CONTINUOUS INTERNET TELEMETRY24H DRIFT3,254 material changesacross 2,894 domains · -144 vs yesterdayDNS DRIFT21 domains changed DNS providertop destination cloudflare.com · -6 vs yesterdayEMAIL DRIFT4 domains switched email providertop destination reyrey.com · -2 vs yesterdayCERT DRIFT7 domains switched issuing CA24hNOW3,302 curated domains not answering-6,416 vs yesterdayERRORS10,967 responded with an errorlast probe · 5xx / 404 / 429 / 40324H DRIFT3,254 material changesacross 2,894 domains · -144 vs yesterdayDNS DRIFT21 domains changed DNS providertop destination cloudflare.com · -6 vs yesterdayEMAIL DRIFT4 domains switched email providertop destination reyrey.com · -2 vs yesterdayCERT DRIFT7 domains switched issuing CA24hNOW3,302 curated domains not answering-6,416 vs yesterdayERRORS10,967 responded with an errorlast probe · 5xx / 404 / 429 / 403

reference.com

Observed 2026-07-13T00:10:25.738254201+00:00 (9h ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onFastly
Email byProofpoint
Secured byLet's Encrypt
Also usesGoogle Search ConsoleFacebook/Meta
IPv6 · 1 subdomain · push_legacy
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat reference.com actually stands on - every host below is a signed observation
reference.com
A / AAAA
185.199.108.153185.199.111.153185.199.109.153185.199.110.153+4 more
Fastlyserves the site
NS
dns1.p03.nsone.netdns2.p03.nsone.netdns3.p03.nsone.netdns4.p03.nsone.net
nsone.netanswers its DNS
MX
mxa-0015af01.gslb.pphosted.commxb-0015af01.gslb.pphosted.com
Proofpointreceives its email
TLS
www.reference.com
Let's Encryptissued its certificate

DNS Records

A 4

  • 185.199.108.153
  • 185.199.111.153
  • 185.199.109.153
  • 185.199.110.153

AAAA 4

  • 2606:50c0:8002::153
  • 2606:50c0:8001::153
  • 2606:50c0:8000::153
  • 2606:50c0:8003::153

MX 2

  • 0mxa-0015af01.gslb.pphosted.com
  • 0mxb-0015af01.gslb.pphosted.com

TXT 7

  • v=spf1 redirect=ask.com
  • ms=ms24275044
  • google-site-verification=bnVDUQezVF3HHsm8M_zZc30ETcHbvQD27yYnT1eaZQk
  • _globalsign-domain-verification=ZlaZzwu0TA07KjmzBDYR4ZPfHFSZbKX5HfiTwBiGBB
  • facebook-domain-verification=lsre1s2c9d25anunhzhg1v420ucqg7
  • _globalsign-domain-verification=2wRqY6IrIINLY7B8Qcp-qur9HsiRTO04g4gwsMmFy3
  • google-site-verification=yCP56rQx9YJdQhsBr77Qm4B3BRbgimgzFE0PtI94uoQ

NS 4

  • dns1.p03.nsone.net
  • dns2.p03.nsone.net
  • dns3.p03.nsone.net
  • dns4.p03.nsone.net

SOA 1

  • dns1.p03.nsone.net hostmaster.nsone.net

TLS Certificates (3)

Common NameIssuerExpires
www.reference.com C=US, O=Let's Encrypt, CN=YR2 Thu, 01 Oct 2026 14:33:47 +0000
YR2 C=US, O=ISRG, CN=Root YR Sat, 02 Sep 2028 23:59:59 +0000
Root YR C=US, O=Internet Security Research Group, CN=ISRG Root X1 Thu, 02 Sep 2032 23:59:59 +0000

Subdomains (1)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for reference.com. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for reference.com <a href="https://domaindrift.io/t/reference.com"> <img src="https://domaindrift.io/badge/reference.com.svg" width="300" height="64" alt="DomainDrift signed observations for reference.com"> </a>

Ed25519 Receipt

Receipt ID
61420b65-c89b-46bb-9749-3bda8d6fc7e7
Output Hash
f8c3b2055fd296d3dbb9e268a5be393fea4a74851288c9900780ec79b7565d7d
Signature
ed25519:5c11b0f0aaa7542f1eff02b7c635e2e02ac59165b2155d723c123fa247552c6e9d70cd4c8c2a6742c4ff4912f89d82938abcb6cb243df05ee19ca02ec79b050c
Public Key
ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent
(genesis)
Plane
fast
Verify this in your browser