ref-sh.ch

Observed Aug 16, 2026, 07:26 UTC (1d ago). Every field below was attested with an Ed25519 signature at scan time.

This reading of ref-sh.ch was taken 1d ago

ref-sh.ch is on the survey sweep, which works its way across the whole catalog rather than returning to one name on a schedule. Putting ref-sh.ch under watch moves it to the fast lane, where DomainDrift re-checks it about every 5 minutes and signs each reading, so a change becomes a dated event within minutes instead of waiting for the sweep to come round.

Watch ref-sh.ch Watching a domain needs a DRM3 account. The reading above stays free and public either way.

Verify this receipt yourself + Watch this domain

Up right now

Email byMicrosoft 365

Secured byLet's Encrypt

Also usesGoogle Search Console

IPv6 · 1 subdomain · domcop

Every line above is a signed observation. Check the math at the bottom of the page.

DRIFT

Steady. No change on record for ref-sh.ch in the last day; this reading matches the one before it. The steady record is signed like every other reading. Watch it to catch the next move the moment it lands.

INFRASTRUCTURE MAPwhat ref-sh.ch actually stands on - every host below is a signed observation

ref-sh.ch

A / AAAA

45.131.254.2482001:1680:101:93::248

2001serves the site

ns2.kirchenweb.chns1.kirchenweb.chns3.kirchenweb.ch

kirchenweb.chanswers its DNS

kgvsh-ch.mail.protection.outlook.com

Microsoft 365receives its email

TLS

ref-sh.ch

Let's Encryptissued its certificate

DNS Records

A 1

45.131.254.248

AAAA 1

2001:1680:101:93::248

MX 1

0kgvsh-ch.mail.protection.outlook.com

TXT 4

v=spf1 a mx include:spf.kirchenweb.ch include:spf.mtfweb.ch include:_spf.bluewin.ch include:_spf.google.com include:spf.protection.outlook.com -all
google-site-verification=kHA2Qy-Pred0GcmgdY4M5AKSaZSi8Qet40yvhRfbwdw
MS=ms73149347
google-site-verification=6_1cwq7VChl1HKf1TMfeKIyQWiiScQUGbpN-96rr0bQ

NS 3

ns2.kirchenweb.ch
ns1.kirchenweb.ch
ns3.kirchenweb.ch

SOA 1

ns3.kirchenweb.ch support.kirchenweb.ch

MCP_RECORDS 1

v=spf1 -all

DMARC_RECORDS 1

v=spf1 -all

BIMI_RECORDS 1

v=spf1 -all

MTA_STS_RECORDS 1

v=spf1 -all

TLS Certificates (4)

Common Name	Issuer	Expires
`ref-sh.ch`	C=US, O=Let's Encrypt, CN=YR1	Sun, 18 Oct 2026 23:10:17 +0000
`ref-sh.ch`	C=US, O=Let's Encrypt, CN=YR1	Sun, 18 Oct 2026 23:10:17 +0000
`YR1`	C=US, O=ISRG, CN=Root YR	Sat, 02 Sep 2028 23:59:59 +0000
`Root YR`	C=US, O=Internet Security Research Group, CN=ISRG Root X1	Thu, 02 Sep 2032 23:59:59 +0000

Subdomains (1)

www.ref-sh.ch

WILDCARD DNSobserved 2026-08-17 07:27 UTC

DomainDrift asked this domain for one hostname that nobody ever registered, and it answered. A domain that answers invented hostnames is running wildcard DNS. It is common and usually deliberate. A SaaS platform gives every customer a subdomain this way. How the check works

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; the only network request the check makes is for the published public keys.

Verify this receipt

Ed25519 Receipt

Receipt ID: rcpt_af8983b673a344f8
Output Hash: e4299d3a1dc95f3cccb0dab1a359f79d812295cbc98081ae215c77097ac0fe60
Signature: ed25519:2122e10fec95880b0a04ca499450c63e9b02eda7a543d968eed29dea34b7bd84c2249717be368928883af28464612a19f1123a5c916c9f86f6a0fb0963635b0d
Public Key: ed25519:4859bb613d650e12dd7478cc307c73a8712fabc115a9dc59f65534ed3c09a8f9
Parent: (genesis)
Plane: fast

Verify this in your browser

Permalink: https://domaindrift.io/t/ref-sh.ch