CONTINUOUS INTERNET TELEMETRY24H DRIFT3,003 material changesacross 2,751 domains · +2,094 vs yesterdayDNS DRIFT193 domains changed DNS providertop destination parity.domains · +167 vs yesterdayEMAIL DRIFT38 domains switched email providertop destination google.com · +30 vs yesterdayCERT DRIFT74 domains switched issuing CA24h · +51 vs yesterdayNOW2,356 curated domains not answering-354 vs yesterdayERRORS22,849 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED91,151 throttled or blocked our scanner429 rate-limit / 403 bot-block

hrblock.com

Observed Jul 21, 2026, 19:39 UTC (9h ago). Every field below was attested with an Ed25519 signature at scan time. Catalog observation, re-checked on rotation — watch it for 5-minute checks.

Guarded by a firewall
Runs onMicrosoft Corporation
Email byMicrosoft 365
Secured bySectigo
Registered withMarkMonitor Inc.
Also usesGoogle Search ConsoleDockerHubSpotFigma
3 subdomains · push_legacy
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat hrblock.com actually stands on - every host below is a signed observation
hrblock.com
A / AAAA
20.98.176.55
Microsoft Corporationserves the site
NS
ns1-04.azure-dns.comns2-04.azure-dns.netns3-04.azure-dns.orgns4-04.azure-dns.info
azure-dns.com + azure-dns.net + moreanswers its DNS
MX
hrblock-com.mail.protection.outlook.com
Microsoft 365receives its email
TLS
origin4cdn-www.hrblock.com
Sectigo Limitedissued its certificate

DNS Records

A 1

  • 20.98.176.55

MX 1

  • 0hrblock-com.mail.protection.outlook.com

TXT 20

  • v=spf1 a mx ip4:20.84.177.68 ip4:20.84.177.70 ip4:35.80.141.6 ip4:44.229.121.55 ip4:168.137.102.64/28 ip4:168.137.32.20 ip4:168.137.72.32/28 ip4:68.232.145.0/28 ip4:66.231.92.253 ip4:13.110.14.208/28 ip4:208.185.229.0/24 ip4:23.21.109.197 ip4:147.160.167.0/26 ip4:208.185.235.0/24 ip4:148.59.108.0/23 ip4:148.59.106.0/23 ip4:148.59.100.16/28 ip4:168.137.64.0/27 ip4:168.137.64.32/28 include:spf.protection.outlook.com include:spfhost.messageprovider.com include:_spf.salesforce.com -all
  • apple-domain-verification=uWKqUpnzUVGDneYh
  • Dynatrace-site-verification=d5f1cd2a-4fd5-4e7a-84e1-f3dc9cd8f0e5__1udgokcegsbkhv8pk4trf7k2uk
  • apple-domain-verification=bUjK4j4pDkWAr_von1QII0mxfWaL8570jfLYUgiYppU
  • google-site-verification=aeZI60hcL3X1AlwL3mhGGDdHWtSlvTbpXqU4RLDUJz8
  • liveramp-site-verification=M4RoHs9ffjJYuCa6wrv3DKOOegDNUDtOIf46fQZ2acU
  • _sdoqggyavs2bcm251m1vbuonh0ypewh
  • google-site-verification=G1Ga4hwgwABo0Ig2kVZTkdZN8K1DQeR5FX8plgxu7DM
  • klaviyo-site-verification=VYaDL5
  • yahoo-verification-key=fC7lO0bTzZID8iy34MAK3/mrxIbcIvyog+01YINyJjM=

NS 4

  • ns1-04.azure-dns.com
  • ns2-04.azure-dns.net
  • ns3-04.azure-dns.org
  • ns4-04.azure-dns.info

SOA 1

  • ns1-04.azure-dns.com dnssupport.hrblock.com

SRV 2

  • eim.hrblock.com:5222 p5
  • eim.hrblock.com:5269 p5

TLS Certificates (4)

Common NameIssuerExpires
origin4cdn-www.hrblock.com C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA OV R36 Wed, 20 Jan 2027 23:59:59 +0000
Sectigo Public Server Authentication CA OV R36 C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication Root R46 Fri, 21 Mar 2036 23:59:59 +0000
Sectigo Public Server Authentication Root R46 C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority Mon, 18 Jan 2038 23:59:59 +0000
USERTrust RSA Certification Authority C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority Mon, 18 Jan 2038 23:59:59 +0000

Subdomains (3)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for hrblock.com. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for hrblock.com <a href="https://domaindrift.io/t/hrblock.com"> <img src="https://domaindrift.io/badge/hrblock.com.svg" width="300" height="64" alt="DomainDrift signed observations for hrblock.com"> </a>

Ed25519 Receipt

Receipt ID
rcpt_28ced72c2eb721bb
Output Hash
7ab28daeb5ddf73b9153626a0005d580276cb8d3da3afdc5b1937fd6e9abd9bb
Signature
ed25519:155abe5cca0016d2e7f9d50582c09ed621307780c8cd33ca12c1f67743b7802f77a71398e9b4518ce1b0cf74bd0281531724535c77c807d876cf88a9152d2b0f
Public Key
ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent
(genesis)
Plane
fast
Verify this in your browser