Domain
gi.de
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of gi.de
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
Hosting IPs
19
A/AAAA targets
Subdomains
53
CT + scan + body
Record Types
4
seen in DNS
Observed Certs
2
in our scans
DNS Records
A
—
AAAA
—
MX
—
NS
—
TXT
—
CNAME
—
CAA
—
WHOIS / Registration
Registration data planned
Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.
Subdomains
Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.
| Subdomain | Resolves to | Last seen |
|---|---|---|
| dl.gi.de | 2026-07-22 16:50:38.824 | |
| icinga.gi.de | 2026-07-19 15:33:33.696 | |
| ldap.gi.de | 2026-07-23 08:39:46.689 | |
| lists.gi.de | 2026-07-28 13:59:46.480 | |
| spring.fg-sidar.gi.de | 2026-06-17 23:48:30.766 | |
| akteure.ak-xrl.gi.de | 2026-07-18 18:39:39.207 | |
| ceur-ws.gi.de | 1970-01-01 00:00:00.000 | |
| confluence.gi.de | 2026-06-18 13:32:19.643 | |
| dagstuhl.gi.de | 2026-05-26 10:05:02.397 | |
| dl7.gi.de | 1970-01-01 00:00:00.000 | |
| dltest.gi.de | 1970-01-01 00:00:00.000 | |
| fg-afs.gi.de | 2026-06-18 21:01:28.577 | |
| fg-ie.gi.de | 2026-05-26 04:24:25.813 | |
| gewissensbits.gi.de | 2026-05-26 04:24:25.813 | |
| gi.de | 2026-07-24 10:01:02.801 | |
| gina-test.hz.gi.de | 2026-06-19 01:21:17.218 | |
| gina.rz.gi.de | 1970-01-01 00:00:00.000 | |
| helpdesk.gi.de | 2026-06-03 08:12:44.189 | |
| jira.gi.de | 2026-06-03 08:12:44.189 | |
| pads.gi.de | 2026-06-21 01:05:36.768 | |
| pfsense.gs.gi.de | 2026-05-26 21:52:25.161 | |
| pfsense.vnet.gi.de | 2026-06-16 05:38:40.313 | |
| plesk.gi.de | 2026-06-21 05:56:17.174 | |
| rz.gi.de | 1970-01-01 00:00:00.000 | |
| se-2023.gi.de | 2026-07-22 10:30:16.117 | |
| shop.gi.de | 1970-01-01 00:00:00.000 | |
| stage.fa-arcs.gi.de | 1970-01-01 00:00:00.000 | |
| ukonto.gi.de | 1970-01-01 00:00:00.000 | |
| www.ceur-ws.gi.de | 1970-01-01 00:00:00.000 | |
| www.gi.de | 2026-07-22 16:50:38.824 |
Tech Stack
Tech detection pending
Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.
TLS Certificates
Subject: *.ra-georgi.de
Issuer: Certum DV TLS G2 R39 CA
SANs: *.ra-georgi.de, ra-georgi.de
Subject: hygi.de
Issuer: D-TRUST BR CA 2-23-1 2023
SANs: hygi.de, www.hygi.de
Subject: mail.cgicgi.de
Issuer: YR2
SANs: cgicgi.de, imap.cgicgi.de, mail.cgicgi.de, smtp.cgicgi.de, www.cgicgi.de
Subject: cgi.desarrollo.milano.com
Issuer: Go Daddy Secure Certificate Authority - G2
SANs: cgi.desarrollo.milano.com, www.cgi.desarrollo.milano.com
Subject: mail.asygi.dev
Issuer: E7
SANs: mail.asygi.dev, panel.asygi.dev
Subject: murgi.de
Issuer: E7
SANs: murgi.de, www.murgi.de
Subject: srv01.matthias-dlugi.de
Issuer: R10
SANs: srv01.matthias-dlugi.de
Subject: mail-s.gw-gi.de
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: mail-s.gw-gi.de, www.mail-s.gw-gi.de
Subject: *.lgi.de
Issuer: Thawte TLS RSA CA G1
SANs: *.lgi.de, lgi.de
Subject: ldap.gi.de
Issuer: YR1
SANs: ldap.gi.de
Subject: corona.leongeorgi.de
Issuer: R12
SANs: corona.leongeorgi.de, leongeorgi.de
Subject: yrcgi.dev
Issuer: YR2
SANs: www.yrcgi.dev, yrcgi.dev
Subject: alarm.ils.lkgi.de
Issuer: SwissSign RSA TLS OV ICA 2022 - 1
SANs: alarm.ils.lkgi.de
Subject: simplevm.gi.denbi.de
Issuer: YR2
SANs: simplevm.gi.denbi.de
Subject: helgi.dev
Issuer: YE2
SANs: bib.helgi.dev, boka.helgi.dev, heima.helgi.dev, helgi.dev, helgiflix.helgi.dev, matrix.helgi.dev, ombi.helgi.dev
Subject: *.legi.de
Issuer: R13
SANs: *.legi.de
Subject: *.legi.de
Issuer: R13
SANs: *.legi.de
Subject: spektralis-bgi.de
Issuer: YE1
SANs: spektralis-bgi.de, www.spektralis-bgi.de
Subject: *.test.ava-digi.de
Issuer: YR1
SANs: *.test.ava-digi.de
Subject: gs-scale-uc1-83-9vmaogi.dev.p.ccaiplatform.com
Issuer: WR3
SANs: gs-scale-uc1-83-9vmaogi.api.dev.p.ccaiplatform.com, gs-scale-uc1-83-9vmaogi.cb.dev.p.ccaiplatform.com, gs-scale-uc1-83-9vmaogi.dev.p.ccaiplatform.com, gs-scale-uc1-83-9vmaogi.media.dev.p.ccaiplatform.com, gs-scale-uc1-83-9vmaogi.va-ss.dev.p.ccaiplatform.com, s-9vmaogi.api.dev.p.ccaiplatform.com, s-9vmaogi.cb.dev.p.ccaiplatform.com, s-9vmaogi.dev.p.ccaiplatform.com, s-9vmaogi.media.dev.p.ccaiplatform.com, s-9vmaogi.va-ss.dev.p.ccaiplatform.com
Subject: *.pid-gi.de
Issuer: GlobalSign GCC R6 AlphaSSL CA 2025
SANs: *.pid-gi.de, pid-gi.de
Subject: www.schwigi.de
Issuer: YR2
SANs: www.schwigi.de
Subject: ngi.deec.uc.pt
Issuer: GEANT TLS RSA 1
SANs: ngi.deec.uc.pt
Subject: akeneo.oktalogi.dev
Issuer: R3
SANs: akeneo.oktalogi.dev
Subject: www.kriegi.de
Issuer: R12
SANs: www.kriegi.de
Subject: novum-rgi.de
Issuer: SSL.com TLS Issuing RSA CA R1
SANs: *.novum-rgi.de, novum-rgi.de
Subject: *.services.defas-fgi.de
Issuer: Amazon RSA 2048 M01
SANs: *.services.defas-fgi.de, services.defas-fgi.de
Subject: activation.asygi.dev
Issuer: R12
SANs: activation.asygi.dev
Subject: plesk.gi.de
Issuer: YR1
SANs: plesk.gi.de
Subject: dev.pmgi.de
Issuer: R13
SANs: dev.pmgi.de
IPs Citing This Domain
Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.
178.254.33.220:80
href · ×3
178.254.33.220:443
href · ×3
116.202.20.14:8080
href · ×2
139.19.206.213:443
href · ×1
85.214.29.49:443
href · ×1
89.163.212.80:443
href · ×1
141.83.63.80:443
href · ×1
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
No origin-IP leaks detected (yet)
Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.
Threat Intelligence
Domain threat-intel pending
Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.
History
Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.
| Type | Value | First seen | Last seen |
|---|---|---|---|
| TXT | apple-domain-verification=77DB8h2m3GAythTi | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| TXT | v=spf1 include:agenturserver.de include:hostedoffice.ag include:spf.mailjet.com include:_spf.zimpel.de include:spf.converve.com include:lists.gi.de ip4:89.63.17.254 ~all | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| MX | 50 mx4.agenturserver.de | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| NS | ns2.domaindiscount24.net | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| TXT | 3gpbddcr8gyntbrwjmd98sxy3ft4zb95 | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| TXT | ZOOM_verify_GtledlCOQAu2oeYxjYxb-w | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| TXT | _q2om0r68i4a6smegptr4yp0pbkn288r | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| MX | 10 mx2.agenturserver.de | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| TXT | MS=8F9FBC778148FA5AADA6CFEC38885461680DB43D | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| MX | 20 mx3.agenturserver.de | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| TXT | _nvba4nzrxn593ip0ghitt0o2ysntc7r | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| TXT | 4vhr9dpxg3v6xx7tn3w6ycs0n3sw89hb | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| NS | ns1.domaindiscount24.net | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| A | 157.97.35.173 | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| MX | 10 mx1.agenturserver.de | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| NS | ns3.domaindiscount24.net | 2026-05-26 13:52:57.285 | 2026-07-24 10:01:02.801 |
| TXT | _loihszftfvhfm5tdhpl7x6ez1jlg72m | 2026-06-25 20:05:56.415 | 2026-07-24 10:01:02.801 |