cursor.sh

Observed Jul 21, 2026, 19:59 UTC (15h ago). Every field below was attested with an Ed25519 signature at scan time. Catalog observation, re-checked on rotation — watch it for 5-minute checks.

Verify this receipt yourself + Watch this domain

Up right now

Runs onAmazon

Email byGoogle Workspace

Secured byLet's Encrypt

Also usesGoogle Search Console

tranco_1k

Every line above is a signed observation. Check the math at the bottom of the page.

INFRASTRUCTURE MAPwhat cursor.sh actually stands on - every host below is a signed observation

cursor.sh

A / AAAA

76.76.21.21

Amazonserves the site

ns-1143.awsdns-14.orgns-1554.awsdns-02.co.ukns-70.awsdns-08.comns-896.awsdns-48.net

awsdns-14.org + awsdns-02.co.uk + moreanswers its DNS

aspmx.l.google.comalt3.aspmx.l.google.comalt4.aspmx.l.google.comalt1.aspmx.l.google.com+1 more

Google Workspacereceives its email

TLS

cursor.sh

Let's Encryptissued its certificate

DNS Records

A 1

76.76.21.21

MX 5

1aspmx.l.google.com
10alt3.aspmx.l.google.com
10alt4.aspmx.l.google.com
5alt1.aspmx.l.google.com
5alt2.aspmx.l.google.com

TXT 4

cursor-domain-verification-2kmn02=aJPOd4v8HEjWIWV6sZETbdiaJ
google-site-verification=C1TncBZ0C00dMCHHosS_vTyRPM02dJCJsKN2zkcfFZ0
v=spf1 include:_spf.google.com ~all
v=DMARC1; p=none; rua=mailto:dmarc_agg@vali.email;

NS 4

ns-1143.awsdns-14.org
ns-1554.awsdns-02.co.uk
ns-70.awsdns-08.com
ns-896.awsdns-48.net

SOA 1

ns-1143.awsdns-14.org awsdns-hostmaster.amazon.com

TLS Certificates (3)

Common Name	Issuer	Expires
`cursor.sh`	C=US, O=Let's Encrypt, CN=YR1	Mon, 21 Sep 2026 03:03:46 +0000
`YR1`	C=US, O=ISRG, CN=Root YR	Sat, 02 Sep 2028 23:59:59 +0000
`Root YR`	C=US, O=Internet Security Research Group, CN=ISRG Root X1	Thu, 02 Sep 2032 23:59:59 +0000

Subdomains (0)

None observed.

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for cursor.sh. It updates itself. It attests a signed observation - not that the site is safe.

<a href="https://domaindrift.io/t/cursor.sh">
  <img src="https://domaindrift.io/badge/cursor.sh.svg"
       width="300" height="64" alt="DomainDrift signed observations for cursor.sh">
</a>

Ed25519 Receipt

Receipt ID: rcpt_8355f9d6becd386a
Output Hash: c9af20ca91a7f90fe78ef29e68a048648da9dfff72576bd68438bbc8ccfdaf90
Signature: ed25519:47876d82deaa71cd682c43f98095bd04b1099cd789eae85799180a64b580c83f658a76a2ba724876549943d4f6f7f0cda25e146018aee8c938dfe87a02355208
Public Key: ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent: (genesis)
Plane: fast

Verify this in your browser

Permalink: https://domaindrift.io/t/cursor.sh