wf.com

Observed 2026-07-13T04:01:57.315Z (1d ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now

Runs onCloudflare

Email byProofpoint

Registered withMarkMonitor Inc.

Also usesFacebook/MetaGoogle Search Console

3 subdomains · tranco_20k

Every line above is a signed observation. Check the math at the bottom of the page.

INFRASTRUCTURE MAPwhat wf.com actually stands on - every host below is a signed observation

wf.com

A / AAAA

23.211.127.323.211.127.8

Cloudflareserves the site

a24-66.akam.netedns1.ultradns.orgedns1.ultradns.biza2-64.akam.net+3 more

akam.net + ultradns.org + moreanswers its DNS

mxb-00004003.gslb.pphosted.commxa-00004003.gslb.pphosted.com

Proofpointreceives its email

HTTPS probe

redirect Redirecting (3xx) 301 → https://www.wellsfargo.com/

HTTP status301

Servercloudflare

TLS protocolHTTP/2

TLS issuernot observed

Behind Cloudflareyes

Response time240 ms

DNS resolutionNOERROR

Redirect chain

https://www.wellsfargo.com/

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 2

23.211.127.3
23.211.127.8

MX 2

10mxb-00004003.gslb.pphosted.com
10mxa-00004003.gslb.pphosted.com

TXT 7

_m8f0q7wzm5uc5enovtzub1kh1074jvd
facebook-domain-verification=qviugnhv5wegwubbfdgrkfdt032dv8
v=spf1 include:_spf.wf.com include:spf-00004003.pphosted.com -all
_lnxn1fosoyvzu2ib6zc3nj9ri4c7g33
google-site-verification=9FJwe3vhOS0J7jHploaYV1iXsjCXCDORV7bmIbgSaGQ
MS=ms82778578
v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:tn1d3s4FQU@dmarc.inboxmonster.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:wellsfargo-dmarc@datafeeds.phishlabs.com;

NS 7

a24-66.akam.net
edns1.ultradns.org
edns1.ultradns.biz
a2-64.akam.net
edns1.ultradns.com
edns1.ultradns.net
a1-189.akam.net

SOA 1

edns1.ultradns.com hostmaster.wellsfargo.com

TLS Certificates (0)

None.

Subdomains (3)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for wf.com. It updates itself. It attests a signed observation - not that the site is safe.

<a href="https://domaindrift.io/t/wf.com">
  <img src="https://domaindrift.io/badge/wf.com.svg"
       width="300" height="64" alt="DomainDrift signed observations for wf.com">
</a>

Ed25519 Receipt

Receipt ID: 55e3e3d1-0fe1-4ff0-9467-51319dd61287
Output Hash: 56e0763d924e65c07d8d5070cb1b686bccde60f29710474ed84ed26926b66992
Signature: ed25519:f2f3d9422cbd8c88e9d669c6612d35d0afab7d9da216cc09fa52f39ab4b98da67a0e28ac937b8c2151aba7ab543802e001f59e6c4cf6e8c2c98dc4418ded3707
Public Key: ed25519:d610d74ef18f683e5beb859d241d5e67dff0c122e8928b06bec1c2476f4ba27b
Parent: (genesis)
Plane: fast

Verify this in your browser

Permalink: https://domaindrift.io/t/wf.com