Domain
com.sa
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of com.sa
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
Hosting IPs
—
A/AAAA targets
Subdomains
—
CT + scan + body
Record Types
—
seen in DNS
Observed Certs
—
in our scans
DNS Records
A
—
AAAA
—
MX
—
NS
—
TXT
—
CNAME
—
CAA
—
WHOIS / Registration
Registration data planned
Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.
Subdomains
Subdomain enumeration pending
Every subdomain ever issued a TLS cert under this apex — extracted from Certificate Transparency logs, our own scan observations and body references.
Tech Stack
Tech detection pending
Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.
TLS Certificates
Subject: system.galactic.com.sa
Issuer: YE2
SANs: system.galactic.com.sa
Subject: prcwd.aramco.com.sa
Issuer: Aramco Overseas Company BV Issuing-CA1
SANs: prcwd.aramco.com.sa
Subject: server.saff.com.sa
Issuer: YR1
SANs: server.saff.com.sa
Subject: sapin.com.sa
Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1
SANs: sapin.com.sa, sapinuae.ae, www.sapin.com.sa, www.sapinuae.ae
Subject: *.myclinic.com.sa
Issuer: Go Daddy Secure Certificate Authority - G2
SANs: *.myclinic.com.sa, myclinic.com.sa
Subject: *.wataniya.com.sa
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.wataniya.com.sa, wataniya.com.sa
Subject: management.ecolor.com.sa
Issuer: YE1
SANs: management.ecolor.com.sa
Subject: app.mowafaqa.com.sa
Issuer: WR3
SANs: api.mowafaqa.com.sa, app.mowafaqa.com.sa, customer.mowafaqa.com.sa
Subject: files.mbl.com.sa
Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1
SANs: files.mbl.com.sa
Subject: *.teaa.com.sa
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.teaa.com.sa, teaa.com.sa
Subject: mail.flb.com.sa
Issuer: YR1
SANs: autoconfig.flb.com.sa, autodiscover.flb.com.sa, mail.flb.com.sa
Subject: saib.com.sa
Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1
SANs: akws.saib.com.sa, akws.sib.com.sa, rewards.saib.com.sa, rewards.sib.com.sa, saib.com.sa, saib.sa, sib.com.sa, sib.sa, ws1.saib.com.sa, ws1.sib.com.sa, ws2.saib.com.sa, ws2.sib.com.sa, ws3.saib.com.sa, ws3.sib.com.sa, ws4.saib.com.sa, ws4.sib.com.sa, ws5.saib.com.sa, ws5.sib.com.sa, ws6.saib.com.sa, ws6.sib.com.sa, ws7.saib.com.sa, ws7.sib.com.sa, ws8.saib.com.sa, ws8.sib.com.sa, www.gss.saib.com.sa, www.gss.sib.com.sa, www.saib.com.sa, www.saib.sa, www.sib.com.sa, www.sib.sa
Subject: micro-helper.ascend.com.sa
Issuer: YE2
SANs: micro-helper.ascend.com.sa
Subject: wazzan.aqt.com.sa
Issuer: YR2
SANs: wazzan.aqt.com.sa
Subject: *.bidaya.com.sa
Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1
SANs: *.bidaya.com.sa
Subject: vpn.naqua.com.sa
Issuer: YE2
SANs: vpn.naqua.com.sa
Subject: abaya.com.sa
Issuer: E8
SANs: abaya.com.sa
Subject: *.sar.com.sa
Issuer: Go Daddy Secure Certificate Authority - G2
SANs: *.sar.com.sa, sar.com.sa
Subject: marketplace.apps.ocpryd.neoleap.com.sa
Issuer: GlobalSign RSA OV SSL CA 2018
SANs: marketplace.apps.ocpryd.neoleap.com.sa
Subject: durar.com.sa
Issuer: R13
SANs: durar.com.sa, www.durar.com.sa
Subject: webmail.dna.com.sa
Issuer: YR1
SANs: cpanel.dna.com.sa, dna.com.sa, mail.dna.com.sa, webdisk.dna.com.sa, webmail.dna.com.sa, www.dna.com.sa
Subject: expe.rezafood.com.sa
Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1
SANs: collab-edge.rezafood.com.sa, expe.rezafood.com.sa, rezafood.com.sa
Subject: marsoom.com.sa
Issuer: WR3
SANs: marsoom.com.sa, www.marsoom.com.sa
Subject: bk.saudiozone.com.sa
Issuer: YE1
SANs: bk.saudiozone.com.sa
Subject: erp.fairvalue.com.sa
Issuer: YE1
SANs: erp.fairvalue.com.sa
Subject: *.tiqmo.com.sa
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.tiqmo.com.sa, tiqmo.com.sa
Subject: *.sure.com.sa
Issuer: GlobalSign GCC R6 AlphaSSL CA 2025
SANs: *.sure.com.sa, sure.com.sa
Subject: *.tree.com.sa
Issuer: GoDaddy TLS Intermediate CA DV - R1v1
SANs: *.tree.com.sa, tree.com.sa
Subject: erp.actgroup.com.sa
Issuer: YE2
SANs: erp.actgroup.com.sa
Subject: mdm.dataserve.com.sa
Issuer: MeshCentralRoot-8f1f1f
SANs: 127.0.0.1, http://localhost/, http://mdm.dataserve.com.sa/, localhost, mdm.dataserve.com.sa
IPs Citing This Domain
No citing IPs found yet
As the world-sweep progresses, hosts referencing this domain in their HTML will surface here.
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
| Origin IP | Origin ASN | CDN ASN | Confidence | Reasoning |
|---|---|---|---|---|
| 88.85.251.114 | AS29684 | AS13335 | 95% | cert a64fcc26… served by 88.85.251.114 (AS29684) carries SAN almoosahealth.com.sa which currently resolves through Cloudflare (AS13335) at 104.26.15.75, 104.26.14.75, 172.67.72.192, 2606:4700:20::681a:e4b |
| 37.99.174.41 | AS47794 | AS13335 | 95% | cert 5e0cedc1… served by 37.99.174.41 (AS47794) carries SAN salama.com.sa which currently resolves through Cloudflare (AS13335) at 104.18.29.161, 104.18.28.161, 2606:4700::6812:1da1, 2606:4700::6812:1ca1 |
| 84.8.98.56 | AS31898 | AS13335 | 95% | cert ecc6d700… served by 84.8.98.56 (AS31898) carries SAN pos-update.autostation.com.sa which currently resolves through Cloudflare (AS13335) at 188.114.96.0, 188.114.97.0, 2a06:98c1:3120::4, 2a06:98c1:3121::4 |
| 23.8.204.37 | AS4775 | AS16625 | 95% | cert 0a6eebf3… served by 23.8.204.37 (AS4775) carries SAN jobs.starfab.com.sa which currently resolves through Akamai (AS16625) at 184.24.26.136, 23.218.63.208 |
| 23.39.101.105 | AS45758 | AS16625 | 95% | cert d8d36730… served by 23.39.101.105 (AS45758) carries SAN www.coloplast.com.sa which currently resolves through Akamai (AS16625) at 184.24.16.193, 23.215.22.249, 23.209.21.159 |
| 46.224.53.113 | AS24940 | AS13335 | 95% | cert 8cffd3d6… served by 46.224.53.113 (AS24940) carries SAN etmaam.com.sa which currently resolves through Cloudflare (AS13335) at 172.67.75.154, 104.26.8.142, 104.26.9.142, 2606:4700:20::ac43:4b9a |
| 193.122.90.55 | AS31898 | AS209242 | 95% | cert e341cd47… served by 193.122.90.55 (AS31898) carries SAN tree.com.sa which currently resolves through Cloudflare (AS209242) at 198.202.211.1 |
| 158.101.246.86 | AS31898 | AS13335 | 95% | cert 128e48ab… served by 158.101.246.86 (AS31898) carries SAN dufaa.com.sa which currently resolves through Cloudflare (AS13335) at 104.18.1.45, 104.18.0.45, 2606:4700::6812:2d, 2606:4700::6812:12d |
| 23.219.27.216 | AS3786 | AS16625 | 95% | cert bf4e8c5d… served by 23.219.27.216 (AS3786) carries SAN stage.mastercard.com.sa which currently resolves through Akamai (AS16625) at 96.7.28.167, 23.218.56.231, 184.24.19.35 |
| 212.24.235.114 | AS29255 | AS13335 | 95% | cert d5e57626… served by 212.24.235.114 (AS29255) carries SAN tawuniya.com.sa which currently resolves through Cloudflare (AS13335) at 172.65.90.47, 172.65.90.46, 2606:4700:78::90:0:300, 2606:4700:78::90:0:301 |
| 141.147.53.130 | AS31898 | AS16509 | 95% | cert 613e0ef5… served by 141.147.53.130 (AS31898) carries SAN panda.com.sa which currently resolves through Amazon (AS16509) at 216.198.79.1 |
| 202.43.52.87 | AS3786 | AS14618 | 95% | cert 67e0d7a6… served by 202.43.52.87 (AS3786) carries SAN www.rehlat.com.sa which currently resolves through Amazon (AS14618) at 100.31.16.60, 44.219.8.60, 34.197.190.24, 13.223.217.134 |
| 23.8.147.241 | AS17639 | AS16625 | 95% | cert 0417d1a9… served by 23.8.147.241 (AS17639) carries SAN www.scotch.3m.com.sa which currently resolves through Akamai (AS16625) at 23.222.59.43, 2a02:26f0:1180:681::34fe, 2a02:26f0:1180:68c::34fe |
| 157.245.108.149 | AS14061 | AS13335 | 95% | cert 3d572d84… served by 157.245.108.149 (AS14061) carries SAN blueartworld.com.sa which currently resolves through Cloudflare (AS13335) at 188.114.96.0, 2a06:98c1:3121::, 2a06:98c1:3120::, 188.114.97.0 |
| 2.22.189.234 | AS55836 | AS16625 | 95% | cert 133b30d0… served by 2.22.189.234 (AS55836) carries SAN mtf.mastercard.com.sa which currently resolves through Akamai (AS16625) at 23.215.23.112 |
| 8.233.26.57 | AS396982 | AS209242 | 95% | cert e341cd47… served by 8.233.26.57 (AS396982) carries SAN tree.com.sa which currently resolves through Cloudflare (AS209242) at 198.202.211.1 |
| 207.127.102.184 | AS31898 | AS13335 | 95% | cert 91d37321… served by 207.127.102.184 (AS31898) carries SAN enjoy-driving.com.sa which currently resolves through Cloudflare (AS13335) at 172.67.72.176, 104.26.7.75, 104.26.6.75, 2606:4700:20::681a:74b |
| 185.196.20.56 | AS51167 | AS13335 | 95% | cert 39aab9c5… served by 185.196.20.56 (AS51167) carries SAN smalamoudi.com.sa which currently resolves through Cloudflare (AS13335) at 188.114.96.0, 2a06:98c1:3121::, 2a06:98c1:3120::, 188.114.97.0 |
| 23.221.112.68 | AS9299 | AS16625 | 95% | cert bf4e8c5d… served by 23.221.112.68 (AS9299) carries SAN stage.mastercard.com.sa which currently resolves through Akamai (AS16625) at 184.24.19.35 |
| 34.110.233.28 | AS396982 | AS13335 | 95% | cert 6a0e7dc4… served by 34.110.233.28 (AS396982) carries SAN piatto.com.sa which currently resolves through Cloudflare (AS13335) at 104.18.28.195, 104.18.29.195, 2606:4700::6812:1cc3, 2606:4700::6812:1dc3 |
| 162.19.174.234 | AS16276 | AS13335 | 95% | cert e3e69a88… served by 162.19.174.234 (AS16276) carries SAN alsalam.com.sa which currently resolves through Cloudflare (AS13335) at 104.21.46.64, 172.67.168.35, 2606:4700:3036::6815:2e40, 2606:4700:3033::ac43:a823 |
| 88.85.241.155 | AS29684 | AS8075 | 95% | cert 540d4941… served by 88.85.241.155 (AS29684) carries SAN ahg.com.sa which currently resolves through Microsoft (AS8075) at 20.174.64.187 |
| 84.8.121.99 | AS31898 | AS13335 | 95% | cert 7ee82e2e… served by 84.8.121.99 (AS31898) carries SAN emkanfinance.com.sa which currently resolves through Cloudflare (AS13335) at 172.65.90.47, 172.65.90.46, 2606:4700:78::90:0:300, 2606:4700:78::90:0:301 |
| 146.19.71.231 | AS29684 | AS30148 | 95% | cert 49c981c9… served by 146.19.71.231 (AS29684) carries SAN sihksa.com.sa which currently resolves through Sucuri (AS30148) at 192.124.249.3 |
| 34.166.143.209 | AS396982 | AS13335 | 95% | cert 0b2ab436… served by 34.166.143.209 (AS396982) carries SAN visionbank.com.sa which currently resolves through Cloudflare (AS13335) at 104.18.1.112, 104.18.0.112, 2606:4700::6812:70, 2606:4700::6812:170 |
Threat Intelligence
Domain threat-intel pending
Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.
History
Domain timeline pending
Passive-DNS history accumulates as our forward-DNS crawler observes A/AAAA/MX/NS/TXT records over time.