rootkit.finance - dns.ninja

`rootkit.finance`

DNSSEC	⚠️ Not signed
A	2406:da1e:214:c900:f7bb:94ff:fb15:e36c^{🇨🇳 Amazon2406:da1e::/38}
A	2600:1f18:6a07:601:3a2e:6474:85a2:7d3b^{🇺🇸 Amazon2600:1f18:6000::/35 AMAZON EC2 IAD prefix}
A	2600:1f1c:6db:8800:1bb2:674a:e955:729c^{🇺🇸 Amazon2600:1f1c:400::/38 AMAZON AWS}
A	2a01:4f8:1c1e:d6f1::1^{🇩🇪 Hetzner2a01:4f8::/32 HETZNER-IPv6-BLK}
A	2a01:4ff:f0:5f41::1^{🇺🇸 HETZNER-CLOUD2-AS2a01:4ff::/40 HETZNER-IPv6-BLK}
A	2a01:4ff:1f0:dd50::1^{🇩🇪 HETZNER-CLOUD3-AS2a01:4ff:100::/40 HETZNER-IPv6-BLK}
A	2a05:d014:179b:c400:2fc6:8141:276a:b7e9^{🇩🇪 Amazon2a05:d014:1400::/38}
A	2a05:d018:1d22:801:3286:665a:133:329d^{🇮🇪 Amazon2a05:d018:1000::/36 EC2 DUB Prefix}
A	5.78.156.59^{🇺🇸 HETZNER-CLOUD3-AS5.78.156.0/24}
A	5.161.47.86^{🇺🇸 HETZNER-CLOUD2-AS5.161.47.0/24}
A	195.201.128.179^{🇩🇪 Hetzner195.201.0.0/16 HETZNER-DC}
NS	`ns1.dns-redirect.com` ⭐
		A	5.161.47.86^{🇺🇸 HETZNER-CLOUD2-AS5.161.47.0/24}
			PTR	`static.86.47.161.5.clients.your-server.de`
		A	5.161.230.87^{🇺🇸 HETZNER-CLOUD2-AS5.161.230.0/24}
			PTR	`static.87.230.161.5.clients.your-server.de`
		A	195.201.128.179^{🇩🇪 Hetzner195.201.0.0/16 HETZNER-DC}
			PTR	`static.179.128.201.195.clients.your-server.de`
NS	`ns2.dns-redirect.com`
		A	76.223.91.20^{🇺🇸 Amazon76.223.80.0/20}
			PTR	`ad988eeb126877ff9.awsglobalaccelerator.com`
		A	166.117.68.124^{🇺🇸 Amazon166.117.64.0/20}
			PTR	`ad988eeb126877ff9.awsglobalaccelerator.com`
TXT	`afternic-verification-aGHTsEA2nLa7KRqzmJySAx`
TXT	`95b3a950-315c-45b8-937a-b865ebeb043a`
TXT	`abuse-report=mailto:abuse@redirhub.com`
SOA	`ns1.dns-redirect.com`admin@dns.com 2024-07-29 #1

`finance`

	DNSSEC	🔒 Signed (DS record present)
	NS	`v0n0.nic.finance` ⭐
	NS	`v0n1.nic.finance`
	NS	`v0n2.nic.finance`
	NS	`v0n3.nic.finance`
	NS	`v2n0.nic.finance`
	NS	`v2n1.nic.finance`
	SOA	`v0n0.nic.finance`hostmaster@donuts.email serial=1786440994

⚠️ On DNS blocklist: spam-tlds

Same first word

rootkit.net.cn

rootkit.it

rootkit.se

rootkit.io

rootkit.de

rootkit.org

rootkit.hu

rootkit.me

rootkit.com.cn

rootkit.fr

rootkit.info

rootkit.finance

rootkit.dk

rootkit.ir

rootkit.nl

rootkit.es

rootkit.cc

rootkit.be

rootkit.us

rootkit.ca

rootkit.one

rootkit.ru

rootkit.com

rootkit.co

rootkit.pl

rootkit.eu

Similar names

ototrik.com

ortokit.com

kitroot.com

rotokit.com

trikoot.net

otkrito.com

tortiko.ru

otkrito.ru

irottko.hu

kotrito.com

kotorit.com

trikoto.com

irottko.com

tikroot.com

triokto.de

rikotto.nl

otkrito.lv

trikoto.de

DNS History

45 records (13 active, 32 former)

○NS5579.ns1.abovedomains.com2026-03-31 → 2026-03-31 · 4 obs

○ 2026-03-18 06:45:52
● 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
○ 2026-08-11 10:14:16

○NS5579.ns2.abovedomains.com2026-03-31 → 2026-03-31 · 4 obs

○ 2026-03-18 06:45:52
● 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
○ 2026-08-11 10:14:16

○NSns1.abovedomains.com2026-03-31 → 2026-03-31 · 4 obs

○ 2026-03-18 06:45:52
● 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
○ 2026-08-11 10:14:16

●NSns1.dns-redirect.com2026-02-20 → 2026-08-11 · 6 obs

● 2026-02-20 01:30:14
● 2026-03-18 06:45:52
○ 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
● 2026-08-11 10:14:16

○NSns1.park-my-domain.net2026-06-09 → 2026-06-09 · 4 obs

○ 2026-03-31 02:29:52
● 2026-06-09 00:12:30
○ 2026-06-10 16:25:56
○ 2026-08-11 10:14:16

○NSns2.abovedomains.com2026-03-31 → 2026-03-31 · 4 obs

○ 2026-03-18 06:45:52
● 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
○ 2026-08-11 10:14:16

●NSns2.dns-redirect.com2026-02-20 → 2026-08-11 · 6 obs

● 2026-02-20 01:30:14
● 2026-03-18 06:45:52
○ 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
● 2026-08-11 10:14:16

○NSns2.park-my-domain.net2026-06-09 → 2026-06-09 · 4 obs

○ 2026-03-31 02:29:52
● 2026-06-09 00:12:30
○ 2026-06-10 16:25:56
○ 2026-08-11 10:14:16

○MXpark-mx.above.com2026-03-31 → 2026-03-31 · 3 obs

● 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
○ 2026-08-11 10:14:16

○A103.224.212.2002026-03-31 → 2026-03-31 · 4 obs

○ 2026-03-18 06:45:52
● 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
○ 2026-08-11 10:14:16

○A157.90.33.732026-06-09 → 2026-06-09 · 4 obs

○ 2026-03-31 02:29:52
● 2026-06-09 00:12:30
○ 2026-06-10 16:25:56
○ 2026-08-11 10:14:16

○A157.90.33.742026-06-09 → 2026-06-09 · 4 obs

○ 2026-03-31 02:29:52
● 2026-06-09 00:12:30
○ 2026-06-10 16:25:56
○ 2026-08-11 10:14:16

●A195.201.128.1792026-02-20 → 2026-08-11 · 6 obs

● 2026-02-20 01:30:14
● 2026-03-18 06:45:52
○ 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
● 2026-08-11 10:14:16

●A2406:da1e:214:c900:f7bb:94ff:fb15:e36c2026-08-11 → 2026-08-11 · 3 obs

○ 2026-07-22 15:30:58
● 2026-08-11 10:14:14
● 2026-08-11 10:14:16

○A2406:da1e:214:c901:1c9:3a07:8610:664d2026-06-14 → 2026-06-14 · 4 obs

○ 2026-06-10 16:25:56
● 2026-06-14 16:26:12
○ 2026-06-24 15:48:46
○ 2026-08-11 10:14:16

○A2406:da1e:214:c901:3515:6c70:501a:c8592026-06-25 → 2026-06-25 · 4 obs

○ 2026-06-24 15:48:46
● 2026-06-25 16:32:08
○ 2026-07-05 10:26:10
○ 2026-08-11 10:14:16

○A2406:da1e:214:c901:85fa:f4eb:bb6c:9cc52026-06-10 → 2026-06-10 · 4 obs

○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
○ 2026-06-14 16:26:12
○ 2026-08-11 10:14:16

○A2406:da1e:214:c901:a1e2:fc7f:1e14:6ae22026-07-05 → 2026-07-05 · 4 obs

○ 2026-06-25 16:32:08
● 2026-07-05 10:26:10
○ 2026-07-22 15:30:58
○ 2026-08-11 10:14:16

○A2406:da1e:214:c901:a6e3:c029:70d9:a35c2026-06-24 → 2026-06-24 · 4 obs

○ 2026-06-14 16:26:12
● 2026-06-24 15:48:46
○ 2026-06-25 16:32:08
○ 2026-08-11 10:14:16

○A2406:da1e:214:c901:b98f:8ffd:780b:173b2026-07-22 → 2026-07-22 · 4 obs

○ 2026-07-05 10:26:10
● 2026-07-22 15:30:58
○ 2026-08-11 10:14:14
○ 2026-08-11 10:14:16

●A2600:1f18:6a07:601:3a2e:6474:85a2:7d3b2026-07-05 → 2026-08-11 · 3 obs

○ 2026-06-25 16:32:08
● 2026-07-05 10:26:10
● 2026-08-11 10:14:16

●A2600:1f1c:6db:8800:1bb2:674a:e955:729c2026-08-11 → 2026-08-11 · 3 obs

○ 2026-07-22 15:30:58
● 2026-08-11 10:14:14
● 2026-08-11 10:14:16

○A2600:1f1c:6db:8800:2027:2cf8:2b87:86752026-06-10 → 2026-06-10 · 4 obs

○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
○ 2026-06-14 16:26:12
○ 2026-08-11 10:14:16

○A2600:1f1c:6db:8800:2ba7:3db1:91ff:42392026-06-25 → 2026-06-25 · 4 obs

○ 2026-06-24 15:48:46
● 2026-06-25 16:32:08
○ 2026-07-05 10:26:10
○ 2026-08-11 10:14:16

○A2600:1f1c:6db:8800:9250:95cf:fe2:6f042026-07-05 → 2026-07-05 · 4 obs

○ 2026-06-25 16:32:08
● 2026-07-05 10:26:10
○ 2026-07-22 15:30:58
○ 2026-08-11 10:14:16

○A2600:1f1c:6db:8800:933a:d521:54a9:e8802026-06-24 → 2026-06-24 · 4 obs

○ 2026-06-14 16:26:12
● 2026-06-24 15:48:46
○ 2026-06-25 16:32:08
○ 2026-08-11 10:14:16

○A2600:1f1c:6db:8800:a28:60b6:f2ac:7b1c2026-06-14 → 2026-06-14 · 4 obs

○ 2026-06-10 16:25:56
● 2026-06-14 16:26:12
○ 2026-06-24 15:48:46
○ 2026-08-11 10:14:16

○A2600:1f1c:6db:8800:bb2d:23eb:4657:4f702026-07-22 → 2026-07-22 · 4 obs

○ 2026-07-05 10:26:10
● 2026-07-22 15:30:58
○ 2026-08-11 10:14:14
○ 2026-08-11 10:14:16

○A2600:9000:a612:55d9:1b82:e963:5969:d2c72026-02-20 → 2026-03-18 · 4 obs

● 2026-02-20 01:30:14
● 2026-03-18 06:45:52
○ 2026-03-31 02:29:52
○ 2026-08-11 10:14:16

●A2a01:4f8:1c1e:d6f1::12026-02-20 → 2026-08-11 · 6 obs

● 2026-02-20 01:30:14
● 2026-03-18 06:45:52
○ 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
● 2026-08-11 10:14:16

○A2a01:4f9:c013:29f7::12026-06-10 → 2026-06-10 · 4 obs

○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
○ 2026-07-22 15:30:58
○ 2026-08-11 10:14:16

●A2a01:4ff:1f0:dd50::12026-02-20 → 2026-08-11 · 6 obs

● 2026-02-20 01:30:14
● 2026-03-18 06:45:52
○ 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
● 2026-08-11 10:14:16

●A2a01:4ff:f0:5f41::12026-02-20 → 2026-08-11 · 6 obs

● 2026-02-20 01:30:14
● 2026-03-18 06:45:52
○ 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
● 2026-08-11 10:14:16

○A2a01:4ff:f0:a884::12026-06-10 → 2026-06-10 · 4 obs

○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
○ 2026-08-11 10:14:14
○ 2026-08-11 10:14:16

●A2a05:d014:179b:c400:2fc6:8141:276a:b7e92026-08-11 → 2026-08-11 · 3 obs

○ 2026-07-22 15:30:58
● 2026-08-11 10:14:14
● 2026-08-11 10:14:16

○A2a05:d018:1d22:800:7eae:d927:5469:85092026-07-22 → 2026-07-22 · 4 obs

○ 2026-07-05 10:26:10
● 2026-07-22 15:30:58
○ 2026-08-11 10:14:14
○ 2026-08-11 10:14:16

○A2a05:d018:1d22:800:8250:8f9e:30f4:c0842026-06-14 → 2026-06-14 · 4 obs

○ 2026-06-10 16:25:56
● 2026-06-14 16:26:12
○ 2026-06-24 15:48:46
○ 2026-08-11 10:14:16

○A2a05:d018:1d22:800:8e22:1749:c818:1a352026-06-10 → 2026-06-10 · 4 obs

○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
○ 2026-06-14 16:26:12
○ 2026-08-11 10:14:16

○A2a05:d018:1d22:800:fbfc:9d8f:29dc:8c772026-06-24 → 2026-06-24 · 4 obs

○ 2026-06-14 16:26:12
● 2026-06-24 15:48:46
○ 2026-07-05 10:26:10
○ 2026-08-11 10:14:16

●A2a05:d018:1d22:801:3286:665a:133:329d2026-08-11 → 2026-08-11 · 3 obs

○ 2026-07-22 15:30:58
● 2026-08-11 10:14:14
● 2026-08-11 10:14:16

○A46.62.237.1382026-02-20 → 2026-06-10 · 7 obs

● 2026-02-20 01:30:14
● 2026-03-18 06:45:52
○ 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
○ 2026-07-22 15:30:58
○ 2026-08-11 10:14:16

○A5.161.230.872026-02-20 → 2026-06-10 · 7 obs

● 2026-02-20 01:30:14
● 2026-03-18 06:45:52
○ 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
○ 2026-08-11 10:14:14
○ 2026-08-11 10:14:16

●A5.161.47.862026-02-20 → 2026-08-11 · 6 obs

● 2026-02-20 01:30:14
● 2026-03-18 06:45:52
○ 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
● 2026-08-11 10:14:16

●A5.78.156.592026-02-20 → 2026-08-11 · 6 obs

● 2026-02-20 01:30:14
● 2026-03-18 06:45:52
○ 2026-03-31 02:29:52
○ 2026-06-09 00:12:30
● 2026-06-10 16:25:56
● 2026-08-11 10:14:16

○A76.223.91.202026-02-20 → 2026-03-18 · 4 obs

● 2026-02-20 01:30:14
● 2026-03-18 06:45:52
○ 2026-03-31 02:29:52
○ 2026-08-11 10:14:16

🔍 DNS Trace

📋 Delegation Chain

Zone	Nameservers	Glue
finance	v0n0.nic.finance, v0n1.nic.finance, v0n2.nic.finance, v0n3.nic.finance...	-
rootkit.finance	ns1.dns-redirect.com, ns2.dns-redirect.com	-

✅ Authoritative Response

Server:5.161.230.87

NS records: ns1.dns-redirect.com, ns2.dns-redirect.com

🔒 DNSSEC Status

⚠️ Insecure (no DNSSEC)

No DS record for rootkit.finance (unsigned zone)

⏱️ Timing

Total: 232ms | Queries: -

📄 Records

Type	Count	Sample Data
A	3	`5.78.156.59, 195.201.128.179...`
AAAA	8	`2600:1f18:6a07:601:3a2e:6474:85a2:7d3b, 2600:1f1c:6db:8800:1bb2:674a:e955:729c...`
NS	2	`ns1.dns-redirect.com, ns2.dns-redirect.com`
TXT	3	`afternic-verification-aGHTsEA2nLa7KRqzmJ, 95b3a950-315c-45b8-937a-b865ebeb043a...`
SOA	1	`ns1.dns-redirect.com admin.dns.com`

Analysis

IP Addresses

rootkit.finance points to 11 IP addresses, including 5.78.156.59, 5.161.47.86 and 195.201.128.179, plus 8 other.

sashatanya-lordfilm.online, dnarts.com, organized.church plus two other host names have IP numbers in common with rootkit.finance.

Name Servers

rootkit.finance is delegated to two name servers: ns1.dns-redirect.com and ns2.dns-redirect.com.

The name server configuration of rootkit.finance is shared with other domains, for instance www.nationpage.com, www.shatle.com, cbdsp.com and two others.

Host names carrying three IP numbers:

ns1.dns-redirect.com points to 5.161.47.86, 5.161.230.87 and 195.201.128.179.

Host names pointing to two IP addresses:

ns2.dns-redirect.com points to 76.223.91.20 and 166.117.68.124.