Domain
rankmath.com
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of rankmath.com
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
Hosting IPs
7
A/AAAA targets
Subdomains
50
CT + scan + body
Record Types
6
seen in DNS
Observed Certs
15
in our scans
DNS Records
A
104.20.40.216, 172.66.154.85
AAAA
2606:4700:10::6814:28d8, 2606:4700:10::ac42:9a55
MX
1 rankmath-com.mail.protection.outlook.com
NS
lilyana.ns.cloudflare.com, rayden.ns.cloudflare.com
TXT
MS=ms94284564, Sendinblue-code:496b272c21f623ae83d61aaafb8a3d2b, ca3-d6cbfce43c1f43978cf0bdfe67e96160, google-site-verification=1YrswNBwB6B9FkElAQ8UEW9o46-38FBwtyijU-n-xaA, google-site-verification=KQEKkiJZdoMPbkQA9NGlyYa-oz7hrHkduNNEmM7LOHE, google-site-verification=x4Lq9exP3NFTuo9Yt0HrM8g0K2wPfUvkNpGT98t6tVY, knowbe4-site-verification=13cfe1b22eeb49de9313bc1e94dbe1a2, v=spf1 include:spf.efwd.registrar-servers.com include:_spf.createsend.com include:_spf.raskesider.no include:_spf.google.com include:spf.protection.outlook.com include:mail.zendesk.com -all
CNAME
—
CAA
—
WHOIS / Registration
Registration data planned
Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.
Subdomains
Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.
| Subdomain | Resolves to | Last seen |
|---|---|---|
| cai.rankmath.com | 2026-06-16 13:11:51.641 | |
| demo.rankmath.com | 2026-07-24 22:16:03.807 | |
| handbook.rankmath.com | 2026-06-14 22:08:58.337 | |
| i.rankmath.com | 2026-07-24 22:16:03.807 | |
| rankmath.com | 2026-07-28 20:39:29.599 | |
| support.rankmath.com | 2026-07-24 22:16:03.807 | |
| vault.rankmath.com | 2026-07-18 13:38:58.810 | |
| www.rankmath.com | 2026-06-14 22:08:58.337 | |
| api-staging.rankmath.com | 1970-01-01 00:00:00.000 | |
| api.rankmath.com | 1970-01-01 00:00:00.000 | |
| cai-research-staging.rankmath.com | 1970-01-01 00:00:00.000 | |
| cai-staging.rankmath.com | 1970-01-01 00:00:00.000 | |
| img.mail.rankmath.com | 1970-01-01 00:00:00.000 | |
| oauth.rankmath.com | 2026-07-18 04:27:54.557 | |
| s.rankmath.com | 2026-07-28 18:54:14.710 | |
| seo-platform-staging.rankmath.com | 1970-01-01 00:00:00.000 | |
| seo-platform.rankmath.com | 1970-01-01 00:00:00.000 | |
| support-staging.rankmath.com | 2026-06-14 22:08:58.337 | |
| www-staging.rankmath.com | 2026-06-14 22:08:58.337 | |
| www-test.rankmath.com | 2026-06-14 22:08:58.337 |
Tech Stack
Tech detection pending
Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.
TLS Certificates
Subject: appsproxy.wp-media.me
Issuer: R13
SANs: api-staging.wp-rocket.me, api-test.wp-rocket.me, api.wp-rocket.me, appsproxy.wp-media.me, backwpup.com, backwpup.de, handbook.rankmath.com, hub-staging.wp-media.me, hub-test.wp-media.me, hub.wp-media.me, imagify.io, internal-api-staging.wp-rocket.me, internal-api-test.wp-rocket.me, internal-api.wp-rocket.me, login-staging.backwpup.com, login-test.backwpup.com, login.backwpup.com, rankmath.com, rocketcdn.me, staging.imagify.io, support-staging.rankmath.com, support.rankmath.com, temp.login.backwpup.com, tst.imagify.io, wp-media.me, wp-rocket.me, www-sandbox1.wp-rocket.me, www-sandbox2.wp-rocket.me, www-sandbox3.wp-rocket.me, www-sandbox4.wp-rocket.me, www-sandbox5.wp-rocket.me, www-staging.backwpup.com, www-staging.backwpup.de, www-staging.imagify.io, www-staging.rankmath.com, www-staging.rocketcdn.me, www-staging.wp-media.me, www-staging.wp-rocket.me, www-test.backwpup.com, www-test.backwpup.de, www-test.imagify.io, www-test.rankmath.com, www-test.rocketcdn.me, www-test.wp-media.me, www-test.wp-rocket.me, www.backwpup.com, www.backwpup.de, www.imagify.io, www.rankmath.com, www.rocketcdn.me, www.wp-media.me, www.wp-rocket.me
IPs Citing This Domain
Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.
47.116.210.163:9443
href · ×37
50.116.41.94:8080
href · ×37
47.237.206.175:993
href · ×37
3.78.121.8:443
href · ×4
162.243.162.179:443
href · ×4
209.38.175.91:443
href · ×4
3.96.71.195:443
href · ×4
157.90.112.204:443
href · ×4
120.76.200.9:443
href · ×3
152.42.167.224:80
href · ×3
43.154.68.239:443
href · ×3
104.168.141.68:443
href · ×3
46.17.41.24:443
href · ×3
155.94.192.42:443
href · ×3
82.158.227.137:443
href · ×3
185.242.105.246:443
href · ×3
91.225.138.155:80
href · ×3
84.32.57.97:443
href · ×3
82.158.227.111:443
href · ×3
146.190.95.97:80
href · ×2
15.235.210.238:80
href · ×2
3.37.1.144:443
href · ×2
82.158.227.193:443
href · ×2
140.188.206.184:443
href · ×2
64.227.136.89:80
href · ×2
46.250.239.178:443
href · ×2
3.110.187.175:443
href · ×2
45.207.163.56:443
href · ×2
104.223.69.155:443
href · ×2
43.143.148.19:80
href · ×2
24.155.145.248:80
href · ×2
128.241.252.64:443
href · ×2
134.209.112.59:443
href · ×2
65.1.242.50:443
href · ×2
216.194.169.124:443
href · ×2
34.226.45.81:443
href · ×2
173.254.224.217:443
href · ×2
52.87.128.128:443
href · ×2
213.165.85.196:443
href · ×2
54.177.168.137:443
href · ×2
62.216.72.46:443
href · ×2
178.32.97.136:8080
href · ×2
217.13.162.31:443
href · ×2
173.254.224.215:443
href · ×2
52.58.164.202:80
href · ×2
188.120.229.207:443
href · ×2
193.25.200.79:443
href · ×2
13.201.126.162:80
href · ×2
82.158.227.15:443
href · ×2
43.202.30.158:443
href · ×2
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
| Origin IP | Origin ASN | CDN ASN | Confidence | Reasoning |
|---|---|---|---|---|
| 185.10.9.101 | AS51468 | AS13335 | 95% | cert 675846da… served by 185.10.9.101 (AS51468) carries SAN rankmath.com which currently resolves through Cloudflare (AS13335) at 104.20.40.216, 172.66.154.85, 2606:4700:10::6814:28d8, 2606:4700:10::ac42:9a55 |
Threat Intelligence
Domain threat-intel pending
Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.
History
Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.
| Type | Value | First seen | Last seen |
|---|---|---|---|
| A | 104.20.40.216 | 2026-05-25 21:56:50.553 | 2026-07-28 20:39:29.599 |
| A | 172.66.154.85 | 2026-05-25 21:56:50.553 | 2026-07-28 20:39:29.599 |
| AAAA | 2606:4700:10::6814:28d8 | 2026-05-25 21:56:50.553 | 2026-07-28 20:39:29.599 |
| AAAA | 2606:4700:10::ac42:9a55 | 2026-05-25 21:56:50.553 | 2026-07-28 20:39:29.599 |
| TXT | v=spf1 include:spf.efwd.registrar-servers.com include:_spf.createsend.com include:_spf.raskesider.no include:_spf.google.com include:spf.protection.outlook.com include:mail.zendesk.com -all | 2026-05-25 22:07:29.493 | 2026-07-28 20:39:29.599 |
| TXT | Sendinblue-code:496b272c21f623ae83d61aaafb8a3d2b | 2026-05-25 22:07:29.493 | 2026-07-28 20:39:29.599 |
| TXT | google-site-verification=KQEKkiJZdoMPbkQA9NGlyYa-oz7hrHkduNNEmM7LOHE | 2026-05-25 22:07:29.493 | 2026-07-28 20:39:29.599 |
| MX | 1 rankmath-com.mail.protection.outlook.com | 2026-05-25 22:07:29.493 | 2026-07-28 20:39:29.599 |
| TXT | zoho-verification=zb79613570.zmverify.zoho.in | 2026-05-25 22:07:29.493 | 2026-07-28 20:39:29.599 |
| TXT | ca3-d6cbfce43c1f43978cf0bdfe67e96160 | 2026-05-25 22:07:29.493 | 2026-07-28 20:39:29.599 |
| TXT | MS=ms94284564 | 2026-05-25 22:07:29.493 | 2026-07-28 20:39:29.599 |
| NS | lilyana.ns.cloudflare.com | 2026-05-25 22:07:29.493 | 2026-07-28 20:39:29.599 |
| NS | rayden.ns.cloudflare.com | 2026-05-25 22:07:29.493 | 2026-07-28 20:39:29.599 |
| TXT | google-site-verification=1YrswNBwB6B9FkElAQ8UEW9o46-38FBwtyijU-n-xaA | 2026-05-25 22:07:29.493 | 2026-07-28 20:39:29.599 |
| TXT | google-site-verification=x4Lq9exP3NFTuo9Yt0HrM8g0K2wPfUvkNpGT98t6tVY | 2026-05-25 22:07:29.493 | 2026-07-28 20:39:29.599 |
| TXT | knowbe4-site-verification=13cfe1b22eeb49de9313bc1e94dbe1a2 | 2026-05-25 22:07:29.493 | 2026-07-28 20:39:29.599 |
| SRV | _sipfederationtls._tcp 100 1 5061 sipfed.online.lync.com | 2026-05-25 23:59:40.866 | 2026-07-28 20:39:29.599 |