expressvpn.com

Observed Jul 24, 2026, 02:39 UTC (3h ago). Every field below was attested with an Ed25519 signature at scan time. Catalog observation, re-checked on rotation — watch it for 5-minute checks.

Verify this receipt yourself + Watch this domain

Up right now

Runs onAmazon

Email byGoogle Workspace

Secured byAmazon

Registered withSafeNames Ltd.

Also usesAtlassianGoogle Search Console

1 subdomain · security

Every line above is a signed observation. Check the math at the bottom of the page.

INFRASTRUCTURE MAPwhat expressvpn.com actually stands on - every host below is a signed observation

expressvpn.com

A / AAAA

3.170.3.303.170.3.593.170.3.243.170.3.78

Amazonserves the site

ns-1198.awsdns-21.orgns-1588.awsdns-06.co.ukns-373.awsdns-46.comns-910.awsdns-49.net

awsdns-21.org + awsdns-06.co.uk + moreanswers its DNS

aspmx.l.google.comaspmx2.googlemail.comaspmx3.googlemail.comalt1.aspmx.l.google.com+1 more

Google Workspacereceives its email

TLS

expressvpn.com

Amazonissued its certificate

DNS Records

A 4

3.170.3.30
3.170.3.59
3.170.3.24
3.170.3.78

MX 5

1aspmx.l.google.com
10aspmx2.googlemail.com
10aspmx3.googlemail.com
5alt1.aspmx.l.google.com
5alt2.aspmx.l.google.com

TXT 7

1s7j2dj658h9v9vap9mv83ppjd
ahrefs-site-verification_42735181f791498cb245b2f6716ab10ec9792d71d2c1cac28563917281a41108
atlassian-domain-verification=AsiGSJlMQ6GNhZSMVSyt+gEq2IClyv/rDtsdXhzMmSZIiDuo0RRTWrhkye/IRN9D
google-site-verification=XgDBqc3CuVr1hYjhN8btlzyPkDPMt0fZN3mAZCCZI1E
qsv8s0j2tkqt0dces3jms1ctcb
v=DMARC1; p=quarantine; rua=mailto:re+jwljp6xhmy8@dmarc.postmarkapp.com,mailto:postmaster@expressvpn.com;
v=BIMI1; l=https://vmc.digicert.com/4a5e35ce-9099-416f-8867-e649712e3cf1.svg; a=https://vmc.digicert.com/4a5e35ce-9099-416f-8867-e649712e3cf1.pem

NS 4

ns-1198.awsdns-21.org
ns-1588.awsdns-06.co.uk
ns-373.awsdns-46.com
ns-910.awsdns-49.net

SOA 1

ns-373.awsdns-46.com awsdns-hostmaster.amazon.com

CAA 13

issue "amazon.com"
issue "amazonaws.com"
issue "amazontrust.com"
issue "awstrust.com"
issue "comodo.com"
issue "comodoca.com"
issue "godaddy.com"
issue "pki.goog; cansignhttpexchanges=yes"
issuewild "amazon.com"
issuewild "amazonaws.com"

TLS Certificates (3)

Common Name	Issuer	Expires
`expressvpn.com`	C=US, O=Amazon, CN=Amazon RSA 2048 M01	Mon, 12 Oct 2026 23:59:59 +0000
`Amazon RSA 2048 M01`	C=US, O=Amazon, CN=Amazon Root CA 1	Fri, 23 Aug 2030 22:21:28 +0000
`Amazon Root CA 1`	C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Services Root Certificate Authority - G2	Thu, 31 Dec 2037 01:00:00 +0000

Subdomains (1)

www.expressvpn.com

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for expressvpn.com. It updates itself. It attests a signed observation - not that the site is safe.

<a href="https://domaindrift.io/t/expressvpn.com">
  <img src="https://domaindrift.io/badge/expressvpn.com.svg"
       width="300" height="64" alt="DomainDrift signed observations for expressvpn.com">
</a>

Ed25519 Receipt

Receipt ID: rcpt_cad857fd69d3bf27
Output Hash: cb71c0bf1d078423495fd8a3f2e59b3e231a179562d26c737967a595b1d0b74d
Signature: ed25519:bf8e57d8a47ebf36530463f2c4d8c1340b95509b0b550485b4027eae4dfcd33d54e581ff555efd4b37749ebfd62ff739be5fe10adad321a6109b248e43e65f01
Public Key: ed25519:4859bb613d650e12dd7478cc307c73a8712fabc115a9dc59f65534ed3c09a8f9
Parent: (genesis)
Plane: fast

Verify this in your browser

Permalink: https://domaindrift.io/t/expressvpn.com