CONTINUOUS INTERNET TELEMETRY24H DRIFT3,243 material changesacross 2,875 domains · -155 vs yesterdayDNS DRIFT23 domains changed DNS providertop destination cloudflare.com · -4 vs yesterdayEMAIL DRIFT5 domains switched email providertop destination 365cool.com · -1 vs yesterdayCERT DRIFT7 domains switched issuing CA24hNOW3,305 curated domains not answering-6,413 vs yesterdayERRORS10,964 responded with an errorlast probe · 5xx / 404 / 429 / 40324H DRIFT3,243 material changesacross 2,875 domains · -155 vs yesterdayDNS DRIFT23 domains changed DNS providertop destination cloudflare.com · -4 vs yesterdayEMAIL DRIFT5 domains switched email providertop destination 365cool.com · -1 vs yesterdayCERT DRIFT7 domains switched issuing CA24hNOW3,305 curated domains not answering-6,413 vs yesterdayERRORS10,964 responded with an errorlast probe · 5xx / 404 / 429 / 403

abnormalsecurity.com

Observed 2026-07-13T00:01:52.036957414+00:00 (8h ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onAmazon
Email byGoogle Workspace
Secured byLet's Encrypt
Registered withMarkMonitor Inc.
Also usesAtlassianDocuSignGoogle Search ConsoleLinearSlack
4 subdomains · security
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat abnormalsecurity.com actually stands on - every host below is a signed observation
abnormalsecurity.com
A / AAAA
64.239.109.1
Amazonserves the site
NS
ns-1122.awsdns-12.orgns-1693.awsdns-19.co.ukns-304.awsdns-38.comns-822.awsdns-38.net
awsdns-12.org + awsdns-19.co.uk + moreanswers its DNS
MX
aspmx.l.google.comalt3.aspmx.l.google.comalt4.aspmx.l.google.comalt1.aspmx.l.google.com+1 more
Google Workspacereceives its email
TLS
abnormalsecurity.com
Let's Encryptissued its certificate

DNS Records

A 1

  • 64.239.109.1

MX 5

  • 1aspmx.l.google.com
  • 10alt3.aspmx.l.google.com
  • 10alt4.aspmx.l.google.com
  • 5alt1.aspmx.l.google.com
  • 5alt2.aspmx.l.google.com

TXT 33

  • 3zgzmv1ny247t5p1fqwjwmp7dyk3d6yq
  • DA71B2D0FB
  • _5w1f76a8lbgg6gmtb7izyhiikv3bctm
  • _BpHwCvyhNvRQHPeVWOqAOIj
  • _u0z9vos3b8g24r58tbt7mywqopn6cu7
  • anthropic-domain-verification-5meyw1=EOP0UPELmiECTFXiRNAn9FPpB
  • atlassian-domain-verification=2tj9WF/F6QmZAox8ibD/9kzkbB8TDRn35MQQeMw/sDCtALpFFdwR5CVUTHcCzWTI
  • cursor-domain-verification-77xzqa=A3r20buuNOfBHDOYx4sqjdMbi
  • docusign=b0c8be6b-6eed-4974-b24e-5f41ba7adf7b
  • f28996a85469422095054b6fd35d0f26

NS 4

  • ns-1122.awsdns-12.org
  • ns-1693.awsdns-19.co.uk
  • ns-304.awsdns-38.com
  • ns-822.awsdns-38.net

SOA 1

  • ns-822.awsdns-38.net awsdns-hostmaster.amazon.com

CAA 4

  • issue "amazonaws.com"
  • issue "digicert.com"
  • issue "letsencrypt.org"
  • issue "pki.goog"

TLS Certificates (3)

Common NameIssuerExpires
abnormalsecurity.com C=US, O=Let's Encrypt, CN=YR2 Sun, 04 Oct 2026 14:51:31 +0000
YR2 C=US, O=ISRG, CN=Root YR Sat, 02 Sep 2028 23:59:59 +0000
Root YR C=US, O=Internet Security Research Group, CN=ISRG Root X1 Thu, 02 Sep 2032 23:59:59 +0000

Subdomains (4)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for abnormalsecurity.com. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for abnormalsecurity.com <a href="https://domaindrift.io/t/abnormalsecurity.com"> <img src="https://domaindrift.io/badge/abnormalsecurity.com.svg" width="300" height="64" alt="DomainDrift signed observations for abnormalsecurity.com"> </a>

Ed25519 Receipt

Receipt ID
a2779d12-d9ad-4cb4-9aff-210f94fcc405
Output Hash
87822e450e3c1cc3eadc5901e4d78a2c53c380feb1aafa63ca3c4f596dcad7f3
Signature
ed25519:bb1e2319db907a32ded3ae582180c00f902a59246cc993dba10d24b26f70850134de91a6b749a7446c40e8bdbc7fb698c9aeb478d1f02b08f9f376fee5f6c705
Public Key
ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent
(genesis)
Plane
fast
Verify this in your browser