Domain

www.ft.com

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .com TLD

Run a live full scan of www.ft.com

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now

Hosting IPs

A/AAAA targets

Subdomains

—

CT + scan + body

Record Types

seen in DNS

Observed Certs

in our scans

DNS Records

—

AAAA

—

TXT

—

CNAME

—

CAA

—

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Subdomain enumeration pending

Every subdomain ever issued a TLS cert under this apex — extracted from Certificate Transparency logs, our own scan observations and body references.

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

Certificate observations pending

TLS certs naming this domain in subject or SANs will appear here as our scan-layer catches them.

IPs Citing This Domain

Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.

164.92.164.138:443 href · ×23

213.47.79.81:80 href · ×8

223.27.16.198:443 href · ×7

165.232.146.50:80 href · ×6

208.86.8.56:443 href · ×6

45.79.174.116:443 href · ×6

188.239.18.157:80 href · ×5

178.105.224.136:8000 href · ×5

164.132.149.190:443 href · ×4

3.28.115.69:443 href · ×4

169.44.149.66:443 href · ×4

79.96.28.86:80 href · ×4

34.144.196.154:443 href · ×3

34.75.139.5:443 href · ×3

34.75.139.5:80 href · ×3

156.239.236.46:8000 href · ×3

196.192.79.170:443 href · ×3

34.236.23.32:443 href · ×2

52.194.215.191:443 href · ×2

34.234.166.148:443 href · ×2

173.236.246.215:443 href · ×2

147.182.191.52:80 href · ×2

109.64.87.14:80 href · ×2

57.183.6.226:80 href · ×2

3.27.112.188:443 href · ×2

152.70.127.163:443 href · ×2

3.151.212.111:443 href · ×2

223.30.126.61:80 href · ×2

175.178.89.33:8080 href · ×2

104.193.143.190:443 href · ×2

47.112.1.62:80 href · ×2

35.223.253.38:80 href · ×2

51.24.46.240:443 href · ×1

182.255.91.24:443 href · ×1

44.211.205.194:80 href · ×1

16.16.241.28:443 href · ×1

46.101.89.254:443 href · ×1

107.173.180.128:80 href · ×1

216.146.200.7:443 href · ×1

94.130.88.117:80 href · ×1

170.64.250.157:443 href · ×1

62.234.47.220:80 href · ×1

89.240.6.245:443 href · ×1

35.197.253.163:443 href · ×1

198.211.124.203:80 href · ×1

18.153.158.42:80 href · ×1

162.243.154.86:443 href · ×1

54.148.159.134:80 href · ×1

8.138.88.49:80 href · ×1

65.19.139.3:443 href · ×1

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

No origin-IP leaks detected (yet)

Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.

Type	Value	First seen	Last seen
A	104.18.4.165	2026-05-26 00:17:38.499	2026-07-31 21:06:37.379
A	104.18.5.165	2026-05-26 00:17:38.499	2026-07-31 21:06:37.379
AAAA	2606:4700::6812:5a5	2026-05-26 00:17:38.499	2026-07-31 21:06:37.379
AAAA	2606:4700::6812:4a5	2026-05-26 00:17:38.499	2026-07-31 21:06:37.379