CONTINUOUS INTERNET TELEMETRY24H DRIFT8,098 material changesacross 7,784 domainsDNS DRIFT580 domains changed DNS providertop destination parity.domainsEMAIL DRIFT110 domains switched email providertop destination google.comCERT DRIFT182 domains switched issuing CA24hNOW1,631 curated domains not reachable-1,079 vs yesterdaySITE ERRORS20,605 sites serving errorslast probe · 5xx / 404 / TLSTHROTTLED93,370 throttled or blocked our scanner429 rate-limit / 403 bot-block

figma.com

Observed Jul 21, 2026, 19:08 UTC (21h ago). Every field below was attested with an Ed25519 signature at scan time. Catalog observation, re-checked on rotation — watch it for 5-minute checks.

Up right now
Email byGoogle Workspace
Secured byAmazon
Registered withAmazon Registrar, Inc.
Also uses1PasswordZoomAtlassianDocuSignFigmaGoogle Search ConsoleLinearNotion
dev_tools
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat figma.com actually stands on - every host below is a signed observation
figma.com
A / AAAA
18.160.41.12718.160.41.1018.160.41.8418.160.41.23
unattributedserves the site
NS
ns-1239.awsdns-26.orgns-1657.awsdns-15.co.ukns-326.awsdns-40.comns-912.awsdns-50.net
awsdns-26.org + awsdns-15.co.uk + moreanswers its DNS
MX
aspmx.l.google.comaspmx2.googlemail.comaspmx3.googlemail.comalt1.aspmx.l.google.com+1 more
Google Workspacereceives its email
TLS
*.figma.com
Amazonissued its certificate

DNS Records

A 4

  • 18.160.41.127
  • 18.160.41.10
  • 18.160.41.84
  • 18.160.41.23

MX 5

  • 1aspmx.l.google.com
  • 10aspmx2.googlemail.com
  • 10aspmx3.googlemail.com
  • 5alt1.aspmx.l.google.com
  • 5alt2.aspmx.l.google.com

TXT 44

  • 1password-site-verification=LUTCLEML6JDMHACYUXWAJAOV74
  • MS=ms23440957
  • MS=ms46247837
  • ZOOM_verify_vCQSjij2TCG8TawaqXfiMQ
  • adobe-idp-site-verification=8761b40fa7a309149c45c025ecf2d2eea8fb4ecb489194cce3e2efede17c781e
  • anthropic-domain-verification-4rt01s=L6y4AArUwEXaF4KxpmWGKAKXI
  • apple-domain-verification=1IOgJXKcT9knvlrK
  • atlassian-domain-verification=oDxpYa6fakpgoavsUf0n1AppTm13MnKzy2d01eAF1xtr9jA58AKXqtjU68cCkFtJ
  • bzagy7hkzg
  • cursor-domain-verification-cvxp0h=ZYVC7GrCWXWBT8QrWSy3lnmoH

NS 4

  • ns-1239.awsdns-26.org
  • ns-1657.awsdns-15.co.uk
  • ns-326.awsdns-40.com
  • ns-912.awsdns-50.net

SOA 1

  • ns-1657.awsdns-15.co.uk awsdns-hostmaster.amazon.com

CAA 4

  • iodef "mailto:security@figma.com"
  • issue "amazonaws.com"
  • issue "letsencrypt.org"
  • issue "pki.goog; cansignhttpexchanges=yes"

TLS Certificates (3)

Common NameIssuerExpires
*.figma.com C=US, O=Amazon, CN=Amazon RSA 2048 M04 Wed, 03 Feb 2027 23:59:59 +0000
Amazon RSA 2048 M04 C=US, O=Amazon, CN=Amazon Root CA 1 Fri, 23 Aug 2030 22:26:35 +0000
Amazon Root CA 1 C=US, ST=Arizona, L=Scottsdale, O=Starfield Technologies, Inc., CN=Starfield Services Root Certificate Authority - G2 Thu, 31 Dec 2037 01:00:00 +0000

Subdomains (0)

None observed.

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for figma.com. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for figma.com <a href="https://domaindrift.io/t/figma.com"> <img src="https://domaindrift.io/badge/figma.com.svg" width="300" height="64" alt="DomainDrift signed observations for figma.com"> </a>

Ed25519 Receipt

Receipt ID
rcpt_beb40be5ebd41144
Output Hash
a64bec6d0979418e8fe905f69659de9f3f6a54cca4e8cfefdc35b482da3a6578
Signature
ed25519:d09bc10df2eda65e525cab9d9dbb392a05dcf01e76e32592902917c4e10295f6f0ef79496dfb1cc5872f8d05a8e7e611502dbe58cb691d784a40350188fdd803
Public Key
ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent
(genesis)
Plane
fast
Verify this in your browser