remove.sh - dns.ninja

remove.sh

DNSSEC⚠️ Not signed
A2606:4700:3036::ac43:a909🇺🇸 Cloudflare2606:4700:3036::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US ✓ In HTTPS hints
A2606:4700:3037::6815:1b45🇺🇸 Cloudflare2606:4700:3037::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US ✓ In HTTPS hints
A104.21.27.69Cloudflare104.21.16.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US ✓ In HTTPS hints
A172.67.169.9🇺🇸 Cloudflare172.67.160.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US ✓ In HTTPS hints
NSrobin.ns.cloudflare.com
A2606:4700:50::adf5:3ada🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRrobin.ns.cloudflare.com
A2803:f800:50::6ca2:c0da🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L
PTRrobin.ns.cloudflare.com
A2a06:98c1:50::ac40:20da🇺🇸 Cloudflare2a06:98c1:50::/45
PTRrobin.ns.cloudflare.com
A108.162.192.218🇺🇸 Cloudflare108.162.192.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRrobin.ns.cloudflare.com
A172.64.32.218🇺🇸 Cloudflare172.64.32.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRrobin.ns.cloudflare.com
A173.245.58.218🇺🇸 Cloudflare173.245.58.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRrobin.ns.cloudflare.com
NSwoz.ns.cloudflare.com
A2606:4700:58::adf5:3b96🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRwoz.ns.cloudflare.com
A2803:f800:50::6ca2:c196🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L
PTRwoz.ns.cloudflare.com
A2a06:98c1:50::ac40:2196🇺🇸 Cloudflare2a06:98c1:50::/45
PTRwoz.ns.cloudflare.com
A108.162.193.150🇺🇸 Cloudflare108.162.193.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRwoz.ns.cloudflare.com
A172.64.33.150🇺🇸 Cloudflare172.64.33.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRwoz.ns.cloudflare.com
A173.245.59.150🇺🇸 Cloudflare173.245.59.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRwoz.ns.cloudflare.com
TXTgoogle-site-verification=Kl9yFnBNQPQQdUXB_t7b1z68jwLp3WPK0usKRndvdqo
HTTPSHTTP/3, HTTP/2 ✓ hints match
IPv4 hints104.21.27.69, 172.67.169.9
IPv6 hints2606:4700:3036::ac43:a909, 2606:4700:3037::6815:1b45
ECHX25519, HKDF-SHA256 + AES-128-GCM draft, id=254, name=cloudflare-ech.com
SOArobin.ns.cloudflare.comdns@cloudflare.com serial=2406039721

sh

DNSSEC🔒 Signed (DS record present)
NSa0.nic.sh
NSa2.nic.sh
NSb0.nic.sh
NSc0.nic.sh
SOAa0.nic.shhostmaster@donuts.email serial=1780918793

Same first word

Similar names

DNS History

10 records (6 active, 4 former)

NSrobin.ns.cloudflare.comwoz.ns.cloudflare.comA104.21.27.69172.67.169.92606:4700:3036::ac43:a9092606:4700:3037::6815:1b45188.114.96.0188.114.97.02a06:98c1:3120::2a06:98c1:3121::
NSrobin.ns.cloudflare.com2026-02-14 → 2026-06-08 · 2 obs
● 2026-02-14 16:30:32
● 2026-06-08 12:19:00
NSwoz.ns.cloudflare.com2026-02-14 → 2026-06-08 · 2 obs
● 2026-02-14 16:30:32
● 2026-06-08 12:19:00
A104.21.27.692026-03-19 → 2026-06-08 · 9 obs
○ 2026-03-18 19:56:08
● 2026-03-19 11:20:40
○ 2026-03-28 16:29:52
○ 2026-04-01 05:40:04
● 2026-04-02 23:47:08
○ 2026-04-05 00:44:08
○ 2026-04-24 14:24:18
● 2026-04-27 18:26:48
● 2026-06-08 12:19:00
A172.67.169.92026-03-19 → 2026-06-08 · 9 obs
○ 2026-03-18 19:56:08
● 2026-03-19 11:20:40
○ 2026-03-28 16:29:52
○ 2026-04-01 05:40:04
● 2026-04-02 23:47:08
○ 2026-04-05 00:44:08
○ 2026-04-24 14:24:18
● 2026-04-27 18:26:48
● 2026-06-08 12:19:00
A188.114.96.02026-02-14 → 2026-04-24 · 10 obs
● 2026-02-14 16:30:32
● 2026-03-18 19:56:08
○ 2026-03-19 11:20:40
● 2026-03-28 16:29:52
● 2026-04-01 05:40:04
○ 2026-04-02 23:47:08
● 2026-04-05 00:44:08
● 2026-04-24 14:24:18
○ 2026-04-27 18:26:48
○ 2026-06-08 12:19:00
A188.114.97.02026-02-14 → 2026-04-24 · 10 obs
● 2026-02-14 16:30:32
● 2026-03-18 19:56:08
○ 2026-03-19 11:20:40
● 2026-03-28 16:29:52
● 2026-04-01 05:40:04
○ 2026-04-02 23:47:08
● 2026-04-05 00:44:08
● 2026-04-24 14:24:18
○ 2026-04-27 18:26:48
○ 2026-06-08 12:19:00
A2606:4700:3036::ac43:a9092026-03-19 → 2026-06-08 · 9 obs
○ 2026-03-18 19:56:08
● 2026-03-19 11:20:40
○ 2026-03-28 16:29:52
○ 2026-04-01 05:40:04
● 2026-04-02 23:47:08
○ 2026-04-05 00:44:08
○ 2026-04-24 14:24:18
● 2026-04-27 18:26:48
● 2026-06-08 12:19:00
A2606:4700:3037::6815:1b452026-03-19 → 2026-06-08 · 9 obs
○ 2026-03-18 19:56:08
● 2026-03-19 11:20:40
○ 2026-03-28 16:29:52
○ 2026-04-01 05:40:04
● 2026-04-02 23:47:08
○ 2026-04-05 00:44:08
○ 2026-04-24 14:24:18
● 2026-04-27 18:26:48
● 2026-06-08 12:19:00
A2a06:98c1:3120::2026-02-14 → 2026-04-24 · 10 obs
● 2026-02-14 16:30:32
● 2026-03-18 19:56:08
○ 2026-03-19 11:20:40
● 2026-03-28 16:29:52
● 2026-04-01 05:40:04
○ 2026-04-02 23:47:08
● 2026-04-05 00:44:08
● 2026-04-24 14:24:18
○ 2026-04-27 18:26:48
○ 2026-06-08 12:19:00
A2a06:98c1:3121::2026-02-14 → 2026-04-24 · 10 obs
● 2026-02-14 16:30:32
● 2026-03-18 19:56:08
○ 2026-03-19 11:20:40
● 2026-03-28 16:29:52
● 2026-04-01 05:40:04
○ 2026-04-02 23:47:08
● 2026-04-05 00:44:08
● 2026-04-24 14:24:18
○ 2026-04-27 18:26:48
○ 2026-06-08 12:19:00

🔍 DNS Trace

📋 Delegation Chain

ZoneNameserversGlue
sha0.nic.sh, a2.nic.sh, b0.nic.sh, c0.nic.sh8 records
remove.shrobin.ns.cloudflare.com, woz.ns.cloudflare.com-

✅ Authoritative Response

Server:172.64.33.150

NS records: robin.ns.cloudflare.com, woz.ns.cloudflare.com

🔒 DNSSEC Status

⚠️ Insecure (no DNSSEC)

No DS record for remove.sh (unsigned zone)

⏱️ Timing

Total: 391ms | Queries: -

📄 Records

TypeCountSample Data
A2172.67.169.9, 104.21.27.69
AAAA22606:4700:3037::6815:1b45, 2606:4700:3036::ac43:a909
NS2robin.ns.cloudflare.com, woz.ns.cloudflare.com
TXT1google-site-verification=Kl9yFnBNQPQQdUX
HTTPS1{"priority":1,"target":".","alpn":["h3",
SOA1robin.ns.cloudflare.com dns.cloudflare.c

📌 Glue Records Collected

Total: 8

In-bailiwick: 8 (a0.nic.sh, a2.nic.sh, b0.nic.sh...)

Analysis

IP Addresses

remove.sh points to 4 IP addresses — 104.21.27.69, 172.67.169.9, 2606:4700:3036::ac43:a909 and 2606:4700:3037::6815:1b45.

a-r.az, unival.es, www.m.marketplacepremium24.com plus two other host names have IP numbers in common with remove.sh.

Name Servers

remove.sh is delegated to two name servers: robin.ns.cloudflare.com and woz.ns.cloudflare.com.

The name server configuration of remove.sh is shared with other domains, for instance 632615-coinbase.com, blinking.dog, tokenvestors.com and two others.

There is at least partial name server overlap between remove.sh and other domains — resumestime.com, leanpreneurs.com, hxc259.com and two more among them.

These name servers frequently co-occur with the name servers meiling.ns.cloudflare.com and kiki.ns.cloudflare.com.

Hosts with 6 IP addresses each:

robin.ns.cloudflare.com maps to six IP addresses: 108.162.192.218, 172.64.32.218, 173.245.58.218 and three others.

woz.ns.cloudflare.com maps to six IP addresses: 108.162.193.150, 172.64.33.150, 173.245.59.150 and three others.