# Al Mayadeen Origin Server IPs — Leaked via DNS/SPF
# Date: Feb 28, 2026

## SPF RECORD (CRITICAL — reveals origin IPs behind Cloudflare)
v=spf1 a mx mx:mx1.almayadeen.net mx:mx2.almayadeen.net ip4:80.81.152.41 ip4:89.249.221.244 -all

## ORIGIN IP RANGE 1: 80.81.152.x
80.81.152.41       — SPF origin (web server behind Cloudflare)
80.81.152.37       — mail.almayadeen.net (secondary mail)

## ORIGIN IP RANGE 2: 89.249.221.x
89.249.221.244     — SPF origin + mx3.almayadeen.net (dual role: web + mail)
89.249.221.245     — ftp.almayadeen.net (FTP server)
89.249.221.252     — mail.almayadeen.net (primary mail, 2 IPs)

## ORIGIN IP RANGE 3: 194.126.9.x
194.126.9.230      — mx1.almayadeen.net (primary MX server)

## MX RECORDS
almayadeen.net MX preference=1  mx1.almayadeen.net → 194.126.9.230
almayadeen.net MX preference=2  mx3.almayadeen.net → 89.249.221.244

## TXT RECORDS
google-site-verification=9ccXUvjKiv9Reva0HD4QNVTFHO6SidPD7-Z7KRt3gqU
google-site-verification=PNUy--Lzy6bkRJcScDS9HvytsuwjhHETuiYIXUAMDPU
google-site-verification=QTUyXVxdcLNuugOu2W47Y2iST1MJpmNa8loe7p7FwIk
loaderio=e26421201d5e0b60d1522ebe1a7c770f
v=spf1 (see above)

## A RECORDS (via DNS)
mail.almayadeen.net   → 89.249.221.252, 80.81.152.37
ftp.almayadeen.net    → 89.249.221.245
smtp.almayadeen.net   → (no record)
webmail.almayadeen.net → (no record)
cpanel.almayadeen.net  → (no record)

## PROBING RESULTS
All origin IPs TIMEOUT on HTTP and HTTPS from US
— Firewalled to accept only Cloudflare IP ranges
— FTP (port 21) not tested
— SMTP (port 25/587) not tested

## .env FILES PATTERN
ALL Al Mayadeen subdomains have .env files blocked by Cloudflare WAF:
portal-api.almayadeen.net/.env       → 403 (4836 bytes — Cloudflare block page)
alpha-ar-admin.almayadeen.net/.env   → 403 (4836 bytes)
interactions.almayadeen.net/.env     → 403 (4836 bytes)
ai.almayadeen.net/.env               → 403 (4836 bytes)
— If origin IPs were accessible, .env files would likely be exposed

## MANGOPULSE.NET DNS
mangopulse.net → Cloudflare IPs (104.26.1.219, 172.67.71.194, 104.26.0.219)
NS: bowen.ns.cloudflare.com
TXT: 2x google-site-verification tokens
No MX records found (no email infrastructure visible)