malwareanalysis.net - dns.ninja

`malwareanalysis.net`

DNSSEC	⚠️ Not signed
A	2606:4700:3033::6815:1ee^{🇺🇸 Cloudflare2606:4700:3033::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	2606:4700:3037::ac43:9896^{🇺🇸 Cloudflare2606:4700:3037::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	104.21.1.238^{Cloudflare104.21.0.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	172.67.152.150^{🇺🇸 Cloudflare172.67.144.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
NS	`mona.ns.cloudflare.com` ⭐
		A	2606:4700:50::adf5:3ace^{🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`mona.ns.cloudflare.com`
		A	2803:f800:50::6ca2:c0ce^{🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L}
			PTR	`mona.ns.cloudflare.com`
		A	2a06:98c1:50::ac40:20ce^{🇺🇸 Cloudflare2a06:98c1:50::/45}
			PTR	`mona.ns.cloudflare.com`
		A	108.162.192.206^{🇺🇸 Cloudflare108.162.192.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`mona.ns.cloudflare.com`
		A	172.64.32.206^{🇺🇸 Cloudflare172.64.32.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`mona.ns.cloudflare.com`
		A	173.245.58.206^{🇺🇸 Cloudflare173.245.58.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`mona.ns.cloudflare.com`
NS	`toby.ns.cloudflare.com`
		A	2606:4700:58::adf5:3bef^{🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`toby.ns.cloudflare.com`
		A	2803:f800:50::6ca2:c1ef^{🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L}
			PTR	`toby.ns.cloudflare.com`
		A	2a06:98c1:50::ac40:21ef^{🇺🇸 Cloudflare2a06:98c1:50::/45}
			PTR	`toby.ns.cloudflare.com`
		A	108.162.193.239^{🇺🇸 Cloudflare108.162.193.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`toby.ns.cloudflare.com`
		A	172.64.33.239^{🇺🇸 Cloudflare172.64.33.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`toby.ns.cloudflare.com`
		A	173.245.59.239^{🇺🇸 Cloudflare173.245.59.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`toby.ns.cloudflare.com`
MX	`smtp.secureserver.net` ⭐
		A	216.69.141.71^{🇺🇸 AS398101216.69.140.0/22}
			PTR	`osplibsmtp01-v01.prod.phx3.secureserver.net`
		A	216.69.141.84^{🇺🇸 AS398101216.69.140.0/22}
			PTR	`osplibsmtp02-v01.prod.phx3.secureserver.net`
		A	216.69.141.113^{🇺🇸 AS398101216.69.140.0/22}
			PTR	`osplibsmtp03-v01.prod.phx3.secureserver.net`
MX	`mailstore1.secureserver.net`⁽¹⁰⁾
		A	216.69.141.78^{🇺🇸 AS398101216.69.140.0/22}
			PTR	`osplibsmtp01-v02.prod.phx3.secureserver.net`
		A	216.69.141.114^{🇺🇸 AS398101216.69.140.0/22}
			PTR	`osplibsmtp03-v02.prod.phx3.secureserver.net`
		A	216.69.141.162^{🇺🇸 AS398101216.69.140.0/22}
			PTR	`osplibsmtp02-v02.prod.phx3.secureserver.net`
HTTPS	HTTP/3, HTTP/2 ✓ hints match
		IPv4 hints	104.21.1.238, 172.67.152.150
		IPv6 hints	2606:4700:3033::6815:1ee, 2606:4700:3037::ac43:9896
		ECH	X25519, HKDF-SHA256 + AES-128-GCM draft, id=86, name=cloudflare-ech.com
SOA	`mona.ns.cloudflare.com`dns@cloudflare.com serial=2408450005

`net`

	DNSSEC	🔒 Signed (DS record present)
	NS	`a.gtld-servers.net` ⭐
	NS	`b.gtld-servers.net`
	NS	`c.gtld-servers.net`
	NS	`d.gtld-servers.net`
	NS	`e.gtld-servers.net`
	NS	`f.gtld-servers.net`
	NS	`g.gtld-servers.net`
	NS	`h.gtld-servers.net`
	NS	`i.gtld-servers.net`
	NS	`j.gtld-servers.net`
	NS	`k.gtld-servers.net`
	NS	`l.gtld-servers.net`
	NS	`m.gtld-servers.net`
	SOA	`a.gtld-servers.net`nstld@verisign-grs.com serial=1783149716

Same first word

malwareanalysis.com

malwareanalysis.co.kr

malwareanalysis.net

malwareanalysis.co

DNS History

11 records (8 active, 3 former)

●NSmona.ns.cloudflare.com2026-02-16 → 2026-07-04 · 3 obs

○ 2017-01-31 18:00:08
● 2026-02-16 00:37:26
● 2026-07-04 07:50:52

○NSns31.domaincontrol.com2015-08-15 → 2017-01-31 · 4 obs

● 2015-08-15 12:40:04
● 2017-01-31 18:00:08
○ 2026-02-16 00:37:26
○ 2026-07-04 07:50:52

○NSns32.domaincontrol.com2015-08-15 → 2017-01-31 · 4 obs

● 2015-08-15 12:40:04
● 2017-01-31 18:00:08
○ 2026-02-16 00:37:26
○ 2026-07-04 07:50:52

●NStoby.ns.cloudflare.com2026-02-16 → 2026-07-04 · 3 obs

○ 2017-01-31 18:00:08
● 2026-02-16 00:37:26
● 2026-07-04 07:50:52

●MXmailstore1.secureserver.net2015-08-15 → 2026-07-04 · 2 obs

● 2015-08-15 12:40:04
● 2026-07-04 07:50:52

●MXsmtp.secureserver.net2015-08-15 → 2026-07-04 · 2 obs

● 2015-08-15 12:40:04
● 2026-07-04 07:50:52

●A104.21.1.2382026-02-16 → 2026-07-04 · 3 obs

○ 2017-01-31 18:00:08
● 2026-02-16 00:37:26
● 2026-07-04 07:50:52

●A172.67.152.1502026-02-16 → 2026-07-04 · 3 obs

○ 2017-01-31 18:00:08
● 2026-02-16 00:37:26
● 2026-07-04 07:50:52

●A2606:4700:3033::6815:1ee2026-02-16 → 2026-07-04 · 3 obs

○ 2017-01-31 18:00:08
● 2026-02-16 00:37:26
● 2026-07-04 07:50:52

●A2606:4700:3037::ac43:98962026-02-16 → 2026-07-04 · 3 obs

○ 2017-01-31 18:00:08
● 2026-02-16 00:37:26
● 2026-07-04 07:50:52

○A50.63.202.552015-08-15 → 2017-01-31 · 4 obs

● 2015-08-15 12:40:04
● 2017-01-31 18:00:08
○ 2026-02-16 00:37:26
○ 2026-07-04 07:50:52

🔍 DNS Trace

📋 Delegation Chain

Zone	Nameservers	Glue
net	e.gtld-servers.net, l.gtld-servers.net, f.gtld-servers.net, d.gtld-servers.net...	-
malwareanalysis.net	toby.ns.cloudflare.com, mona.ns.cloudflare.com	-

✅ Authoritative Response

Server:108.162.192.206

NS records: toby.ns.cloudflare.com, mona.ns.cloudflare.com

🔒 DNSSEC Status

⚠️ Insecure (no DNSSEC)

No DS record for malwareanalysis.net (unsigned zone)

⏱️ Timing

Total: 502ms | Queries: -

📄 Records

Type	Count	Sample Data
A	2	`104.21.1.238, 172.67.152.150`
AAAA	2	`2606:4700:3033::6815:1ee, 2606:4700:3037::ac43:9896`
NS	2	`mona.ns.cloudflare.com, toby.ns.cloudflare.com`
MX	2	`smtp.secureserver.net (pri: 0), mailstore1.secureserver.net (pri: 10)`
HTTPS	1	`{"priority":1,"target":".","alpn":["h3",`
SOA	1	`mona.ns.cloudflare.com dns.cloudflare.co`

Analysis

IP Addresses

malwareanalysis.net points to the four IP addresses 104.21.1.238, 172.67.152.150, 2606:4700:3033::6815:1ee and 2606:4700:3037::ac43:9896.

madisonwm.com, zbeshop.com, bestkebabkatowice.pl plus two other host names have IP numbers in common with malwareanalysis.net.

Name Servers

DNS delegation for malwareanalysis.net points to two name servers: mona.ns.cloudflare.com and toby.ns.cloudflare.com.

The name server configuration of malwareanalysis.net is shared with other domains, for instance unionps.org, feelb-infra.ovh, marosgroup.com and two others.

There is at least partial name server overlap between malwareanalysis.net and other domains — malucelli.net, hwj280.com, soundpollution.se and two more among them.

The name servers ollie.ns.cloudflare.com, ridge.ns.cloudflare.com and ruben.ns.cloudflare.com are often found in combination with these name servers.

Hosts with 6 IP addresses each:

mona.ns.cloudflare.com has IP addresses 108.162.192.206, 172.64.32.206 and 173.245.58.206, plus 3 other.

toby.ns.cloudflare.com has IP addresses 108.162.193.239, 172.64.33.239 and 173.245.59.239, plus 3 other.

Mail Servers

malwareanalysis.net uses two mail servers, mailstore1.secureserver.net and smtp.secureserver.net.

The mail server setup of malwareanalysis.net matches that of other domains such as inviertecomopro.com, dhc4.com, pvwine.com and two others.

mailstore1.secureserver.net points to 216.69.141.78, 216.69.141.114 and 216.69.141.162. smtp.secureserver.net points to 216.69.141.71, 216.69.141.84 and 216.69.141.113. Both hosts resolve to three IP numbers.