CONTINUOUS INTERNET TELEMETRY24H3,987 material changesacross 3,224 domains · +12 vs yesterdayMOVES44 domains changed DNS providertop destination dns.br · +5 vs yesterdayMOVES13 domains switched email providertop destination mimecast.com · +1 vs yesterdayTLS12 domains switched issuing CA24h · -3 vs yesterdayNOW9,764 curated domains not answeringlast probe, steadyMOVERgov.brDNS provider changed: gov.br → dns.br24H3,987 material changesacross 3,224 domains · +12 vs yesterdayMOVES44 domains changed DNS providertop destination dns.br · +5 vs yesterdayMOVES13 domains switched email providertop destination mimecast.com · +1 vs yesterdayTLS12 domains switched issuing CA24h · -3 vs yesterdayNOW9,764 curated domains not answeringlast probe, steadyMOVERgov.brDNS provider changed: gov.br → dns.br

bremen.de

Observed 2026-07-05T17:08:32.979Z (6d ago). Every field below was attested with an Ed25519 signature at scan time.

INFRASTRUCTURE MAPwhat bremen.de actually stands on - every host below is a signed observation
bremen.de
A / AAAA
185.228.148.8
unattributedserves the site
NS
ns2.inwx.dens.inwx.dens3.inwx.eu
inwx.de + inwx.euanswers its DNS
MX
mail.cleanmail.eu
cleanmail.eureceives its email

HTTPS probe

redirect Redirecting (3xx) 301 → https://www.bremen.de/
HTTP status301
Servercloudflare
TLS protocolHTTP/2
TLS issuernot observed
Behind Cloudflareyes
Response time714 ms
DNS resolutionNOERROR
Redirect chain
https://www.bremen.de/

Every field above is part of the same signed observation as the records below. Blank means not observed, never "none".

DNS Records

A 1

  • 185.228.148.8

MX 1

  • 0mail.cleanmail.eu

TXT 9

  • v=spf1 ip4:194.95.254.0/23 ip4:195.37.102.0/23 ip4:193.168.236.0/22 ip4:83.145.109.0/24 ip4:94.186.185.248/29 ip4:94.186.131.0/24 ip4:185.228.148.7/32 ip4:185.228.148.8/32 ip6:2001:638:70f:10::/64 ip6:2a00:12d0:4001:200::/64 include:spfa.alinto.net include:mail.zendesk.com -all
  • v=DMARC1; p=quarantine; pct=100; adkim=r; aspf=r
  • zone-ownership-verification-61b22d31a9137844f91768acb3d42f4a96040f5fa10287593ce6d8764b578db0
  • D-TRUST=YOI46EJFMCKXKPOL2AZHDMF
  • D-TRUST=G8D3XYI95UBRILFGFSUI2QI
  • google-site-verification=Kv0OGJS4mGWNvb0gp3RJOl3Z1VQn5QPIjHPMz3rXTs0
  • v=spf1 ip4:194.95.254.0/23 ip4:193.168.236.0/23 ip4:195.37.102.0/22 ip4:94.186.185.248/29 ip4:94.186.131.0/24 ip4:185.228.148.7/32 ip4:185.228.148.8/32 ip6:2a00:12d0:4001::/48 ip6:2001:638:70f:10::/64 -all
  • v=spf1 ip4:194.95.254.0/23 ip4:193.168.236.0/23 ip4:195.37.102.0/22 ip4:94.186.185.248/29 ip4:94.186.131.0/24 ip4:185.228.148.7/32 ip4:185.228.148.8/32 ip6:2a00:12d0:4001::/48 ip6:2001:638:70f:10::/64 -all
  • v=DNSSEC1; (detected)

NS 3

  • ns2.inwx.de
  • ns.inwx.de
  • ns3.inwx.eu

SOA 1

  • ns.inwx.de hostmaster.inwx.de

CAA 8

  • issue harica.gr
  • issue digicert.com
  • issue pki.dfn.de
  • issue letsencrypt.org
  • issue pki.goog
  • issue d-trust.net
  • issue certum.pl
  • issue sectigo.com

TLS Certificates (0)

None.

Subdomains (194)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what Connor observes and signs for bremen.de. It updates itself. It attests a signed observation - not that the site is safe.

Connor signed-observation badge for bremen.de <a href="https://connor.dns.drm3.network/t/bremen.de"> <img src="https://connor.dns.drm3.network/badge/bremen.de.svg" width="300" height="64" alt="Connor signed observations for bremen.de"> </a>

Ed25519 Receipt

Receipt ID
2eb33e12-491f-4d60-9075-65ca7b16fb5d
Output Hash
df82bce9d78c093ca5a5fd81539587265befef0f059fb51f3d43d46bdb7402f0
Signature
ed25519:0f4a7f3446bde831fe35ce2e3b6282135e9c77a34475f2f57e7cd3528394d33bb1792c9d5c9bd8966810dfc0b0e2351863bd80453b87c6de96d19391e4f6a006
Public Key
ed25519:d610d74ef18f683e5beb859d241d5e67dff0c122e8928b06bec1c2476f4ba27b
Parent
(genesis)
Plane
fast
Verify this in your browser