nefariousplan.com - dns.ninja

`nefariousplan.com`

DNSSEC	⚠️ Not signed
A	2606:4700:3031::ac43:8a72^{🇺🇸 Cloudflare2606:4700:3031::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	2606:4700:3036::6815:38f2^{🇺🇸 Cloudflare2606:4700:3036::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	104.21.56.242^{Cloudflare104.21.48.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	172.67.138.114^{🇺🇸 Cloudflare172.67.128.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
NS	`cass.ns.cloudflare.com` ⭐
		A	2606:4700:50::adf5:3a51^{🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`cass.ns.cloudflare.com`
		A	2803:f800:50::6ca2:c051^{🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L}
			PTR	`cass.ns.cloudflare.com`
		A	2a06:98c1:50::ac40:2051^{🇺🇸 Cloudflare2a06:98c1:50::/45}
			PTR	`cass.ns.cloudflare.com`
		A	108.162.192.81^{🇺🇸 Cloudflare108.162.192.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`cass.ns.cloudflare.com`
		A	172.64.32.81^{🇺🇸 Cloudflare172.64.32.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`cass.ns.cloudflare.com`
		A	173.245.58.81^{🇺🇸 Cloudflare173.245.58.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`cass.ns.cloudflare.com`
NS	`vick.ns.cloudflare.com`
		A	2606:4700:58::adf5:3bf4^{🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`vick.ns.cloudflare.com`
		A	2803:f800:50::6ca2:c1f4^{🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L}
			PTR	`vick.ns.cloudflare.com`
		A	2a06:98c1:50::ac40:21f4^{🇺🇸 Cloudflare2a06:98c1:50::/45}
			PTR	`vick.ns.cloudflare.com`
		A	108.162.193.244^{🇺🇸 Cloudflare108.162.193.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`vick.ns.cloudflare.com`
		A	172.64.33.244^{🇺🇸 Cloudflare172.64.33.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`vick.ns.cloudflare.com`
		A	173.245.59.244^{🇺🇸 Cloudflare173.245.59.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`vick.ns.cloudflare.com`
MX	`aspmx.l.google.com` ⭐
		A	2607:f8b0:4004:c09::1a^{🇺🇸 Google2607:f8b0:4004::/48}
			PTR	`bh-in-f26.1e100.net`
		A	142.251.111.26^{🇺🇸 Google142.251.111.0/24}
			PTR	`bk-in-f26.1e100.net`
MX	`alt1.aspmx.l.google.com`⁽²⁰⁾
		A	2800:3f0:4003:c0f::1b^{🇨🇱 Google2800:3f0:4003::/48}
		A	108.177.123.26^{🇺🇸 Google108.177.123.0/24}
			PTR	`lcscld-in-f26.1e100.net`
MX	`alt2.aspmx.l.google.com`⁽³⁰⁾
		A	2a00:1450:400b:c02::1b^{🇮🇪 Google2a00:1450:400b::/48}
			PTR	`dj-in-f27.1e100.net`
		A	172.253.116.27^{🇺🇸 Google172.253.116.0/24}
			PTR	`dj-in-f27.1e100.net`
MX	`aspmx2.googlemail.com`⁽⁴⁰⁾
		A	2800:3f0:4003:c0f::1a^{🇨🇱 Google2800:3f0:4003::/48}
		A	108.177.123.26^{🇺🇸 Google108.177.123.0/24}
			PTR	`lcscld-in-f26.1e100.net`
MX	`aspmx3.googlemail.com`⁽⁵⁰⁾
		A	2a00:1450:400b:c02::1a^{🇮🇪 Google2a00:1450:400b::/48}
			PTR	`dj-in-f26.1e100.net`
		A	172.253.116.26^{🇺🇸 Google172.253.116.0/24}
			PTR	`dj-in-f26.1e100.net`
TXT	`google-site-verification=fLVpawkBcQ8G5-OziOavW93dXKf5l3h38ipYB9am_8M`
TXT	`google-site-verification=hfl3I-Haj1Sd9J-qceepKPqhnaVuFdFrW45AjUGGSOI`
TXT	`v=spf1 include:_spf.google.com ~all`
HTTPS	HTTP/3, HTTP/2 ✓ hints match
		IPv4 hints	104.21.56.242, 172.67.138.114
		IPv6 hints	2606:4700:3031::ac43:8a72, 2606:4700:3036::6815:38f2
		ECH	X25519, HKDF-SHA256 + AES-128-GCM draft, id=179, name=cloudflare-ech.com
SOA	`cass.ns.cloudflare.com`dns@cloudflare.com serial=2410072374

`com`

	DNSSEC	🔒 Signed (DS record present)
	NS	`a.gtld-servers.net` ⭐
	NS	`b.gtld-servers.net`
	NS	`c.gtld-servers.net`
	NS	`d.gtld-servers.net`
	NS	`e.gtld-servers.net`
	NS	`f.gtld-servers.net`
	NS	`g.gtld-servers.net`
	NS	`h.gtld-servers.net`
	NS	`i.gtld-servers.net`
	NS	`j.gtld-servers.net`
	NS	`k.gtld-servers.net`
	NS	`l.gtld-servers.net`
	NS	`m.gtld-servers.net`
	SOA	`a.gtld-servers.net`nstld@verisign-grs.com serial=1784877197

Same first word

nefariousplan.com

DNS History

18 records (11 active, 7 former)

●NScass.ns.cloudflare.com2026-04-22 → 2026-07-24 · 3 obs

○ 2017-08-29 07:17:42
● 2026-04-22 02:08:42
● 2026-07-24 07:19:04

○NSns13.domaincontrol.com2015-05-31 → 2017-08-29 · 4 obs

● 2015-05-31 23:12:10
● 2017-08-29 07:17:42
○ 2026-04-22 02:08:42
○ 2026-07-24 07:19:04

○NSns14.domaincontrol.com2015-05-31 → 2017-08-29 · 4 obs

● 2015-05-31 23:12:10
● 2017-08-29 07:17:42
○ 2026-04-22 02:08:42
○ 2026-07-24 07:19:04

●NSvick.ns.cloudflare.com2026-04-22 → 2026-07-24 · 3 obs

○ 2017-08-29 07:17:42
● 2026-04-22 02:08:42
● 2026-07-24 07:19:04

●MXalt1.aspmx.l.google.com2015-05-31 → 2026-07-24 · 2 obs

● 2015-05-31 23:12:10
● 2026-07-24 07:19:04

●MXalt2.aspmx.l.google.com2015-05-31 → 2026-07-24 · 2 obs

● 2015-05-31 23:12:10
● 2026-07-24 07:19:04

●MXaspmx.l.google.com2015-05-31 → 2026-07-24 · 2 obs

● 2015-05-31 23:12:10
● 2026-07-24 07:19:04

●MXaspmx2.googlemail.com2015-05-31 → 2026-07-24 · 2 obs

● 2015-05-31 23:12:10
● 2026-07-24 07:19:04

●MXaspmx3.googlemail.com2015-05-31 → 2026-07-24 · 2 obs

● 2015-05-31 23:12:10
● 2026-07-24 07:19:04

●A104.21.56.2422026-04-22 → 2026-07-24 · 6 obs

○ 2017-08-29 07:17:42
● 2026-04-22 02:08:42
○ 2026-05-01 06:01:32
○ 2026-06-03 19:48:12
● 2026-07-09 07:59:20
● 2026-07-24 07:19:04

○A138.68.30.2472026-05-01 → 2026-06-03 · 5 obs

○ 2026-04-22 02:08:42
● 2026-05-01 06:01:32
● 2026-06-03 19:48:12
○ 2026-07-09 07:59:20
○ 2026-07-24 07:19:04

●A172.67.138.1142026-04-22 → 2026-07-24 · 6 obs

○ 2017-08-29 07:17:42
● 2026-04-22 02:08:42
○ 2026-05-01 06:01:32
○ 2026-06-03 19:48:12
● 2026-07-09 07:59:20
● 2026-07-24 07:19:04

○A184.168.221.302015-05-31 → 2016-09-20 · 4 obs

● 2015-05-31 23:12:10
● 2016-09-20 08:59:22
○ 2017-08-29 07:17:42
○ 2026-07-24 07:19:04

○A23.227.38.322017-08-29 → 2017-08-29 · 4 obs

○ 2016-09-20 08:59:22
● 2017-08-29 07:17:42
○ 2026-04-22 02:08:42
○ 2026-07-24 07:19:04

●A2606:4700:3031::ac43:8a722026-07-09 → 2026-07-24 · 3 obs

○ 2026-06-03 19:48:12
● 2026-07-09 07:59:20
● 2026-07-24 07:19:04

○A2606:4700:3032::ac43:8a722026-04-22 → 2026-04-22 · 4 obs

○ 2017-08-29 07:17:42
● 2026-04-22 02:08:42
○ 2026-05-01 06:01:32
○ 2026-07-24 07:19:04

○A2606:4700:3035::6815:38f22026-04-22 → 2026-04-22 · 4 obs

○ 2017-08-29 07:17:42
● 2026-04-22 02:08:42
○ 2026-05-01 06:01:32
○ 2026-07-24 07:19:04

●A2606:4700:3036::6815:38f22026-07-09 → 2026-07-24 · 3 obs

○ 2026-06-03 19:48:12
● 2026-07-09 07:59:20
● 2026-07-24 07:19:04

🔍 DNS Trace

📋 Delegation Chain

Zone	Nameservers	Glue
com	a.gtld-servers.net, b.gtld-servers.net, c.gtld-servers.net, d.gtld-servers.net...	-
nefariousplan.com	cass.ns.cloudflare.com, vick.ns.cloudflare.com	12 records

✅ Authoritative Response

Server:108.162.193.244

NS records: cass.ns.cloudflare.com, vick.ns.cloudflare.com

🔒 DNSSEC Status

⚠️ Insecure (no DNSSEC)

No DS record for nefariousplan.com (unsigned zone)

⏱️ Timing

Total: 282ms | Queries: -

📄 Records

Type	Count	Sample Data
A	2	`172.67.138.114, 104.21.56.242`
AAAA	2	`2606:4700:3036::6815:38f2, 2606:4700:3031::ac43:8a72`
NS	2	`cass.ns.cloudflare.com, vick.ns.cloudflare.com`
MX	5	`aspmx.l.google.com (pri: 10), alt1.aspmx.l.google.com (pri: 20)...`
TXT	3	`google-site-verification=fLVpawkBcQ8G5-O, google-site-verification=hfl3I-Haj1Sd9J-...`
HTTPS	1	`{"priority":1,"target":".","alpn":["h3",`
SOA	1	`cass.ns.cloudflare.com dns.cloudflare.co`

📌 Glue Records Collected

Total: 12

Out-of-bailiwick: 12 (cass.ns.cloudflare.com, cass.ns.cloudflare.com, cass.ns.cloudflare.com...)

Analysis

IP Addresses

nefariousplan.com resolves to four IP addresses: 104.21.56.242, 172.67.138.114, 2606:4700:3031::ac43:8a72 and 2606:4700:3036::6815:38f2.

rtplive-wings365.xyz, motherboardusermanuals.com, revista-autoclub.al plus two other host names have IP numbers in common with nefariousplan.com.

Name Servers

The NS records for nefariousplan.com delegate to cass.ns.cloudflare.com and vick.ns.cloudflare.com.

The name server configuration of nefariousplan.com is shared with other domains, for instance iloveromania.eu, momenticmarketing.com, prank.ee and two others.

nefariousplan.com partially shares its NS delegation with several other domains, including accessacademies.org, digimatiq.com, tegro.finance and two others.

These name servers regularly co-occur with the name servers nitin.ns.cloudflare.com, etta.ns.cloudflare.com and aragorn.ns.cloudflare.com.

Hosts with 6 IP addresses each:

cass.ns.cloudflare.com maps to 108.162.192.81, 172.64.32.81, 173.245.58.81 and 3 additional IP addresses.

vick.ns.cloudflare.com maps to 108.162.193.244, 172.64.33.244, 173.245.59.244 and 3 additional IP addresses.

Mail Servers

nefariousplan.com is handled by five mail servers: aspmx2.googlemail.com, aspmx3.googlemail.com, aspmx.l.google.com and two others.

At least some of the mail servers used by nefariousplan.com are shared with other domains: ns500742.ns500731.ns500754.ns500754.ns500742.ns500705.ns500671.ns500671.ns500649.ns500688.ns500291.ns500291.ns500153.tenderladiesbz.com, bozzy.org, williamsgroupauto.com and two others among them.

These mail servers are often deployed together with alt2.aspmx.l.google.com, alt1.aspmx.l.google.com, alt4.aspmx.l.google.com and 3 other mail servers.

Host names pointing to two IP addresses:

The A records for aspmx2.googlemail.com return 108.177.123.26 and 2800:3f0:4003:c0f::1a.

The A records for aspmx3.googlemail.com return 172.253.116.26 and 2a00:1450:400b:c02::1a.

The A records for aspmx.l.google.com return 142.251.111.26 and 2607:f8b0:4004:c09::1a.

The A records for alt1.aspmx.l.google.com return 108.177.123.26 and 2800:3f0:4003:c0f::1b.

The A records for alt2.aspmx.l.google.com return 172.253.116.27 and 2a00:1450:400b:c02::1b.

aspmx2.googlemail.com and alt1.aspmx.l.google.com each have 108.177.123.26 IP addresses.