paypal.com

Observed Jul 21, 2026, 19:09 UTC (2d ago). Every field below was attested with an Ed25519 signature at scan time. Catalog observation, re-checked on rotation — watch it for 5-minute checks.

Verify this receipt yourself + Watch this domain

Up right now

Runs onFastly

Email bySendGrid

Secured byDigiCert

Registered withMarkMonitor Inc.

Also usesDockerStripeAtlassian

3 subdomains · fintech

Every line above is a signed observation. Check the math at the bottom of the page.

INFRASTRUCTURE MAPwhat paypal.com actually stands on - every host below is a signed observation

paypal.com

A / AAAA

162.159.141.96151.101.3.1151.101.195.1

Fastlyserves the site

pdns100.ultradns.compdns100.ultradns.netns1-pchnet.paypal.comns2-pchnet.paypal.com

ultradns.com + ultradns.net + moreanswers its DNS

mx1.paypalcorp.commx2.paypalcorp.com

SendGridreceives its email

TLS

paypal.com

DigiCert Incissued its certificate

DNS Records

A 3

162.159.141.96
151.101.3.1
151.101.195.1

MX 2

10mx1.paypalcorp.com
10mx2.paypalcorp.com

TXT 14

MS=ms95960309
mgf84gx1cv1c759pmjqx0wnths9ss9f6
docker-verification=2deb3c1f-56d2-4fe4-8a09-d48b7bf8a918
workplace-domain-verification=F7ezsH9uapvYDGd2VtPARy1qq9ymN6
globalsign-domain-verification=KXa3jn_dNODlTVQ4eg1Wx3vA-RrHZ2K7iLQN0vdJBx
mgverify=e00c4bf7480ee22be851faa9acd20e41b8fd0f7b75b434bbe38aa257e5aae3a0
intersight=6d86ec09a7c6926c6f9b8eff8ef0ef06679d84aab4999756a0920a8d430ed8ae
Notion_verify_uVqjH2PpjVthR9xxfR5BZGsuYGtqb6Za4uDHPaA917v5Cg5J0rRwiATz84PWHZh8Px7vFK
stripe-verification=549bef27619f14f935a84c6a23492e80f49ff57a341d9ddc74d8486881cd0d8c
adobe-idp-site-verification=11600efbec96c0e73dd8820cd33ca906ec4302aea4487d208a42a2b01806144c

NS 4

pdns100.ultradns.com
pdns100.ultradns.net
ns1-pchnet.paypal.com
ns2-pchnet.paypal.com

SOA 1

ppdns.paypal.com hostmaster.paypal.com

SRV 1

xmpp.paypal.com:5269 p0

CAA 3

issue "digicert.com"
issue "quovadisglobal.com"
issue "visa.com"

TLS Certificates (3)

Common Name	Issuer	Expires
`paypal.com`	C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1	Wed, 25 Nov 2026 23:59:59 +0000
`DigiCert Global G2 TLS RSA SHA256 2020 CA1`	C=US, O=DigiCert Inc, 2.5.4.11=www.digicert.com, CN=DigiCert Global Root G2	Mon, 23 Sep 2030 23:59:59 +0000
`DigiCert Global Root G2`	C=US, O=DigiCert Inc, 2.5.4.11=www.digicert.com, CN=DigiCert Global Root CA	Sun, 09 Nov 2031 23:59:59 +0000

Subdomains (3)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for paypal.com. It updates itself. It attests a signed observation - not that the site is safe.

<a href="https://domaindrift.io/t/paypal.com">
  <img src="https://domaindrift.io/badge/paypal.com.svg"
       width="300" height="64" alt="DomainDrift signed observations for paypal.com">
</a>

Ed25519 Receipt

Receipt ID: rcpt_fff3a9b1ccf8b226
Output Hash: a0f7a0e5596a294df60b51c8ab4256fbe3453d4a9987dd7d74e935044625ec0f
Signature: ed25519:72f640932e03147bbf4c8edecd1901f3ec7099c9b342cc4b841b01add07e0064d142332b53169a1a52909a8e2824b8b0c8aea25503992f222549f4f5109c5b05
Public Key: ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent: (genesis)
Plane: fast

Verify this in your browser

Permalink: https://domaindrift.io/t/paypal.com