Domain

api.ip.sb

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .sb TLD

Run a live full scan of api.ip.sb

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now

Hosting IPs

A/AAAA targets

Subdomains

—

CT + scan + body

Record Types

seen in DNS

Observed Certs

in our scans

DNS Records

—

AAAA

—

TXT

—

CNAME

—

CAA

—

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Subdomain enumeration pending

Every subdomain ever issued a TLS cert under this apex — extracted from Certificate Transparency logs, our own scan observations and body references.

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

Certificate observations pending

TLS certs naming this domain in subject or SANs will appear here as our scan-layer catches them.

IPs Citing This Domain

Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.

38.45.66.121:443 href · ×4

107.174.85.153:80 href · ×3

120.79.62.77:443 href · ×2

20.210.126.164:80 href · ×2

206.237.120.214:443 href · ×2

107.174.85.153:443 href · ×2

111.231.19.254:80 href · ×2

48.218.143.60:80 href · ×2

74.226.193.208:80 href · ×1

43.134.15.53:80 href · ×1

43.163.95.104:80 href · ×1

13.78.13.134:80 href · ×1

8.133.187.175:80 href · ×1

104.214.177.77:80 href · ×1

47.94.2.100:443 href · ×1

40.115.143.140:80 href · ×1

48.210.73.138:80 href · ×1

43.165.173.243:443 href · ×1

47.113.198.169:80 href · ×1

166.88.55.32:80 href · ×1

38.55.122.103:443 href · ×1

47.91.2.84:443 href · ×1

130.33.65.140:80 href · ×1

129.204.181.17:443 href · ×1

182.16.78.132:80 href · ×1

172.192.26.199:80 href · ×1

20.188.25.236:80 href · ×1

111.119.243.80:80 href · ×1

38.123.103.21:8080 href · ×1

101.133.238.119:443 href · ×1

198.23.149.9:80 href · ×1

47.113.198.169:8000 href · ×1

85.235.64.16:443 href · ×1

60.190.37.58:443 href · ×1

175.27.137.115:443 href · ×1

206.189.87.87:443 href · ×1

43.156.111.2:80 href · ×1

38.123.103.21:80 href · ×1

213.108.21.65:443 href · ×1

152.69.204.246:443 href · ×1

20.46.169.110:80 href · ×1

115.29.169.56:443 href · ×1

34.92.3.5:80 href · ×1

155.103.67.105:443 href · ×1

47.239.121.222:80 href · ×1

82.156.217.155:443 href · ×1

34.96.158.173:80 href · ×1

163.61.30.183:443 href · ×1

43.99.53.88:80 href · ×1

47.121.24.242:443 href · ×1

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

No origin-IP leaks detected (yet)

Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.

Type	Value	First seen	Last seen
A	104.26.12.31	2026-05-26 02:46:31.734	2026-07-27 06:10:39.795
AAAA	2606:4700:20::681a:c1f	2026-05-26 02:46:31.734	2026-07-27 06:10:39.795
AAAA	2606:4700:20::ac43:4bac	2026-05-26 02:46:31.734	2026-07-27 06:10:39.795
AAAA	2606:4700:20::681a:d1f	2026-05-26 02:46:31.734	2026-07-27 06:10:39.795
A	104.26.13.31	2026-05-26 02:46:31.734	2026-07-27 06:10:39.795
A	172.67.75.172	2026-05-26 02:46:31.734	2026-07-27 06:10:39.795