Domain

mail.edu.tw

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .tw TLD

Run a live full scan of mail.edu.tw

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now

Hosting IPs

—

A/AAAA targets

Subdomains

—

CT + scan + body

Record Types

—

seen in DNS

Observed Certs

—

in our scans

DNS Records

140.111.200.153, 140.111.200.82, 140.111.200.83, 140.111.200.84

AAAA

2001:288:0:200::153, 2001:288:0:200::82, 2001:288:0:200::83, 2001:288:0:200::84

10 mg.edu.tw

edudns-r1.edu.tw, edudns-r2.edu.tw, moemoon.edu.tw, moestar.edu.tw

TXT

Public-CA-domain-verification=EE50F2730964726DBA403DB1DB4E39D3, feZKZT10QA-dTKocpK3G-Jalu0OoyJOpNXfDN7N4ZFc, mX1JQspoF0xtJJbRB-fJXxU_u66deDxTsd0nlsujbxc, v=spf1 ip4:163.28.10.0/23 ip4:163.28.52.0/24 ip4:163.28.84.0/24 ip4:163.28.127.0/24 ip4:140.111.200.82/32 ip4:140.111.200.83/32 ip4:140.111.200.84/32 ip4:140.111.200.85/32 ip4:140.111.200.86/32 ip6:2001:288:200:10::/63 ip6:2001:288:3100::/64 ip6:2001:288:5000:8::/64 ip6:2001:288:7100:127::/64 ip6:2001:288:0:200::82 ip6:2001:288:0:200::83 ip6:2001:288:0:200::84 ip6:2001:288:0:200::85 ip6:2001:288:0:200::86 -all

CNAME

—

CAA

—

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Subdomain enumeration pending

Every subdomain ever issued a TLS cert under this apex — extracted from Certificate Transparency logs, our own scan observations and body references.

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

140.111.200.153:443 fa8ff3c724b9…

Subject: mail.edu.tw

Issuer: TWCA Secure SSL Certification Authority

SANs: mail.edu.tw

IPs Citing This Domain

Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.

163.30.16.237:443 href · ×3

120.98.35.236:443 href · ×3

163.28.11.141:443 href · ×3

203.68.92.87:443 href · ×2

163.30.128.24:443 href · ×2

163.30.128.24:80 href · ×2

49.213.238.208:443 href · ×1

114.33.3.92:443 href · ×1

163.30.120.108:80 href · ×1

163.30.210.224:443 href · ×1

163.30.77.236:80 href · ×1

163.30.57.112:80 href · ×1

220.134.207.29:5000 href · ×1

163.30.57.110:443 href · ×1

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

No origin-IP leaks detected (yet)

Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Domain timeline pending

Passive-DNS history accumulates as our forward-DNS crawler observes A/AAAA/MX/NS/TXT records over time.