Now covering: php2shell (CVE-2026-109618 / CVE-2026-109619)
Who runs your site,and how are they handling security?
Enter a domain. OpenVMap finds the companies behind its web, DNS, mail and certificate from public data, shows what each has announced about security incidents, and tells you whom to ask next.
- Not for profit, no account
- Domains are not kept in readable form
- One request to the site's front page
53 providers tracked · 38 entries from official notices · updated 2026-10-30
Why it matters
The fix comes from whoever runs the server
A flaw in the server's software is fixed by the company that manages the server, not by the site's owner. Yet many owners left the site to an agency and do not know whose servers it runs on.
OpenVMap names those companies from public DNS, routing data and the certificate, and puts what each has announced side by side.
First, find out who to ask. The fix starts there.
What you get
What the result page tells you
Whom to ask
The company behind each of web, DNS, mail and the certificate, even for a site an agency set up.
Every notice in one place
php2shell status for 53 providers, each with a link to its notice and the date it was checked.
The providers' own incidents
Incidents announced by Vercel, Railway, Zeabur, eMudhra (emSign) appear when the site uses that provider.
A message you can send
Questions for your agency or host, written for your result. Copy them and send.
No load on the site
One ordinary visit to the front page and the start of one connection to read the certificate. Nothing else.
How it works
Three steps to your next move
- 01
Enter the domain
Type your site's domain and press Check.
- 02
The providers are found
Public DNS and routing data, then the front page's answer and the certificate, name the platform and the certificate authority.
- 03
Status and next steps
Each provider's notice, what to do now, and a message to send, on one page.
Where the data comes from
Only information you can trace to a source
Each provider's status is written from what the provider announced. It can be wrong, so every entry has the date it was checked and a link to its source. No LLM is used to check a site.
- providers tracked
- 53
- entries from official notices
- 38
- last updated
- 2026-10-30
FAQ
Before you check
Does it cost anything?
No. It is a free tool run by one person, with no account to create, no paid tier and no sales contact.
Is the domain I enter stored?
Not in readable form. To avoid repeat visits to the same site, the PHP result is kept for an hour under a value the domain cannot be recovered from. No server access logs are kept.
Does checking put load on the site?
One ordinary GET of the front page and the start of one TLS connection to read who issued its certificate. No attacks, logins, directory probing or port scans.
Can it tell whether PHP is patched?
No. That is not visible from outside. The result tells you whom to ask and what to ask; confirm with the company that runs the server or your agency.
Which domains may I check?
Domains you manage or were asked to check. Result pages are not indexed by search engines.
Where does the provider status come from?
From the providers' own announcements. It can be wrong, so always check the source. Official means the provider's page; secondary means press or third party summaries. Both carry a checked date and a source.
Does unknown mean the provider has not patched?
No. It means no official notice has been found. Use the message on the result page to ask them directly.
Is an LLM used to check a site?
No. Every conclusion can be reproduced from recorded observations: public DNS, routing data, the front page's answer and the certificate.
Who runs it?
One person. The code and the provider data are public on GitHub, where corrections are welcome.
Find out who runs your site
Not for profit, no account. The domain you enter is not stored in readable form.
- Not for profit, no account
- Domains are not kept in readable form
- One request to the site's front page