Domain
or.th
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of or.th
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
Hosting IPs
—
A/AAAA targets
Subdomains
—
CT + scan + body
Record Types
—
seen in DNS
Observed Certs
—
in our scans
DNS Records
A
—
AAAA
—
MX
—
NS
—
TXT
—
CNAME
—
CAA
—
WHOIS / Registration
Registration data planned
Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.
Subdomains
Subdomain enumeration pending
Every subdomain ever issued a TLS cert under this apex — extracted from Certificate Transparency logs, our own scan observations and body references.
Tech Stack
Tech detection pending
Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.
TLS Certificates
Subject: bapcor.thewebpractice.co.nz
Issuer: cPanel, Inc. Certification Authority
SANs: bapcor.thewebpractice.co.nz, www.bapcor.com.au
Subject: *.sacit.or.th
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.sacit.or.th, sacit.or.th
Subject: *.mea.or.th
Issuer: GlobalSign RSA OV SSL CA 2018
SANs: *.mea.or.th, mail.mea.or.th, mea.or.th, owa.mea.or.th, www.mea.or.th
Subject: *.tat.or.th
Issuer: Go Daddy Secure Certificate Authority - G2
SANs: *.tat.or.th, tat.or.th
Subject: *.git.or.th
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.git.or.th, git.or.th
Subject: *.nsf.or.th
Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1
SANs: *.nsf.or.th
Subject: internet.nectec.or.th
Issuer: R12
SANs: internet.nectec.or.th
Subject: *.tgo.or.th
Issuer: GlobalSign RSA OV SSL CA 2018
SANs: *.tgo.or.th, tgo.or.th
Subject: *.hii.or.th
Issuer: GeoTrust TLS RSA CA G1
SANs: *.hii.or.th, hii.or.th
Subject: slc.tpa.or.th
Issuer: Thawte TLS RSA CA G1
SANs: slc.tpa.or.th
Subject: *.cads.arda.or.th
Issuer: GlobalSign GCC R6 AlphaSSL CA 2025
SANs: *.cads.arda.or.th, cads.arda.or.th
Subject: *.aiscoop.or.th
Issuer: Go Daddy Secure Certificate Authority - G2
SANs: *.aiscoop.or.th, aiscoop.or.th
Subject: telDeviceService1.gpf.or.th
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: telDeviceService1.gpf.or.th, telMessaging1.gpf.or.th, telPresence1-sm100.gpf.or.th, telSessionManager2.gpf.or.th, telSessionManager3.gpf.or.th
Subject: *.cea.or.th
Issuer: GlobalSign RSA OV SSL CA 2018
SANs: *.cea.or.th, cea.or.th
Subject: *.ha.or.th
Issuer: GlobalSign RSA OV SSL CA 2018
SANs: *.ha.or.th, ha.or.th
Subject: *.tceb.or.th
Issuer: RapidSSL TLS RSA CA G1
SANs: *.tceb.or.th, tceb.or.th
Subject: km.fti.or.th
Issuer: YE1
SANs: km.fti.or.th
Subject: *.nationalhealth.or.th
Issuer: GeoTrust TLS RSA CA G1
SANs: *.nationalhealth.or.th, nationalhealth.or.th
Subject: *.dga.or.th
Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1
SANs: *.dga.or.th, dga.or.th
Subject: *.villagefund.or.th
Issuer: Sectigo Public Server Authentication CA OV R36
SANs: *.villagefund.or.th, villagefund.or.th
Subject: rspg.or.th
Issuer: RapidSSL TLS RSA CA G1
SANs: rspg.or.th, www.rspg.or.th
Subject: *.gistda.or.th
Issuer: GlobalSign RSA OV SSL CA 2018
SANs: *.gistda.or.th, gistda.or.th
Subject: *.eef.or.th
Issuer: GlobalSign GCC R3 DV TLS CA 2020
SANs: *.eef.or.th, eef.or.th
Subject: *.mea.or.th
Issuer: GlobalSign RSA OV SSL CA 2018
SANs: *.mea.or.th, mail.mea.or.th, mea.or.th, owa.mea.or.th, www.mea.or.th
Subject: *.mea.or.th
Issuer: GlobalSign RSA OV SSL CA 2018
SANs: *.mea.or.th, mail.mea.or.th, mea.or.th, owa.mea.or.th, www.mea.or.th
Subject: *.tat.or.th
Issuer: Go Daddy Secure Certificate Authority - G2
SANs: *.tat.or.th, tat.or.th
Subject: *.caat.or.th
Issuer: GoGetSSL RSA OV CA
SANs: *.caat.or.th, caat.or.th
Subject: *.ttrs.or.th
Issuer: GlobalSign GCC R6 AlphaSSL CA 2025
SANs: *.ttrs.or.th, ttrs.or.th
Subject: *.tei.or.th
Issuer: GoDaddy TLS Intermediate CA DV - R1v1
SANs: *.tei.or.th, tei.or.th
Subject: *.tat.or.th
Issuer: Go Daddy Secure Certificate Authority - G2
SANs: *.tat.or.th, tat.or.th
IPs Citing This Domain
No citing IPs found yet
As the world-sweep progresses, hosts referencing this domain in their HTML will surface here.
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
| Origin IP | Origin ASN | CDN ASN | Confidence | Reasoning |
|---|---|---|---|---|
| 27.131.148.119 | AS24187 | AS13335 | 95% | cert 8857d60c… served by 27.131.148.119 (AS24187) carries SAN hii.or.th which currently resolves through Cloudflare (AS13335) at 45.60.49.63, 45.60.47.63, 2606:4700::6812:ff9 |
| 134.236.62.153 | AS131090 | AS16509 | 95% | cert e62c4f20… served by 134.236.62.153 (AS131090) carries SAN tat.or.th which currently resolves through Amazon (AS16509) at 13.251.231.249, 2406:da18:bb0:a630:b86d:6287:a91a:2dc0 |
| 27.131.148.34 | AS24187 | AS13335 | 95% | cert 8857d60c… served by 27.131.148.34 (AS24187) carries SAN hii.or.th which currently resolves through Cloudflare (AS13335) at 45.60.49.63, 45.60.47.63, 2606:4700::6812:ff9 |
| 209.15.116.105 | AS135566 | AS13335 | 95% | cert 2a939570… served by 209.15.116.105 (AS135566) carries SAN dga.or.th which currently resolves through Cloudflare (AS13335) at 104.18.28.249, 104.18.29.249, 2606:4700::6812:1df9, 2606:4700::6812:1cf9 |
| 27.131.148.41 | AS24187 | AS13335 | 95% | cert 8857d60c… served by 27.131.148.41 (AS24187) carries SAN hii.or.th which currently resolves through Cloudflare (AS13335) at 45.60.49.63, 45.60.47.63, 2606:4700::6812:ff9 |
| 147.50.44.7 | AS4750 | AS13335 | 95% | cert c13c3fc1… served by 147.50.44.7 (AS4750) carries SAN tceb.or.th which currently resolves through Cloudflare (AS13335) at 188.114.96.0, 2a06:98c1:3121::, 2a06:98c1:3120::, 188.114.97.0 |
| 110.49.66.52 | AS45458 | AS13335 | 95% | cert 10f9c6a4… served by 110.49.66.52 (AS45458) carries SAN caat.or.th which currently resolves through Cloudflare (AS13335) at 104.18.19.101, 104.18.18.101, 2606:4700::6812:1265, 2606:4700::6812:1365 |
| 61.19.204.20 | AS9931 | AS16509 | 95% | cert e62c4f20… served by 61.19.204.20 (AS9931) carries SAN tat.or.th which currently resolves through Amazon (AS16509) at 13.251.231.249, 2406:da18:bb0:a630:b86d:6287:a91a:2dc0 |
| 27.131.148.102 | AS24187 | AS13335 | 95% | cert 8857d60c… served by 27.131.148.102 (AS24187) carries SAN hii.or.th which currently resolves through Cloudflare (AS13335) at 45.60.49.63, 45.60.47.63, 2606:4700::6812:ff9 |
| 161.82.158.56 | AS132280 | AS19551 | 95% | cert 6f1528ff… served by 161.82.158.56 (AS132280) carries SAN nxpo.or.th which currently resolves through Imperva (AS19551) at 45.60.34.251, 45.60.36.251 |
| 203.150.75.151 | AS4618 | AS13335 | 95% | cert 45d38afb… served by 203.150.75.151 (AS4618) carries SAN caat.or.th which currently resolves through Cloudflare (AS13335) at 104.18.19.101, 104.18.18.101, 2606:4700::6812:1265, 2606:4700::6812:1365 |
| 110.49.66.29 | AS45458 | AS13335 | 95% | cert 10f9c6a4… served by 110.49.66.29 (AS45458) carries SAN caat.or.th which currently resolves through Cloudflare (AS13335) at 104.18.19.101, 104.18.18.101, 2606:4700::6812:1265, 2606:4700::6812:1365 |
| 27.254.102.209 | AS4750 | AS132203 | 95% | cert a7872cc2… served by 27.254.102.209 (AS4750) carries SAN mail.nationalhealth.or.th which currently resolves through Tencent (AS132203) at 150.109.165.86 |
| 27.254.102.209 | AS4750 | AS8075 | 95% | cert a7872cc2… served by 27.254.102.209 (AS4750) carries SAN autodiscover.nationalhealth.or.th which currently resolves through Microsoft (AS8075) at 52.98.178.232, 2603:1026:c03:7068::8, 52.98.179.120, 40.99.149.104 |
| 110.164.57.98 | AS45758 | AS13335 | 95% | cert 10f9c6a4… served by 110.164.57.98 (AS45758) carries SAN caat.or.th which currently resolves through Cloudflare (AS13335) at 104.18.19.101, 104.18.18.101, 2606:4700::6812:1265, 2606:4700::6812:1365 |
| 27.254.145.217 | AS9891 | AS13335 | 95% | cert 8b1dfe50… served by 27.254.145.217 (AS9891) carries SAN sv2.tpacal.or.th which currently resolves through Cloudflare (AS13335) at 188.114.97.3, 188.114.96.3, 2a06:98c1:3120::3, 2a06:98c1:3121::3 |
| 203.99.253.83 | AS24190 | AS19551 | 95% | cert 15b61f08… served by 203.99.253.83 (AS24190) carries SAN set.or.th which currently resolves through Imperva (AS19551) at 45.60.48.141 |
| 180.180.241.24 | AS131293 | AS19551 | 95% | cert 131672f3… served by 180.180.241.24 (AS131293) carries SAN nhrc.or.th which currently resolves through Imperva (AS19551) at 45.60.32.44 |
| 122.155.177.170 | AS9335 | AS13335 | 95% | cert c4ecfc01… served by 122.155.177.170 (AS9335) carries SAN tceb.or.th which currently resolves through Cloudflare (AS13335) at 188.114.96.0, 2a06:98c1:3121::, 2a06:98c1:3120::, 188.114.97.0 |
| 83.118.41.124 | AS132280 | AS13335 | 95% | cert dd2fa2b1… served by 83.118.41.124 (AS132280) carries SAN gpo.or.th which currently resolves through Cloudflare (AS13335) at 104.18.15.220, 104.18.14.220 |
| 209.15.116.184 | AS135566 | AS13335 | 95% | cert 874cf341… served by 209.15.116.184 (AS135566) carries SAN pdpc.or.th which currently resolves through Cloudflare (AS13335) at 104.18.30.153, 104.18.31.153, 2606:4700::6812:1f99, 2606:4700::6812:1e99 |
| 203.151.193.152 | AS4618 | AS13335 | 95% | cert 9abe57f1… served by 203.151.193.152 (AS4618) carries SAN nia.or.th which currently resolves through Cloudflare (AS13335) at 104.18.21.4, 104.18.20.4, 2606:4700::6812:1404, 2606:4700::6812:1504 |
| 110.164.149.70 | AS45758 | AS13335 | 95% | cert 10f9c6a4… served by 110.164.149.70 (AS45758) carries SAN caat.or.th which currently resolves through Cloudflare (AS13335) at 104.18.19.101, 104.18.18.101, 2606:4700::6812:1265, 2606:4700::6812:1365 |
| 203.151.193.150 | AS4618 | AS13335 | 95% | cert 9abe57f1… served by 203.151.193.150 (AS4618) carries SAN nia.or.th which currently resolves through Cloudflare (AS13335) at 104.18.21.4, 104.18.20.4, 2606:4700::6812:1404, 2606:4700::6812:1504 |
| 203.151.238.179 | AS4618 | AS19551 | 95% | cert 83f72c2f… served by 203.151.238.179 (AS4618) carries SAN hsri.or.th which currently resolves through Imperva (AS19551) at 45.60.49.63, 45.60.47.63 |
Threat Intelligence
Domain threat-intel pending
Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.
History
Domain timeline pending
Passive-DNS history accumulates as our forward-DNS crawler observes A/AAAA/MX/NS/TXT records over time.