CONTINUOUS INTERNET TELEMETRY24H DRIFT666 material changesacross 568 domains · -1,412 vs yesterdayDNS DRIFT2 domains changed DNS providertop destination kirklanddc.com · -13 vs yesterdayCERT DRIFT2 domains switched issuing CA24h · -44 vs yesterdayNOW2,804 curated domains not answering+1,678 vs yesterdayERRORS18,530 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED48,450 throttled or blocked our scanner429 rate-limit / 403 bot-block24H DRIFT666 material changesacross 568 domains · -1,412 vs yesterdayDNS DRIFT2 domains changed DNS providertop destination kirklanddc.com · -13 vs yesterdayCERT DRIFT2 domains switched issuing CA24h · -44 vs yesterdayNOW2,804 curated domains not answering+1,678 vs yesterdayERRORS18,530 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED48,450 throttled or blocked our scanner429 rate-limit / 403 bot-block

who.int

Observed Jul 18, 2026, 12:02 UTC (2d ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onCloudflare
Email byMicrosoft 365
Secured byGoogle Trust Services
Also usesZoomDocuSignAtlassian
institutions
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat who.int actually stands on - every host below is a signed observation
who.int
A / AAAA
192.133.11.1
Cloudflareserves the site
NS
ext-dns-2.cern.chns1.wpro.who.intwhqdns3.who.intwhqdns2.who.int+1 more
cern.ch + who.intanswers its DNS
MX
who-int.mail.protection.outlook.com
Microsoft 365receives its email
TLS
who.int
Google Trust Servicesissued its certificate

DNS Records

A 1

  • 192.133.11.1

MX 1

  • 10who-int.mail.protection.outlook.com

TXT 12

  • ca3-5fc9c6c655cf481e9d53b30866a6e690
  • ZOOM_verify_bTI318yfSumXtVIVnfEdzQ
  • ciscocidomainverification=17f32bae2ea200dbca5879cd0dc89294b7e78220da17554d099fed05e3f7e8f4
  • docusign=c346709c-41f2-43fd-8a5a-cf7992d6e560
  • MS=ms38766037
  • apple-domain-verification=cYOp0B6FuXeoDFAX
  • atlassian-domain-verification=UxKawy8Zm9aw6Yg8NrPBUbu9anpgfXtL2NS3L7DNt0MGYKfhw/WOXGuRCTcQMKqi
  • docusign=9f72d1bd-efd7-4a97-b385-83d687978e8d
  • google-gws-recovery-domain-verification=44731192
  • v=spf1 ip4:158.232.12.0/24 include:spf.protection.outlook.com include:_spfincludes.who.int -all

NS 5

  • ext-dns-2.cern.ch
  • ns1.wpro.who.int
  • whqdns3.who.int
  • whqdns2.who.int
  • whqdns1.who.int

SOA 1

  • whqdns1.who.int hostmaster.who.int

SRV 5

  • vcse-1.who.int:5060 p1
  • vcse-2.who.int:5060 p1
  • vcse-2.who.int:5061 p1
  • vcse-1.who.int:5061 p1
  • xmpp.who.int:5269 p5

CAA 8

  • issue "letsencrypt.org"
  • issue "pki.goog"
  • issuewild "sectigo.com"
  • issuewild "letsencrypt.org"
  • issue "sectigo.com"
  • issue "digicert.com"
  • issue "awstrust.com"
  • issue "godaddy.com"

TLS Certificates (3)

Common NameIssuerExpires
who.int C=US, O=Google Trust Services, CN=WE1 Mon, 31 Aug 2026 15:21:57 +0000
WE1 C=US, O=Google Trust Services LLC, CN=GTS Root R4 Tue, 20 Feb 2029 14:00:00 +0000
GTS Root R4 C=BE, O=GlobalSign nv-sa, 2.5.4.11=Root CA, CN=GlobalSign Root CA Fri, 28 Jan 2028 00:00:42 +0000

Subdomains (0)

None observed.

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for who.int. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for who.int <a href="https://domaindrift.io/t/who.int"> <img src="https://domaindrift.io/badge/who.int.svg" width="300" height="64" alt="DomainDrift signed observations for who.int"> </a>

Ed25519 Receipt

Receipt ID
53815963-a51d-4a57-9556-3d7e76fd90d2
Output Hash
fba608d025fbbbc58261553b5c516d59ae6a60851f807e8bef79c0f47847c894
Signature
ed25519:3cbee500ad84ee0e3345490b9d3cb5affb02ccbb9bdf2da1a3a650a666f6b03c4cc6773cdd4bc2c20253f34595a42d1cc17688eadc4a2221bcbe3bf3bef7ba0f
Public Key
ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent
(genesis)
Plane
fast
Verify this in your browser