maliciouscode.net - dns.ninja

`maliciouscode.net`

DNSSEC	⚠️ Not signed
A	2606:4700:3031::ac43:d0ad^{🇺🇸 Cloudflare2606:4700:3031::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	2606:4700:3036::6815:55af^{🇺🇸 Cloudflare2606:4700:3036::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	104.21.85.175^{Cloudflare104.21.80.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	172.67.208.173^{🇺🇸 Cloudflare172.67.208.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
NS	`mona.ns.cloudflare.com` ⭐
		A	2606:4700:50::adf5:3ace^{🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`mona.ns.cloudflare.com`
		A	2803:f800:50::6ca2:c0ce^{🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L}
			PTR	`mona.ns.cloudflare.com`
		A	2a06:98c1:50::ac40:20ce^{🇺🇸 Cloudflare2a06:98c1:50::/45}
			PTR	`mona.ns.cloudflare.com`
		A	108.162.192.206^{🇺🇸 Cloudflare108.162.192.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`mona.ns.cloudflare.com`
		A	172.64.32.206^{🇺🇸 Cloudflare172.64.32.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`mona.ns.cloudflare.com`
		A	173.245.58.206^{🇺🇸 Cloudflare173.245.58.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`mona.ns.cloudflare.com`
NS	`toby.ns.cloudflare.com`
		A	2606:4700:58::adf5:3bef^{🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`toby.ns.cloudflare.com`
		A	2803:f800:50::6ca2:c1ef^{🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L}
			PTR	`toby.ns.cloudflare.com`
		A	2a06:98c1:50::ac40:21ef^{🇺🇸 Cloudflare2a06:98c1:50::/45}
			PTR	`toby.ns.cloudflare.com`
		A	108.162.193.239^{🇺🇸 Cloudflare108.162.193.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`toby.ns.cloudflare.com`
		A	172.64.33.239^{🇺🇸 Cloudflare172.64.33.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`toby.ns.cloudflare.com`
		A	173.245.59.239^{🇺🇸 Cloudflare173.245.59.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`toby.ns.cloudflare.com`
MX	`aspmx.l.google.com` ⭐
		A	2607:f8b0:4004:c27::1b^{🇺🇸 Google2607:f8b0:4004::/48}
			PTR	`yuiadsk-in-f27.1e100.net`
		A	142.251.163.26^{🇺🇸 Google142.251.163.0/24}
			PTR	`wv-in-f26.1e100.net`
MX	`alt1.aspmx.l.google.com`⁽²⁰⁾
		A	2800:3f0:4003:c0f::1a^{🇨🇱 Google2800:3f0:4003::/48}
		A	108.177.123.26^{🇺🇸 Google108.177.123.0/24}
			PTR	`lcscld-in-f26.1e100.net`
MX	`alt2.aspmx.l.google.com`⁽²⁰⁾
		A	2a00:1450:400b:c02::1a^{🇮🇪 Google2a00:1450:400b::/48}
			PTR	`dj-in-f26.1e100.net`
		A	172.253.116.26^{🇺🇸 Google172.253.116.0/24}
			PTR	`dj-in-f26.1e100.net`
MX	`aspmx2.googlemail.com`⁽³⁰⁾
		A	2800:3f0:4003:c0f::1b^{🇨🇱 Google2800:3f0:4003::/48}
		A	108.177.123.27^{🇺🇸 Google108.177.123.0/24}
			PTR	`lcscld-in-f27.1e100.net`
MX	`aspmx3.googlemail.com`⁽³⁰⁾
		A	2a00:1450:400b:c02::1b^{🇮🇪 Google2a00:1450:400b::/48}
			PTR	`dj-in-f27.1e100.net`
		A	172.253.116.26^{🇺🇸 Google172.253.116.0/24}
			PTR	`dj-in-f26.1e100.net`
MX	`aspmx4.googlemail.com`⁽³⁰⁾
		A	2a00:1450:4009:c0f::1b^{🇬🇧 Google2a00:1450:4009::/48}
			PTR	`yulhrs-in-f27.1e100.net`
		A	192.178.223.26^{🇺🇸 Google192.178.223.0/24}
			PTR	`yulhrs-in-f26.1e100.net`
MX	`aspmx5.googlemail.com`⁽³⁰⁾
		A	2a00:1450:400c:c23::1a^{🇧🇪 Google2a00:1450:400c::/48}
			PTR	`yubrupd-in-f26.1e100.net`
		A	172.253.157.26^{🇺🇸 Google172.253.0.0/16}
			PTR	`yubrupd-in-f26.1e100.net`
HTTPS	HTTP/3, HTTP/2 ✓ hints match
		IPv4 hints	104.21.85.175, 172.67.208.173
		IPv6 hints	2606:4700:3031::ac43:d0ad, 2606:4700:3036::6815:55af
		ECH	X25519, HKDF-SHA256 + AES-128-GCM draft, id=154, name=cloudflare-ech.com
SOA	`mona.ns.cloudflare.com`dns@cloudflare.com serial=2405019973

`net`

	DNSSEC	🔒 Signed (DS record present)
	NS	`a.gtld-servers.net` ⭐
	NS	`b.gtld-servers.net`
	NS	`c.gtld-servers.net`
	NS	`d.gtld-servers.net`
	NS	`e.gtld-servers.net`
	NS	`f.gtld-servers.net`
	NS	`g.gtld-servers.net`
	NS	`h.gtld-servers.net`
	NS	`i.gtld-servers.net`
	NS	`j.gtld-servers.net`
	NS	`k.gtld-servers.net`
	NS	`l.gtld-servers.net`
	NS	`m.gtld-servers.net`
	SOA	`a.gtld-servers.net`nstld@verisign-grs.com serial=1782632380

Same first word

maliciouscode.net

DNS History

23 records (13 active, 10 former)

●NSmona.ns.cloudflare.com2026-03-29 → 2026-06-28 · 3 obs

○ 2020-01-10 04:44:00
● 2026-03-29 05:35:58
● 2026-06-28 08:08:18

○NSns1.dreamhost.com2015-06-10 → 2020-01-10 · 4 obs

● 2015-06-10 02:18:26
● 2020-01-10 04:44:00
○ 2026-03-29 05:35:58
○ 2026-06-28 08:08:18

○NSns2.dreamhost.com2015-06-10 → 2020-01-10 · 4 obs

● 2015-06-10 02:18:26
● 2020-01-10 04:44:00
○ 2026-03-29 05:35:58
○ 2026-06-28 08:08:18

○NSns3.dreamhost.com2015-06-10 → 2020-01-10 · 4 obs

● 2015-06-10 02:18:26
● 2020-01-10 04:44:00
○ 2026-03-29 05:35:58
○ 2026-06-28 08:08:18

●NStoby.ns.cloudflare.com2026-03-29 → 2026-06-28 · 3 obs

○ 2020-01-10 04:44:00
● 2026-03-29 05:35:58
● 2026-06-28 08:08:18

●MXalt1.aspmx.l.google.com2015-06-10 → 2026-06-28 · 2 obs

● 2015-06-10 02:18:26
● 2026-06-28 08:08:18

●MXalt2.aspmx.l.google.com2015-06-10 → 2026-06-28 · 2 obs

● 2015-06-10 02:18:26
● 2026-06-28 08:08:18

●MXaspmx.l.google.com2015-06-10 → 2026-06-28 · 2 obs

● 2015-06-10 02:18:26
● 2026-06-28 08:08:18

●MXaspmx2.googlemail.com2015-06-10 → 2026-06-28 · 2 obs

● 2015-06-10 02:18:26
● 2026-06-28 08:08:18

●MXaspmx3.googlemail.com2015-06-10 → 2026-06-28 · 2 obs

● 2015-06-10 02:18:26
● 2026-06-28 08:08:18

●MXaspmx4.googlemail.com2015-06-10 → 2026-06-28 · 2 obs

● 2015-06-10 02:18:26
● 2026-06-28 08:08:18

●MXaspmx5.googlemail.com2015-06-10 → 2026-06-28 · 2 obs

● 2015-06-10 02:18:26
● 2026-06-28 08:08:18

●A104.21.85.1752026-04-24 → 2026-06-28 · 6 obs

○ 2026-03-29 05:35:58
● 2026-04-24 10:42:24
● 2026-06-12 18:59:12
○ 2026-06-16 11:52:26
● 2026-06-28 07:09:32
● 2026-06-28 08:08:18

●A172.67.208.1732026-04-24 → 2026-06-28 · 6 obs

○ 2026-03-29 05:35:58
● 2026-04-24 10:42:24
● 2026-06-12 18:59:12
○ 2026-06-16 11:52:26
● 2026-06-28 07:09:32
● 2026-06-28 08:08:18

○A188.114.96.02026-03-29 → 2026-06-16 · 7 obs

○ 2020-01-10 04:44:00
● 2026-03-29 05:35:58
○ 2026-04-24 10:42:24
○ 2026-06-12 18:59:12
● 2026-06-16 11:52:26
○ 2026-06-28 07:09:32
○ 2026-06-28 08:08:18

○A188.114.97.02026-03-29 → 2026-06-16 · 7 obs

○ 2020-01-10 04:44:00
● 2026-03-29 05:35:58
○ 2026-04-24 10:42:24
○ 2026-06-12 18:59:12
● 2026-06-16 11:52:26
○ 2026-06-28 07:09:32
○ 2026-06-28 08:08:18

○A2606:4700:3030::6815:55af2026-04-24 → 2026-06-12 · 5 obs

○ 2026-03-29 05:35:58
● 2026-04-24 10:42:24
● 2026-06-12 18:59:12
○ 2026-06-16 11:52:26
○ 2026-06-28 08:08:18

●A2606:4700:3031::ac43:d0ad2026-06-28 → 2026-06-28 · 3 obs

○ 2026-06-16 11:52:26
● 2026-06-28 07:09:32
● 2026-06-28 08:08:18

○A2606:4700:3033::ac43:d0ad2026-04-24 → 2026-06-12 · 5 obs

○ 2026-03-29 05:35:58
● 2026-04-24 10:42:24
● 2026-06-12 18:59:12
○ 2026-06-16 11:52:26
○ 2026-06-28 08:08:18

●A2606:4700:3036::6815:55af2026-06-28 → 2026-06-28 · 3 obs

○ 2026-06-16 11:52:26
● 2026-06-28 07:09:32
● 2026-06-28 08:08:18

○A2a06:98c1:3120::2026-03-29 → 2026-06-16 · 7 obs

○ 2020-01-10 04:44:00
● 2026-03-29 05:35:58
○ 2026-04-24 10:42:24
○ 2026-06-12 18:59:12
● 2026-06-16 11:52:26
○ 2026-06-28 07:09:32
○ 2026-06-28 08:08:18

○A2a06:98c1:3121::2026-03-29 → 2026-06-16 · 7 obs

○ 2020-01-10 04:44:00
● 2026-03-29 05:35:58
○ 2026-04-24 10:42:24
○ 2026-06-12 18:59:12
● 2026-06-16 11:52:26
○ 2026-06-28 07:09:32
○ 2026-06-28 08:08:18

○A66.240.204.2232015-06-10 → 2020-01-10 · 4 obs

● 2015-06-10 02:18:26
● 2020-01-10 04:44:00
○ 2026-03-29 05:35:58
○ 2026-06-28 08:08:18

🔍 DNS Trace

📋 Delegation Chain

Zone	Nameservers	Glue
net	c.gtld-servers.net, b.gtld-servers.net, l.gtld-servers.net, j.gtld-servers.net...	-
maliciouscode.net	toby.ns.cloudflare.com, mona.ns.cloudflare.com	-

✅ Authoritative Response

Server:173.245.59.239

NS records: toby.ns.cloudflare.com, mona.ns.cloudflare.com

🔒 DNSSEC Status

⚠️ Insecure (no DNSSEC)

No DS record for maliciouscode.net (unsigned zone)

⏱️ Timing

Total: 366ms | Queries: -

📄 Records

Type	Count	Sample Data
A	2	`172.67.208.173, 104.21.85.175`
AAAA	2	`2606:4700:3031::ac43:d0ad, 2606:4700:3036::6815:55af`
NS	2	`mona.ns.cloudflare.com, toby.ns.cloudflare.com`
MX	7	`ASPMX.L.GOOGLE.COM (pri: 10), ALT1.ASPMX.L.GOOGLE.COM (pri: 20)...`
HTTPS	1	`{"priority":1,"target":".","alpn":["h3",`
SOA	1	`mona.ns.cloudflare.com dns.cloudflare.co`

Analysis

IP Addresses

maliciouscode.net resolves to four IP addresses: 104.21.85.175, 172.67.208.173, 2606:4700:3031::ac43:d0ad and 2606:4700:3036::6815:55af.

Two other host names, along with glorianastore.blog, palfinger.lv and pcall.net, also share IP numbers with maliciouscode.net.

Name Servers

The NS records for maliciouscode.net delegate to mona.ns.cloudflare.com and toby.ns.cloudflare.com.

maliciouscode.net shares its NS records with other domains, for example aptgame.com, kin.today, drfereydooni.ir and two others.

maliciouscode.net has at least partial name server overlap with other domains, such as primeonenova2.pics, xn--jpqx4qfn0a405a.com, apvg.org and two others.

It is common to see these name servers used together with name servers ollie.ns.cloudflare.com and lia.ns.cloudflare.com.

DNS names with 6 IP addresses:

mona.ns.cloudflare.com maps to 108.162.192.206, 172.64.32.206, 173.245.58.206 and 3 additional IP addresses.

toby.ns.cloudflare.com maps to 108.162.193.239, 172.64.33.239, 173.245.59.239 and 3 additional IP addresses.

Mail Servers

Mail for maliciouscode.net is routed through 7 mail servers, including aspmx2.googlemail.com, aspmx3.googlemail.com, aspmx4.googlemail.com and 4 other.

There is at least a partial MX overlap between maliciouscode.net and other domains, including ns500731.ns500671.ns500671.ns500754.ns500704.ns500742.ns500705.ns500678.ns500705.ns500678.ns500649.tenderladiesbz.com, ns500759.ns500759.ns500759.ns500698.ns500736.ns500735.ns500698.ns500735.ns500576.ns500708.ns500576.ns500698.ns500619.ns500619.ns500576.trackreceptor.com, ns500754.ns500742.ns500742.ns500742.ns500742.ns500705.ns500688.ns500291.ns500678.lusty(0x736c7574)z.com and two others.

These mail servers tend to appear in combination with mail servers alt1.aspmx.l.google.com, aspmx.l.google.com, alt2.aspmx.l.google.com and 3 others.

Host names that have two IP addresses:

The A records for aspmx2.googlemail.com return 108.177.123.27 and 2800:3f0:4003:c0f::1b.

The A records for aspmx3.googlemail.com return 172.253.116.26 and 2a00:1450:400b:c02::1b.

The A records for aspmx4.googlemail.com return 192.178.223.26 and 2a00:1450:4009:c0f::1b.

The A records for aspmx5.googlemail.com return 172.253.157.26 and 2a00:1450:400c:c23::1a.

The A records for aspmx.l.google.com return 142.251.163.26 and 2607:f8b0:4004:c27::1b.

The A records for alt1.aspmx.l.google.com return 108.177.123.26 and 2800:3f0:4003:c0f::1a.

The A records for alt2.aspmx.l.google.com return 172.253.116.26 and 2a00:1450:400b:c02::1a.

aspmx3.googlemail.com and alt2.aspmx.l.google.com each have 172.253.116.26 IP addresses.