d68ec23d7c97bbc23f500f183805190058fee29f5a4ddf3b33c939fee14008
Public Key
ed25519:7aad40f2d6399c207fe2fc15aade04a78324787a355d36725cc90687f9e10cff
Parent
(genesis)
Plane
fast
Verify this in your browser