IP Address
IPv4
149.111.166.210
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of 149.111.166.210
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
ASN
AS10879
Unitedhealthcare
Country
US
United States
Reverse DNS
healthsafeid-hcc-elr.optum.com
PTR
Open Ports
67
Last scan
Autonomous System
ASN
AS Name
Unitedhealthcare
AS Type
—
RIR
ARIN
Allocated
1997-12-17
Allocation status
Allocated
Geolocation
Reverse DNS
Last seen
2026-07-28 19:25:19
Network
Prefix
RPKI
—
Open Ports
| Port | Proto | Service | Server | Last seen |
|---|---|---|---|---|
| 13 | tcp | — | — | 2026-07-16 02:42:48.000 |
| 20 | tcp | ftp-data | — | 2026-07-18 01:18:33.000 |
| 43 | tcp | — | — | 2026-07-19 12:08:50.000 |
| 111 | tcp | — | — | 2026-06-16 09:13:59.000 |
| 119 | tcp | nntp | — | 2026-07-27 10:29:18.000 |
| 143 | tcp | imap | — | 2026-05-27 04:11:00.000 |
| 177 | tcp | — | — | 2026-06-23 08:40:37.000 |
| 389 | tcp | ldap | — | 2026-06-21 13:52:48.000 |
| 443 | tcp | https | — | 2026-06-22 07:33:23.000 |
| 513 | tcp | — | — | 2026-06-17 00:53:49.000 |
| 587 | tcp | smtp-submission | — | 2026-06-17 00:20:04.000 |
| 666 | tcp | — | — | 2026-07-27 09:31:46.000 |
| 749 | tcp | — | — | 2026-07-25 04:00:46.000 |
| 1100 | tcp | — | — | 2026-06-07 17:02:39.000 |
| 1110 | tcp | — | — | 2026-07-23 18:34:32.000 |
| 1214 | tcp | — | — | 2026-06-17 00:40:45.000 |
| 1311 | tcp | — | — | 2026-07-19 01:01:51.000 |
| 1352 | tcp | — | — | 2026-07-27 05:43:54.000 |
| 1812 | tcp | radius | — | 2026-07-23 03:39:14.000 |
| 1863 | tcp | — | — | 2026-07-20 09:28:24.000 |
| 1900 | tcp | — | — | 2026-06-20 11:29:47.000 |
| 2086 | tcp | — | — | 2026-06-23 15:37:27.000 |
| 2095 | tcp | — | — | 2026-06-22 06:31:31.000 |
| 2222 | tcp | ssh-alt | — | 2026-06-07 19:22:53.000 |
| 2404 | tcp | iec-104 | — | 2026-06-17 13:21:27.000 |
| 2484 | tcp | — | — | 2026-07-18 06:55:20.000 |
| 2638 | tcp | — | — | 2026-07-19 05:19:03.000 |
| 2701 | tcp | — | — | 2026-07-20 16:24:38.000 |
| 2967 | tcp | — | — | 2026-06-17 09:20:11.000 |
| 3269 | tcp | — | — | 2026-06-19 12:51:57.000 |
| 3389 | tcp | rdp | — | 2026-07-17 17:16:17.000 |
| 4040 | tcp | — | — | 2026-07-28 06:39:35.000 |
| 4321 | tcp | — | — | 2026-07-28 07:06:00.000 |
| 5000 | tcp | — | — | 2026-06-07 03:56:59.000 |
| 5002 | tcp | — | — | 2026-07-28 19:24:52.000 |
| 5009 | tcp | — | — | 2026-07-27 04:34:00.000 |
| 5353 | tcp | — | — | 2026-06-15 01:59:21.000 |
| 5802 | tcp | — | — | 2026-07-22 00:06:30.000 |
| 5985 | tcp | winrm-http | — | 2026-06-23 22:01:59.000 |
| 5986 | tcp | winrm-https | — | 2026-06-23 02:28:56.000 |
| 6662 | tcp | — | — | 2026-07-16 20:28:40.000 |
| 7070 | tcp | — | — | 2026-07-16 01:21:39.000 |
| 7100 | tcp | — | — | 2026-07-20 12:31:43.000 |
| 8009 | tcp | — | — | 2026-07-16 12:04:58.000 |
| 8080 | tcp | http-proxy | — | 2026-05-26 13:04:26.000 |
| 8087 | tcp | — | — | 2026-06-07 17:40:51.000 |
| 8090 | tcp | — | — | 2026-07-25 01:28:24.000 |
| 8443 | tcp | https-alt | — | 2026-07-16 10:54:37.000 |
| 8444 | tcp | — | — | 2026-06-07 02:25:17.000 |
| 8500 | tcp | consul | — | 2026-07-23 02:08:31.000 |
| 8883 | tcp | — | — | 2026-07-20 20:35:37.000 |
| 9043 | tcp | — | — | 2026-06-07 18:41:40.000 |
| 9300 | tcp | elasticsearch-tcp | — | 2026-06-22 23:30:20.000 |
| 9418 | tcp | git | — | 2026-06-06 07:07:22.000 |
| 9595 | tcp | — | — | 2026-07-20 13:25:24.000 |
| 9999 | tcp | — | — | 2026-06-20 08:18:23.000 |
| 10000 | tcp | — | — | 2026-06-07 01:09:39.000 |
| 15672 | tcp | — | — | 2026-06-23 17:04:49.000 |
| 16080 | tcp | — | — | 2026-07-24 01:12:09.000 |
| 16389 | tcp | — | — | 2026-07-23 22:58:25.000 |
| 20547 | tcp | — | — | 2026-07-25 08:06:55.000 |
| 21025 | tcp | — | — | 2026-06-15 21:49:49.000 |
| 28017 | tcp | — | — | 2026-07-28 05:34:44.000 |
| 32768 | tcp | — | — | 2026-07-25 10:55:55.000 |
| 49152 | tcp | — | — | 2026-07-17 20:26:49.000 |
| 49153 | tcp | — | — | 2026-07-21 11:58:30.000 |
| 57772 | tcp | — | — | 2026-07-25 16:49:42.000 |
TLS Certificates
Port 443
8d86ddd21769…
Subject: healthsafeid-hcc.optum.com
Issuer: Sectigo Public Server Authentication CA OV R36
SANs: accounts.myhealthcareview.com, accounts.myuhc.com, accounts.yourdentalplan.com, healthsafe-id.com, healthsafeid-ctc.optum.com, healthsafeid-hcc-ctc.optum.com, healthsafeid-hcc-elr.optum.com, healthsafeid-hcc.optum.com, healthsafeid.liveandworkwell.com, healthsafeid.myaarphsa.com, healthsafeid.optum.com, healthsafeid.optumbank.com, healthsafeid.optumfinancial.com, healthsafeid.uhchealthaccounts.com, healthsafeid.uhcretireeaccounts.com, hsid11.optum.com, www.healthsafe-id.com
Valid 2025-08-04 00:00:00 → 2026-08-04 23:59:59
Tech Stack
Wappalyzer fingerprinting pending
HTTP-body analysis identifies web frameworks, CMS platforms, analytics, JS libraries and server-side languages from this host.
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
uhcretireeaccounts.com
95% confidence
behind AS16509 cert 8d86ddd21769… · cert 8d86ddd2… served by 149.111.166.210 (AS10879) carries SAN healthsafeid.uhcretireeaccounts.com which currently resolves through Amazon (AS16509) at 18.239.36.27, 18.239.36.54, 18.239.36.57, 18.239.36.3
yourdentalplan.com
95% confidence
behind AS16509 cert 8d86ddd21769… · cert 8d86ddd2… served by 149.111.166.210 (AS10879) carries SAN accounts.yourdentalplan.com which currently resolves through Amazon (AS16509) at 18.239.36.27, 18.239.36.54, 18.239.36.57, 18.239.36.3
myuhc.com
95% confidence
behind AS16509 cert 8d86ddd21769… · cert 8d86ddd2… served by 149.111.166.210 (AS10879) carries SAN accounts.myuhc.com which currently resolves through Amazon (AS16509) at 18.239.36.27, 18.239.36.54, 18.239.36.57, 18.239.36.3
liveandworkwell.com
95% confidence
behind AS16509 cert 8d86ddd21769… · cert 8d86ddd2… served by 149.111.166.210 (AS10879) carries SAN healthsafeid.liveandworkwell.com which currently resolves through Amazon (AS16509) at 18.239.36.27, 18.239.36.54, 18.239.36.57, 18.239.36.3
optum.com
95% confidence
behind AS16509 cert 8d86ddd21769… · cert 8d86ddd2… served by 149.111.166.210 (AS10879) carries SAN hsid11.optum.com which currently resolves through Amazon (AS16509) at 18.239.36.27, 18.239.36.54, 18.239.36.57, 18.239.36.3
optumfinancial.com
95% confidence
behind AS16509 cert 8d86ddd21769… · cert 8d86ddd2… served by 149.111.166.210 (AS10879) carries SAN healthsafeid.optumfinancial.com which currently resolves through Amazon (AS16509) at 18.239.36.27, 18.239.36.54, 18.239.36.57, 18.239.36.3
myhealthcareview.com
95% confidence
behind AS16509 cert 8d86ddd21769… · cert 8d86ddd2… served by 149.111.166.210 (AS10879) carries SAN accounts.myhealthcareview.com which currently resolves through Amazon (AS16509) at 18.239.36.27, 18.239.36.54, 18.239.36.57, 18.239.36.3
uhchealthaccounts.com
95% confidence
behind AS16509 cert 8d86ddd21769… · cert 8d86ddd2… served by 149.111.166.210 (AS10879) carries SAN healthsafeid.uhchealthaccounts.com which currently resolves through Amazon (AS16509) at 18.239.36.27, 18.239.36.54, 18.239.36.57, 18.239.36.3
myaarphsa.com
95% confidence
behind AS16509 cert 8d86ddd21769… · cert 8d86ddd2… served by 149.111.166.210 (AS10879) carries SAN healthsafeid.myaarphsa.com which currently resolves through Amazon (AS16509) at 18.239.36.27, 18.239.36.54, 18.239.36.57, 18.239.36.3
healthsafe-id.com
95% confidence
behind AS16509 cert 8d86ddd21769… · cert 8d86ddd2… served by 149.111.166.210 (AS10879) carries SAN www.healthsafe-id.com which currently resolves through Amazon (AS16509) at 18.239.36.27, 18.239.36.54, 18.239.36.57, 18.239.36.3
Hosted Domains
8 domains resolve (A-record) to this IP.
Showing 8 of 8
Multi-Vantage Check
Reachability accrued passively from real user-triggered checks across our 65+ probe nodes. Run a live check to add fresh data.
No accumulated reachability data yet
Reachability accrues from real user-triggered checks. Trigger a Ping or HTTP check from our 65+ probe nodes to contribute the first data point.
Threat Intelligence
No threat-intel matches
This IP doesn't appear in any of the feeds we mirror (Tor exits, FireHOL Level 1-3, Spamhaus DROP/EDROP, URLhaus, OpenPhish). Absence here doesn't prove the IP is clean — it just means none of our public-feed sources flag it.
Co-Hosted Domains
No DNS-confirmed domains yet
We cross-reference body-cited domains against our DNS resolver records. Confirmations appear here once both sides have data for the same name.
External References
No external references found yet
As HTML bodies get banner-grabbed, references to external domains land here.
History
First observed
2026-05-26 13:04
Last observed
2026-07-28 19:24
Scan observations
138
The full change-log (ASN moves, cert rotations, port-state diffs) accumulates as our archives grow.