Domain

dev.w3.org

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .org TLD

Run a live full scan of dev.w3.org

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now

Hosting IPs

A/AAAA targets

Subdomains

—

CT + scan + body

Record Types

seen in DNS

Observed Certs

—

in our scans

DNS Records

104.18.22.19, 104.18.23.19

AAAA

2606:4700::6812:1613, 2606:4700::6812:1713

—

TXT

—

CNAME

—

CAA

—

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Subdomain enumeration pending

Every subdomain ever issued a TLS cert under this apex — extracted from Certificate Transparency logs, our own scan observations and body references.

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

Certificate observations pending

TLS certs naming this domain in subject or SANs will appear here as our scan-layer catches them.

IPs Citing This Domain

Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.

216.92.193.11:443 href · ×4

95.111.232.228:80 href · ×3

202.131.65.242:443 href · ×2

186.96.138.170:443 href · ×2

159.69.117.114:443 href · ×2

113.192.242.126:80 href · ×2

109.195.18.49:443 href · ×2

160.218.111.93:8080 href · ×1

200.17.33.176:443 href · ×1

64.23.146.196:80 href · ×1

65.21.191.85:443 href · ×1

54.188.135.36:80 href · ×1

51.77.116.8:8000 href · ×1

90.24.144.130:8000 href · ×1

172.245.177.71:8000 href · ×1

64.227.62.163:443 href · ×1

114.32.96.3:80 href · ×1

143.195.1.177:443 href · ×1

38.191.33.165:443 href · ×1

177.223.42.149:443 href · ×1

178.62.67.75:443 href · ×1

116.62.226.246:443 href · ×1

32.185.83.197:443 href · ×1

24.250.128.88:8080 href · ×1

198.61.161.17:80 href · ×1

200.17.32.183:80 href · ×1

86.58.127.16:443 href · ×1

129.80.61.166:80 href · ×1

168.181.186.51:443 href · ×1

207.180.202.249:443 href · ×1

45.63.74.167:443 href · ×1

206.12.93.191:80 href · ×1

177.38.246.92:443 href · ×1

177.104.179.214:443 href · ×1

194.163.238.132:8080 href · ×1

143.47.118.120:80 href · ×1

196.21.228.150:443 href · ×1

103.13.102.13:443 href · ×1

200.17.33.176:80 href · ×1

125.184.218.48:443 href · ×1

38.191.33.165:80 href · ×1

37.187.152.43:443 href · ×1

200.156.24.147:443 href · ×1

90.3.153.24:8000 href · ×1

52.28.128.92:443 href · ×1

83.212.105.110:443 href · ×1

200.201.183.213:8080 href · ×1

212.87.28.249:80 href · ×1

16.54.30.94:80 href · ×1

31.13.203.190:8080 href · ×1

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

No origin-IP leaks detected (yet)

Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.

Type	Value	First seen	Last seen
A	104.18.22.19	2026-05-26 00:17:38.499	2026-07-28 19:39:40.097
AAAA	2606:4700::6812:1713	2026-05-26 00:17:38.499	2026-07-28 19:39:40.097
AAAA	2606:4700::6812:1613	2026-05-26 00:17:38.499	2026-07-28 19:39:40.097
A	104.18.23.19	2026-05-26 00:17:38.499	2026-07-28 19:39:40.097