php2shell.wtf - dns.ninja

🛡️Domain Reputation CheckBlocklist, phishing & malware status→

`php2shell.wtf`

DNSSEC	⚠️ Not signed
A	2a0f:b240:e:146::42^{WEYRO2a0f:b240:e::/48}
A	103.109.234.78^{🇦🇺 WEYRO103.109.234.0/24}
NS	`launch1.spaceship.net` ⭐
		A	2400:cb00:2049:1::a29f:1a26^{🇺🇸 Cloudflare2400:cb00:2049::/48 , Inc. 101 Townsend Street}
		A	162.159.26.38^{Cloudflare162.159.26.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
NS	`launch2.spaceship.net`
		A	2400:cb00:2049:1::a29f:1b20^{🇺🇸 Cloudflare2400:cb00:2049::/48 , Inc. 101 Townsend Street}
		A	162.159.27.32^{Cloudflare162.159.27.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
SOA	`launch1.spaceship.net`support@spaceship.com serial=1792590553

`wtf`

	DNSSEC	🔒 Signed (DS record present)
	NS	`v0n0.nic.wtf` ⭐
	NS	`v0n1.nic.wtf`
	NS	`v0n2.nic.wtf`
	NS	`v0n3.nic.wtf`
	NS	`v2n0.nic.wtf`
	NS	`v2n1.nic.wtf`
	SOA	`v0n0.nic.wtf`hostmaster@donuts.email serial=1793013479

⚠️ On DNS blocklist: spam-tlds

Same first word

Previous names

phiskits.wtf

phm.wtf

pho.wtf

phobia.wtf

phobos.wtf

phoenix.wtf

pholder.wtf

phone.wtf

phonehome.wtf

phonenumber.wtf

phones.wtf

phonix.wtf

phony.wtf

photo.wtf

photobombme.wtf

photon.wtf

photonic.wtf

photonuts.wtf

phoxin.wtf

Next names

phucyu.wtf

phuhq.wtf

phuwn.wtf

phy.wtf

phygitalnouns.wtf

phygitals.wtf

physics.wtf

phytorinco.wtf

pi.wtf

piamon.wtf

piano.wtf

piar.wtf

pibot.wtf

pic.wtf

picapica.wtf

pick.wtf

pickaxe.wtf

pickem.wtf

DNS History

4 records (4 active, 0 former)

●NSlaunch1.spaceship.net2026-10-22 → 2026-10-26 · 2 obs

● 2026-10-22 10:12:42
● 2026-10-26 12:00:14

●NSlaunch2.spaceship.net2026-10-22 → 2026-10-26 · 2 obs

● 2026-10-22 10:12:42
● 2026-10-26 12:00:14

●A103.109.234.782026-10-22 → 2026-10-26 · 2 obs

● 2026-10-22 10:12:42
● 2026-10-26 12:00:14

●A2a0f:b240:e:146::422026-10-22 → 2026-10-26 · 2 obs

● 2026-10-22 10:12:42
● 2026-10-26 12:00:14

🔍 DNS Trace

📋 Delegation Chain

Zone	Nameservers	Glue
wtf	v0n0.nic.wtf, v0n1.nic.wtf, v0n2.nic.wtf, v0n3.nic.wtf...	12 records
php2shell.wtf	launch2.spaceship.net, launch1.spaceship.net	-

✅ Authoritative Response

Server:162.159.26.38

NS records: launch2.spaceship.net, launch1.spaceship.net

🔒 DNSSEC Status

⚠️ Insecure (no DNSSEC)

Root DNSKEY fetch failed: Error: connect EADDRNOTAVAIL 198.41.0.4:53 - Local (0.0.0.0:0)

⏱️ Timing

Total: 724ms | Queries: -

📄 Records

Type	Count	Sample Data
A	1	`103.109.234.78`
AAAA	1	`2a0f:b240:e:146::42`
NS	2	`launch2.spaceship.net, launch1.spaceship.net`
SOA	1	`launch1.spaceship.net support.spaceship.`

📌 Glue Records Collected

Total: 12

In-bailiwick: 12 (v0n0.nic.wtf, v0n0.nic.wtf, v0n1.nic.wtf...)

Analysis

IP Addresses

php2shell.wtf directs to two IP numbers, 103.109.234.78 and 2a0f:b240:e:146::42

(0x666167676f74).top, scam.ceo, nojs.club and two other host names share IP numbers with php2shell.wtf.

Name Servers

php2shell.wtf uses two name servers for its delegation: launch1.spaceship.net and launch2.spaceship.net.

php2shell.wtf uses the same name servers as several other domains — among them zaya.chat, erionindus.site, claycarter.co and two more.

At least some of php2shell.wtf's name servers are also used by other domains, among them emarax.com.

The two host names launch1.spaceship.net and launch2.spaceship.net each have a pair of IP addresses: launch1.spaceship.net has 162.159.26.38 and 2400:cb00:2049:1::a29f:1a26, and launch2.spaceship.net has 162.159.27.32 and 2400:cb00:2049:1::a29f:1b20.