CONTINUOUS INTERNET TELEMETRY24H DRIFT10,799 material changesacross 10,422 domains · +170 vs yesterdayDNS DRIFT788 domains changed DNS providertop destination parity.domains · +8 vs yesterdayEMAIL DRIFT172 domains switched email providertop destination google.com · +2 vs yesterdayCERT DRIFT220 domains switched issuing CA24h · -10 vs yesterdayNOW1,195 curated domains not reachable-154 vs yesterdaySITE ERRORS19,212 sites serving errorslast probe · 5xx / 404 / TLSTHROTTLED95,098 throttled or blocked our scanner429 rate-limit / 403 bot-block

sofi.com

Observed Jul 21, 2026, 19:09 UTC (1d ago). Every field below was attested with an Ed25519 signature at scan time. Catalog observation, re-checked on rotation — watch it for 5-minute checks.

Guarded by a firewall
Runs onCloudflare
Email byProofpoint
Secured byGoDaddy.com
Registered withGoDaddy.com, LLC
Also usesAtlassianDocuSignFacebook/MetaGoogle Search ConsoleSlackStripe
fintech
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat sofi.com actually stands on - every host below is a signed observation
sofi.com
A / AAAA
104.18.38.31172.64.149.225
Cloudflareserves the site
NS
george.ns.cloudflare.commarge.ns.cloudflare.com
cloudflare.comanswers its DNS
MX
mxa-003a4d01.gslb.pphosted.commxb-003a4d01.gslb.pphosted.com
Proofpointreceives its email
TLS
*.sofi.com
GoDaddy.comissued its certificate

DNS Records

A 2

  • 104.18.38.31
  • 172.64.149.225

MX 2

  • 10mxa-003a4d01.gslb.pphosted.com
  • 10mxb-003a4d01.gslb.pphosted.com

TXT 20

  • MS=ms72326802
  • _ih4yod5o7l1kscwc50sk9oy050jdxs5
  • apple-domain-verification=ouhb31SBg5PFvK7k
  • atlassian-domain-verification=Xu3U8fgrZvV7cVL3aObOTHZ4jAgYERrdVdotEZcSHb4GoXGUfFgrb9X+t1felzxw
  • docusign=86828977-0d4b-4c5a-9db4-64e25ab3421d
  • dropbox-domain-verification=ryxchpphz3fd
  • facebook-domain-verification=3ik6lghf0741hcq51f1j1pwvww3i9r
  • finicity_partner_id:2445582695895
  • google-site-verification=463FQ-VU8mmpU42X6cV3B_XdKvoJ55BWyr4i8pyyI0A
  • google-site-verification=zV0MVDMvQbr7oB7izWsSqZcffe2U2OVWNSRIAPUZEME

NS 2

  • george.ns.cloudflare.com
  • marge.ns.cloudflare.com

SOA 1

  • george.ns.cloudflare.com dns.cloudflare.com

CAA 9

  • issue "amazon.com"
  • issue "globalsign.com"
  • issue "godaddy.com"
  • issue "letsencrypt.org"
  • issue "pki.goog"
  • issuewild "amazon.com"
  • issuewild "globalsign.com"
  • issuewild "godaddy.com"
  • issuewild "pki.goog"

TLS Certificates (3)

Common NameIssuerExpires
*.sofi.com C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., 2.5.4.11=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2 Tue, 08 Dec 2026 23:40:23 +0000
Go Daddy Secure Certificate Authority - G2 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certificate Authority - G2 Sat, 03 May 2031 07:00:00 +0000
Go Daddy Root Certificate Authority - G2 C=US, O=The Go Daddy Group, Inc., 2.5.4.11=Go Daddy Class 2 Certification Authority Fri, 30 May 2031 07:00:00 +0000

Subdomains (0)

None observed.

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for sofi.com. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for sofi.com <a href="https://domaindrift.io/t/sofi.com"> <img src="https://domaindrift.io/badge/sofi.com.svg" width="300" height="64" alt="DomainDrift signed observations for sofi.com"> </a>

Ed25519 Receipt

Receipt ID
rcpt_1a9a9575f2cde2a5
Output Hash
1145ffeff41df2305b68545ea2e57a40b950a4b31a98bb548abe2245b9a62032
Signature
ed25519:b226ed5d8e5fd49ec92ea5dd789c8b22d51a8638c5ceeb3cd381eb80f52ed8c0145ea721ecc559c33690392dfd83c07024ae64827a28b32de07177ab7d2f5d05
Public Key
ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent
(genesis)
Plane
fast
Verify this in your browser