CONTINUOUS INTERNET TELEMETRY24H DRIFT3,228 material changesacross 2,806 domains · -170 vs yesterdayDNS DRIFT23 domains changed DNS providertop destination digicertdns.com + digicertdns.net · -4 vs yesterdayEMAIL DRIFT5 domains switched email providertop destination 365cool.com · -1 vs yesterdayCERT DRIFT8 domains switched issuing CA24h · +1 vs yesterdayNOW3,308 curated domains not answering-6,410 vs yesterdayERRORS10,962 responded with an errorlast probe · 5xx / 404 / 429 / 40324H DRIFT3,228 material changesacross 2,806 domains · -170 vs yesterdayDNS DRIFT23 domains changed DNS providertop destination digicertdns.com + digicertdns.net · -4 vs yesterdayEMAIL DRIFT5 domains switched email providertop destination 365cool.com · -1 vs yesterdayCERT DRIFT8 domains switched issuing CA24h · +1 vs yesterdayNOW3,308 curated domains not answering-6,410 vs yesterdayERRORS10,962 responded with an errorlast probe · 5xx / 404 / 429 / 403

sherwin.com

Observed 2026-07-12T17:12:35.511Z (14h ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onCloudflare
Email bySalesforce
Also usesDocuSignGoogle Search ConsoleAtlassianDocker
10 subdomains · fortune_500
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat sherwin.com actually stands on - every host below is a signed observation
sherwin.com
A / AAAA
148.141.109.95
Cloudflareserves the site
NS
ns2.f5clouddns.comns1.f5clouddns.com
f5clouddns.comanswers its DNS
MX
emhost65.sherwin.comemhost64.sherwin.comemhost61.sherwin.comemhost60.sherwin.com+2 more
Salesforcereceives its email

HTTPS probe

redirect Redirecting (3xx) 301 → https://sherwin-williams.com/
HTTP status301
Servercloudflare
TLS protocolHTTP/2
TLS issuernot observed
Behind Cloudflareyes
Response time474 ms
DNS resolutionNOERROR
Redirect chain
https://sherwin-williams.com/

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 1

  • 148.141.109.95

MX 6

  • 20emhost65.sherwin.com
  • 10emhost64.sherwin.com
  • 10emhost61.sherwin.com
  • 10emhost60.sherwin.com
  • 10emhost63.sherwin.com
  • 10emhost62.sherwin.com

TXT 26

  • heyhack-verification=a78f94ac-708b-496a-a15d-e5ae1d7299e1
  • bkt4tgrfjpnvhxjgl6mbgg5sljt23qqb
  • _2ef9lcvgdevwkcutr5t9sexgla8oe48
  • docusign=2fbdd02f-eb36-4620-a1db-589c7978a9fb
  • logmein-verification-code=e724e312-cd4b-4c01-83d9-36a146a20cf8
  • docusign=75f9e9eb-078a-4845-a138-eba532f1ce8a
  • google-site-verification=6_pMJhKKkwldJwItpD0cfFbWWWsAtH4AcWmtlSiEmcY
  • adobe-idp-site-verification=4bc64d980a94ca6db7af8f75be428cc07bb51f0eb8464949d866648db67f45e9
  • atlassian-domain-verification=JFgKgxC4DeWPTwqCyaPPaL1ZR/uInkuoXKggViVucC4azzNr2DNuTouwYpxfXo9M
  • _pxzawj3nkclzjmurqdr7bfglhd6ws5v

NS 2

  • ns2.f5clouddns.com
  • ns1.f5clouddns.com

SOA 1

  • ns1.f5clouddns.com f5xc-dns.f5.com

CAA 5

  • issue entrust.net
  • issue entrust.net
  • issue letsencrypt.org
  • issue digicert.com
  • issue amazonaws.com

TLS Certificates (0)

None.

Subdomains (10)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for sherwin.com. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for sherwin.com <a href="https://domaindrift.io/t/sherwin.com"> <img src="https://domaindrift.io/badge/sherwin.com.svg" width="300" height="64" alt="DomainDrift signed observations for sherwin.com"> </a>

Ed25519 Receipt

Receipt ID
fa970016-b660-48b4-bc24-b9e8b8b180e3
Output Hash
ec5df85b8c9516f92507dc931f9a14cc873bb8ed6ea6e9a0e33d829b06ca8d46
Signature
ed25519:28e02670fdbc2b2e7730f78b459f65fa3616ed6cf67f357c0f6b7285f0773d46ec004ab368629fbd0d1544c1fe4fd99477d17b7e598e4ea2175ce4f45696c10f
Public Key
ed25519:d610d74ef18f683e5beb859d241d5e67dff0c122e8928b06bec1c2476f4ba27b
Parent
(genesis)
Plane
fast
Verify this in your browser