attacker-controlled.com - dns.ninja

🛡️Domain Reputation CheckBlocklist, phishing & malware status→

`attacker-controlled.com`

DNSSEC	⚠️ Not signed
A	13.248.169.48^{🇺🇸 Amazon13.248.160.0/20}
		PTR	`a904c694c05102f30.awsglobalaccelerator.com`
A	76.223.54.146^{🇺🇸 Amazon76.223.48.0/20}
NS	`ns1.afternic.com` ⭐
		A	2603:5:2126::45^{🇺🇸 GODADDY-DNS2603:5:2120::/44}
			PTR	`ns1.afternic.com`
		A	97.74.98.69^{🇺🇸 GODADDY-DNS97.74.98.0/23}
			PTR	`ns1.afternic.com`
NS	`ns2.afternic.com`
		A	2603:5:2226::45^{🇺🇸 GODADDY-DNS2603:5:2220::/44}
			PTR	`ns2.afternic.com`
		A	173.201.66.69^{🇺🇸 GODADDY-DNS173.201.66.0/23}
			PTR	`ns2.afternic.com`
NS	`verification-d3jclucsp89ganyqbydeny.ns101.verify.hn` ⚠️ Not in zone NS records
		A	13.248.169.48^{🇺🇸 Amazon13.248.160.0/20}
			PTR	`a904c694c05102f30.awsglobalaccelerator.com`
		A	76.223.54.146^{🇺🇸 Amazon76.223.48.0/20}
			PTR	`a904c694c05102f30.awsglobalaccelerator.com`
TXT	`v=spf1 -all`
SOA	`ns1.afternic.com`dns@jomax.net serial=1

`com`

	DNSSEC	🔒 Signed (DS record present)
	NS	`a.gtld-servers.net` ⭐
	NS	`b.gtld-servers.net`
	NS	`c.gtld-servers.net`
	NS	`d.gtld-servers.net`
	NS	`e.gtld-servers.net`
	NS	`f.gtld-servers.net`
	NS	`g.gtld-servers.net`
	NS	`h.gtld-servers.net`
	NS	`i.gtld-servers.net`
	NS	`j.gtld-servers.net`
	NS	`k.gtld-servers.net`
	NS	`l.gtld-servers.net`
	NS	`m.gtld-servers.net`
	SOA	`a.gtld-servers.net`nstld@verisign-grs.com serial=1786935384

Same first word

attacker-controlled.com

DNS History

10 records (5 active, 5 former)

○NSdns1.registrar-servers.com2018-08-17 → 2018-08-17 · 3 obs

● 2018-08-17 09:25:18
○ 2026-04-20 15:54:26
○ 2026-08-17 02:58:24

○NSdns2.registrar-servers.com2018-08-17 → 2018-08-17 · 3 obs

● 2018-08-17 09:25:18
○ 2026-04-20 15:54:26
○ 2026-08-17 02:58:24

●NSns1.afternic.com2026-04-20 → 2026-08-17 · 3 obs

○ 2018-08-17 09:25:18
● 2026-04-20 15:54:26
● 2026-08-17 02:58:24

●NSns2.afternic.com2026-04-20 → 2026-08-17 · 3 obs

○ 2018-08-17 09:25:18
● 2026-04-20 15:54:26
● 2026-08-17 02:58:24

●NSverification-d3jclucsp89ganyqbydeny.ns101.verify.hn2026-04-20 → 2026-08-17 · 3 obs

○ 2018-08-17 09:25:18
● 2026-04-20 15:54:26
● 2026-08-17 02:58:24

○MXmx1.privateemail.com2018-08-17 → 2018-08-17 · 3 obs

● 2018-08-17 09:25:18
○ 2026-04-20 15:54:26
○ 2026-08-17 02:58:24

○MXmx2.privateemail.com2018-08-17 → 2018-08-17 · 3 obs

● 2018-08-17 09:25:18
○ 2026-04-20 15:54:26
○ 2026-08-17 02:58:24

●A13.248.169.482026-04-20 → 2026-08-17 · 3 obs

○ 2018-08-17 09:25:18
● 2026-04-20 15:54:26
● 2026-08-17 02:58:24

○A192.64.119.1762018-08-17 → 2018-08-17 · 3 obs

● 2018-08-17 09:25:18
○ 2026-04-20 15:54:26
○ 2026-08-17 02:58:24

●A76.223.54.1462026-04-20 → 2026-08-17 · 3 obs

○ 2018-08-17 09:25:18
● 2026-04-20 15:54:26
● 2026-08-17 02:58:24

🔍 DNS Trace

📋 Delegation Chain

Zone	Nameservers	Glue
com	b.gtld-servers.net, a.gtld-servers.net, j.gtld-servers.net, f.gtld-servers.net...	-
attacker-controlled.com	ns1.afternic.com, ns2.afternic.com, verification-d3jclucsp89ganyqbydeny.ns101.verify.hn	4 records

✅ Authoritative Response

Server:173.201.66.69

NS records: ns1.afternic.com, ns2.afternic.com, verification-d3jclucsp89ganyqbydeny.ns101.verify.hn

🔒 DNSSEC Status

⚠️ Insecure (no DNSSEC)

No DS record for attacker-controlled.com (unsigned zone)

⏱️ Timing

Total: 4397ms | Queries: -

📄 Records

Type	Count	Sample Data
A	2	`76.223.54.146, 13.248.169.48`
NS	2	`ns1.afternic.com, ns2.afternic.com`
MX	1	`. (pri: 0)`
TXT	1	`v=spf1 -all`
SOA	1	`ns2.afternic.com dns.jomax.net`

📌 Glue Records Collected

Total: 4

Out-of-bailiwick: 4 (ns1.afternic.com, ns1.afternic.com, ns2.afternic.com...)

Analysis

IP Addresses

attacker-controlled.com points to the IP addresses 13.248.169.48 and 76.223.54.146

Additional host names — www.ybc.cn, tour-ksc.com, elitepiano.com and two others — share IP numbers with attacker-controlled.com.

Name Servers

attacker-controlled.com is delegated to three name servers: ns1.afternic.com, ns2.afternic.com and verification-d3jclucsp89ganyqbydeny.ns101.verify.hn.

The name servers of attacker-controlled.com overlap at least partially with those of other domains — among them wallcoupon.com, 324605225r.cdn30s.com, vlog.company and two more.

These name servers commonly appear alongside the name servers verification-frb6pqdkkjlns5j4tthxc3.ns101.verify.hn and verification-ilzyovyxkjcylcmj8rbffy.ns101.verify.hn.

ns1.afternic.com, ns2.afternic.com and verification-d3jclucsp89ganyqbydeny.ns101.verify.hn each resolve to two IP addresses: ns1.afternic.com resolves to 97.74.98.69 and 2603:5:2126::45; ns2.afternic.com resolves to 173.201.66.69 and 2603:5:2226::45; verification-d3jclucsp89ganyqbydeny.ns101.verify.hn resolves to 13.248.169.48 and 76.223.54.146.