Domain

api-m.paypal.com

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .com TLD

Run a live full scan of api-m.paypal.com

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now

Hosting IPs

A/AAAA targets

Subdomains

—

CT + scan + body

Record Types

seen in DNS

Observed Certs

in our scans

DNS Records

104.16.123.74, 104.16.124.74, 104.16.125.58, 104.16.126.58, 151.101.131.1, 151.101.195.1, 151.101.3.1, 151.101.67.1

AAAA

—

TXT

—

CNAME

—

CAA

—

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Subdomain enumeration pending

Every subdomain ever issued a TLS cert under this apex — extracted from Certificate Transparency logs, our own scan observations and body references.

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

173.0.87.2:443 8bd595bf753d…

Subject: edge.paypal.com

Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1

SANs: api-m-edge.paypal.com, api-m.paypal.com, edge.paypal.com

64.4.249.21:443 4a10ca7c5d2b…

Subject: api.paypal.com

Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1

SANs: a.paypal.com, adjvendor.paypal.com, api-3t.paypal.com, api-aa-3t.paypal.com, api-aa.paypal.com, api-m.paypal.com, api.paypal.com, payflowpro.paypal.com, pilot-payflowpro.paypal.com, pointofsale-s.paypal.com, pointofsale.paypal.com, svcs.paypal.com, uptycsbrt.paypal.com, uptycshap.paypal.com, uptycshon.paypal.com, uptycsize.paypal.com, uptycspay.paypal.com, uptycsven.paypal.com, zootapi.paypal.com

45.119.7.249:443 c369a4cf69a8…

Subject: www.paypal.com

Issuer: DigiCert EV RSA CA G2

SANs: api-m.paypal.com, c.paypal.com, t.paypal.com, www.paypal.com, www.paypalobjects.com

173.0.88.66:443 4a10ca7c5d2b…

Subject: api.paypal.com

Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1

64.4.248.21:443 4a10ca7c5d2b…

Subject: api.paypal.com

Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1

43.154.131.189:443 88a1ffee24b6…

Subject: api-m.paypal.com

Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1

SANs: a.paypal.com, api-m.paypal.com, api-m.sandbox.paypal.com, origin-chd-api-m.paypal.com, phx-origin-api-m.paypal.com, slc-a-origin-api-m.paypal.com, slc-b-origin-api-m.paypal.com

43.154.82.42:443 4a10ca7c5d2b…

Subject: api.paypal.com

Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1

124.156.126.175:443 4a10ca7c5d2b…

Subject: api.paypal.com

Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1

64.4.248.36:443 4a10ca7c5d2b…

Subject: api.paypal.com

Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1

173.0.93.132:443 4a10ca7c5d2b…

Subject: api.paypal.com

Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1

173.0.93.137:443 4a10ca7c5d2b…

Subject: api.paypal.com

Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1

64.4.248.36:443 4a10ca7c5d2b…

Subject: api.paypal.com

Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1

IPs Citing This Domain

Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.

35.209.130.128:443 href · ×2

8.138.164.217:443 href · ×1

31.220.99.68:443 href · ×1

50.6.231.40:443 href · ×1

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

No origin-IP leaks detected (yet)

Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.

Type	Value	First seen	Last seen
A	151.101.131.1	2026-05-26 06:44:29.317	2026-07-25 22:40:49.257
A	151.101.3.1	2026-05-26 06:44:29.317	2026-07-25 22:40:49.257
A	151.101.195.1	2026-05-26 06:44:29.317	2026-07-25 22:40:49.257
A	151.101.67.1	2026-05-26 06:44:29.317	2026-07-25 22:40:49.257
A	104.16.123.74	2026-05-26 11:51:50.538	2026-07-21 08:08:14.921
A	104.16.124.74	2026-05-26 11:51:50.538	2026-07-21 08:08:14.921
A	104.16.126.58	2026-07-24 03:40:17.794	2026-07-24 16:49:57.169
A	104.16.125.58	2026-07-24 03:40:17.794	2026-07-24 16:49:57.169