Domain

keybase.io

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .io TLD

Run a live full scan of keybase.io

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now

Hosting IPs

A/AAAA targets

Subdomains

CT + scan + body

Record Types

seen in DNS

Observed Certs

in our scans

DNS Records

100.27.164.188, 100.29.65.32, 18.232.243.137, 184.73.67.48, 23.23.57.228, 3.215.145.180, 3.218.148.65, 32.197.106.22

AAAA

—

1 aspmx.l.google.com, 10 aspmx2.googlemail.com, 10 aspmx3.googlemail.com, 5 alt1.aspmx.l.google.com, 5 alt2.aspmx.l.google.com

ns-1016.awsdns-63.net, ns-1095.awsdns-08.org, ns-1722.awsdns-23.co.uk, ns-337.awsdns-42.com

TXT

google-site-verification=2_x9kakVn08nlY19drRYak0gT8V7--0gD30LuHeQgDc, google-site-verification=ACKvDZtx7Du0yKqq67RD_HTmFFz7pDwRKt1DfKaGIiw, google-site-verification=EScVE2sVORvMDZLhhutKO7wX_1MhEYD4mf07N-9ZVJo, google-site-verification=hCgqgPE11cpweSzun0ckJAyD8zkygm1AnmLzT69gOk8, hns-claim:aaki2sqyeenk5icdlvhu4o6ghrfocr6bymvp5sc6aeaaaaaaaaaklzaororjdpl6qzexi75h7ofhv447lownw5btzuxvs4ibaaaaa3uswt5q, hns-regtest:aakcuz4t4tu5amlrn3pn6vtt47ccazqid2lp3ncbgsjtuav3ymg5h7gb6tlneu74ovc46aqp5no4vkskhzicjwqjbgzqcaaaac763qw3, v=spf1 include:amazonses.com include:_spf.google.com -all

CNAME

—

CAA

—

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.

Subdomain	Resolves to	Last seen
keybase.io	44.222.48.123 23.23.57.228 44.219.137.159 52.3.246.127 +15	2026-07-28 12:13:49.425
www.keybase.io	100.29.65.32 44.222.48.123 44.219.137.159 52.3.246.127	2026-07-27 17:59:46.237
book.keybase.io		1970-01-01 00:00:00.000
www.book.keybase.io		1970-01-01 00:00:00.000

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

Certificate observations pending

TLS certs naming this domain in subject or SANs will appear here as our scan-layer catches them.

IPs Citing This Domain

Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.

45.87.41.154:80 href · ×6

23.88.101.219:443 href · ×3

136.144.172.30:443 href · ×3

104.207.151.134:443 href · ×3

158.178.146.144:80 href · ×2

136.56.178.125:443 href · ×2

67.215.235.58:443 href · ×2

162.221.25.23:443 href · ×2

174.138.15.10:80 href · ×2

85.119.82.20:443 href · ×2

142.93.124.147:443 href · ×2

188.166.136.252:443 href · ×2

142.171.142.190:443 href · ×2

104.197.250.49:80 href · ×2

170.75.160.19:443 href · ×2

24.199.97.60:443 href · ×2

50.116.38.95:443 href · ×2

94.130.148.78:443 href · ×1

128.140.96.196:80 href · ×1

138.197.211.116:443 href · ×1

159.89.112.145:80 href · ×1

46.23.88.233:443 href · ×1

142.93.192.112:443 href · ×1

3.141.41.119:80 href · ×1

116.203.110.233:443 href · ×1

89.116.106.245:443 href · ×1

141.148.246.116:443 href · ×1

193.106.93.116:443 href · ×1

143.198.6.83:443 href · ×1

159.65.202.182:443 href · ×1

74.207.254.74:443 href · ×1

31.28.27.92:443 href · ×1

104.193.59.39:443 href · ×1

95.179.176.231:8080 href · ×1

5.78.112.41:443 href · ×1

138.68.187.148:443 href · ×1

116.203.69.254:443 href · ×1

45.55.77.153:443 href · ×1

158.178.147.52:80 href · ×1

116.203.24.199:443 href · ×1

50.18.38.29:443 href · ×1

193.19.211.159:80 href · ×1

62.146.62.56:80 href · ×1

45.14.224.140:443 href · ×1

35.212.247.180:80 href · ×1

54.175.244.192:443 href · ×1

73.202.108.241:443 href · ×1

45.32.207.246:443 href · ×1

45.32.1.124:443 href · ×1

62.146.62.55:80 href · ×1

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

No origin-IP leaks detected (yet)

Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Domain timeline pending

Passive-DNS history accumulates as our forward-DNS crawler observes A/AAAA/MX/NS/TXT records over time.