Domain
ahrefs.com
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of ahrefs.com
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
Hosting IPs
—
A/AAAA targets
Subdomains
—
CT + scan + body
Record Types
—
seen in DNS
Observed Certs
—
in our scans
DNS Records
A
104.18.39.141, 172.64.148.115
AAAA
2606:4700:4404::ac40:9473, 2606:4700:440b::6812:278d, 2606:4700:440d::ac40:9473, 2a06:98c1:3106::6812:278d
MX
10 aspmx.l.google.com, 20 alt1.aspmx.l.google.com, 30 alt2.aspmx.l.google.com, 40 aspmx2.googlemail.com, 50 aspmx3.googlemail.com
NS
adam.ns.cloudflare.com, yolanda.ns.cloudflare.com
TXT
MS=ms30123980, ZOOM_verify_vwLxddoJ4BT7INd3pWZ29h, _czurbfl9lcsmxcfm7e8rcm1go23ugsh, ahrefs-site-verification_7f23931093dcaea634532fe48680938642809321bfb6d2eedcefdc2b180c0690, anthropic-domain-verification-e2z6y4=vsM2WEZSOKgqjdfmonv4R11Bn, cursor-domain-verification-g7a9ep=eh80vslD0Dk9aAMP9AnlcfPhI, facebook-domain-verification=td8brmt3wu6dbdsm0q071p91in8qx8, google-site-verification=K5q-tV3hv4u12bcTGUTuPX9tGJO8bamXuVkoK41nHnI
CNAME
—
CAA
0 issue "comodoca.com", 0 issue "digicert.com; cansignhttpexchanges=yes", 0 issue "letsencrypt.org", 0 issue "pki.goog; cansignhttpexchanges=yes", 0 issue "ssl.com", 0 issuewild "comodoca.com", 0 issuewild "digicert.com; cansignhttpexchanges=yes", 0 issuewild "letsencrypt.org"
WHOIS / Registration
Registration data planned
Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.
Subdomains
Subdomain enumeration pending
Every subdomain ever issued a TLS cert under this apex — extracted from Certificate Transparency logs, our own scan observations and body references.
Tech Stack
Tech detection pending
Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.
TLS Certificates
Certificate observations pending
TLS certs naming this domain in subject or SANs will appear here as our scan-layer catches them.
IPs Citing This Domain
Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.
188.137.225.25:443
href · ×8
43.154.68.239:443
href · ×3
45.128.220.38:443
href · ×2
43.156.59.126:443
href · ×2
89.117.55.87:80
href · ×2
161.35.226.53:443
href · ×2
139.196.192.34:443
href · ×2
160.16.228.59:80
href · ×1
123.56.169.116:443
href · ×1
81.68.215.194:443
href · ×1
134.209.117.220:443
href · ×1
146.190.124.60:443
href · ×1
3.109.32.38:80
href · ×1
37.27.8.93:443
href · ×1
18.225.87.15:443
href · ×1
18.225.87.15:443
og:url · ×1
18.119.64.251:443
href · ×1
146.59.77.240:443
href · ×1
134.122.80.8:80
href · ×1
161.116.196.228:443
href · ×1
165.232.46.83:443
href · ×1
134.209.117.220:80
href · ×1
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
| Origin IP | Origin ASN | CDN ASN | Confidence | Reasoning |
|---|---|---|---|---|
| 209.146.32.112 | AS174 | AS13335 | 95% | cert 932368e2… served by 209.146.32.112 (AS174) carries SAN ahrefs.com which currently resolves through Cloudflare (AS13335) at 172.64.148.115, 104.18.39.141, 2606:4700:440d::ac40:9473, 2606:4700:440b::6812:278d |
| 37.230.115.100 | AS29182 | AS13335 | 95% | cert b8f07cc3… served by 37.230.115.100 (AS29182) carries SAN ahrefs.com which currently resolves through Cloudflare (AS13335) at 172.64.148.115, 104.18.39.141, 2606:4700:440d::ac40:9473, 2606:4700:440b::6812:278d |
| 168.100.140.249 | AS140577 | AS13335 | 95% | cert 932368e2… served by 168.100.140.249 (AS140577) carries SAN ahrefs.com which currently resolves through Cloudflare (AS13335) at 172.64.148.115, 104.18.39.141, 2606:4700:440d::ac40:9473, 2606:4700:440b::6812:278d |
Threat Intelligence
Domain threat-intel pending
Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.
History
Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.
| Type | Value | First seen | Last seen |
|---|---|---|---|
| MX | 40 aspmx2.googlemail.com | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| CAA | 0 issue "letsencrypt.org" | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| MX | 20 alt1.aspmx.l.google.com | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | google-site-verification=K5q-tV3hv4u12bcTGUTuPX9tGJO8bamXuVkoK41nHnI | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | probo-verification=dc9164e38ce33d0443651434cf3706d3 | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | MS=ms30123980 | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| NS | yolanda.ns.cloudflare.com | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| A | 172.64.148.115 | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | ahrefs-site-verification_7f23931093dcaea634532fe48680938642809321bfb6d2eedcefdc2b180c0690 | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | tiktok-developers-site-verification=nNjA0IcpClOFdXhOtTktyLW5yxjVINlo | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | facebook-domain-verification=td8brmt3wu6dbdsm0q071p91in8qx8 | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| A | 104.18.39.141 | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| MX | 50 aspmx3.googlemail.com | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| CAA | 0 issue "pki.goog; cansignhttpexchanges=yes" | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | stripe-verification=5050a531839b76be29b99cc3258d7154e48a08398c8055b83f2a459946a61fb1 | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| MX | 30 alt2.aspmx.l.google.com | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | stripe-verification=ca8ab9acd029bc87973ee8fb44bbe9869f1766dd5d5eff0c90e67913fcde2060 | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| MX | 10 aspmx.l.google.com | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | rippling-domain-verification=ab40c9f77084cd92 | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | lovable_verification=5OlFH5uw1DaIdLO8ENO7 | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| AAAA | 2a06:98c1:3106::6812:278d | 2026-05-26 02:30:04.450 | 2026-06-26 02:05:01.915 |
| TXT | stripe-verification=CB383DD55808E99BCC1075D20642A09F2CB558B7F3AA059ACD8C0E8556DB986A | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | letaido-domain-verification-zhgccj=K4iuIIIGIrzZZj5O7Mfjw8fqy | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| CAA | 0 issue "ssl.com" | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| CAA | 0 issue "comodoca.com" | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| CAA | 0 issuewild "digicert.com; cansignhttpexchanges=yes" | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | linear-domain-verification=p6kyij7memdw | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | v=spf1 include:sendgrid.net include:_spf.google.com include:spf.mail.intercom.io include:servers.mcsv.net include:mg-spf.greenhouse.io ~all | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | _czurbfl9lcsmxcfm7e8rcm1go23ugsh | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| AAAA | 2606:4700:4404::ac40:9473 | 2026-05-26 02:30:04.450 | 2026-06-26 02:05:01.915 |
| CAA | 0 issuewild "ssl.com" | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | openai-domain-verification=dv-F3FZfMZ7tyPEwJUf4jrwRTXa | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | ZOOM_verify_vwLxddoJ4BT7INd3pWZ29h | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| NS | adam.ns.cloudflare.com | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | anthropic-domain-verification-e2z6y4=vsM2WEZSOKgqjdfmonv4R11Bn | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| CAA | 0 issue "digicert.com; cansignhttpexchanges=yes" | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| CAA | 0 issuewild "comodoca.com" | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | google-site-verification=V7LJIPB3UIcXIvbUUew6uuGP0WRmaOSRQ-I3si_JLBI | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| CAA | 0 issuewild "letsencrypt.org" | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| CAA | 0 issuewild "pki.goog; cansignhttpexchanges=yes" | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | notion_verify_t!EL~G#eXVsE0X1T+Gn>8=>.dNj_p#9k774,Y}Xjz!K+J._bZ+ms!?eHE?5tz72.h_kAv% | 2026-05-26 02:30:04.450 | 2026-07-28 11:44:59.719 |
| TXT | cursor-domain-verification-g7a9ep=eh80vslD0Dk9aAMP9AnlcfPhI | 2026-07-14 19:59:57.881 | 2026-07-28 11:44:59.719 |
| AAAA | 2606:4700:440b::6812:278d | 2026-07-15 20:04:13.980 | 2026-07-28 11:44:59.719 |
| AAAA | 2606:4700:440d::ac40:9473 | 2026-07-15 20:04:13.980 | 2026-07-28 11:44:59.719 |