Domain

php.net

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .net TLD

Run a live full scan of php.net

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now

Hosting IPs

—

A/AAAA targets

Subdomains

—

CT + scan + body

Record Types

—

seen in DNS

Observed Certs

—

in our scans

DNS Records

185.85.0.29

AAAA

2a02:cb40:200::1ad

0 php-smtp4-ip4.php.net

dns1.easydns.com, dns2.easydns.net, dns3.easydns.org, dns4.easydns.info

TXT

google-site-verification=O6K8miDfoyFI4IjIQ13207kl978tUNg1HYv3G-bLabo, v=spf1 ip4:140.211.15.143 ip4:45.112.84.5 ip4:142.93.197.176 ip6:2604:a880:400:d0::1c74:1001 ip6:2a02:cb43:8000::1102 ip4:157.90.121.187 ip6:2a01:4f8:1c1e:416d::1 ~all

CNAME

—

CAA

—

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Subdomain enumeration pending

Every subdomain ever issued a TLS cert under this apex — extracted from Certificate Transparency logs, our own scan observations and body references.

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

Certificate observations pending

TLS certs naming this domain in subject or SANs will appear here as our scan-layer catches them.

IPs Citing This Domain

Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.

198.12.241.4:80 href · ×18

63.32.1.223:80 href · ×7

108.132.205.181:443 href · ×7

43.206.158.171:80 href · ×6

107.21.226.112:443 href · ×4

49.212.189.116:443 href · ×4

52.70.100.164:443 href · ×4

40.69.218.180:80 href · ×3

171.111.221.130:80 href · ×3

216.86.145.146:443 href · ×3

93.157.0.164:80 href · ×2

3.110.172.175:80 href · ×2

193.25.222.197:443 href · ×2

98.82.63.112:443 href · ×2

37.221.195.136:443 href · ×2

185.13.148.125:443 href · ×2

216.86.145.144:80 href · ×2

208.100.42.186:80 href · ×2

192.240.166.131:80 href · ×2

167.114.60.99:80 href · ×2

208.69.120.252:80 href · ×2

130.61.41.11:443 href · ×2

137.74.198.114:443 href · ×2

192.240.189.85:443 href · ×2

169.213.174.123:8888 href · ×2

195.133.40.50:443 href · ×2

208.100.42.187:443 href · ×2

104.207.237.66:443 href · ×2

103.216.116.192:80 href · ×2

68.183.131.149:443 href · ×2

213.171.163.55:80 href · ×2

109.174.144.64:80 href · ×2

202.181.240.110:80 href · ×2

208.53.54.178:443 href · ×2

79.96.161.221:80 href · ×2

109.203.109.170:80 href · ×2

104.207.238.138:443 href · ×2

192.240.189.87:443 href · ×2

5.1.84.169:443 href · ×2

32.184.113.142:80 href · ×2

194.4.64.28:80 href · ×2

138.197.106.82:80 href · ×2

93.157.0.164:443 href · ×2

208.69.126.5:80 href · ×2

96.241.205.3:443 href · ×2

108.255.195.206:443 href · ×2

193.225.219.3:443 href · ×2

93.157.0.165:443 href · ×2

212.164.235.67:443 href · ×2

65.21.146.131:80 href · ×2

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

No origin-IP leaks detected (yet)

Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Domain timeline pending

Passive-DNS history accumulates as our forward-DNS crawler observes A/AAAA/MX/NS/TXT records over time.