Domain
collok.io
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of collok.io
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
Hosting IPs
8
A/AAAA targets
Subdomains
6
CT + scan + body
Record Types
5
seen in DNS
Observed Certs
5
in our scans
DNS Records
A
162.159.140.98, 172.66.0.96
AAAA
2606:4700:7::60, 2a06:98c1:58::60
MX
1 aspmx.l.google.com, 10 alt3.aspmx.l.google.com, 10 alt4.aspmx.l.google.com, 5 alt1.aspmx.l.google.com, 5 alt2.aspmx.l.google.com
NS
ns1.digitalocean.com, ns2.digitalocean.com, ns3.digitalocean.com
TXT
google-site-verification=iAa1FF71ubSWQV9eNcVifj4ibYKUBQg3Qv7876yFhRs, google-site-verification=mKVULobqrTZBRw-umlvEEnX8_lj8E218Ox_5meIqqOU, v=spf1 include:_spf.google.com ~all
CNAME
—
CAA
—
WHOIS / Registration
Registration data planned
Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.
Subdomains
Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.
| Subdomain | Resolves to | Last seen |
|---|---|---|
| collok.io | 2026-07-26 10:20:06.546 | |
| track.collok.io | 2026-07-15 17:36:24.398 |
Tech Stack
Tech detection pending
Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.
TLS Certificates
Subject: *.collok.io
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.collok.io, collok.io
Subject: *.collok.io
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.collok.io, collok.io
Subject: *.collok.io
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.collok.io, collok.io
Subject: *.collok.io
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.collok.io, collok.io
Subject: *.collok.io
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.collok.io, collok.io
Subject: *.collok.io
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.collok.io, collok.io
Subject: *.collok.io
Issuer: Sectigo RSA Domain Validation Secure Server CA
SANs: *.collok.io, collok.io
Subject: *.collok.io
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.collok.io, collok.io
Subject: *.collok.io
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.collok.io, collok.io
Subject: *.collok.io
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.collok.io, collok.io
Subject: *.collok.io
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.collok.io, collok.io
Subject: *.collok.io
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.collok.io, collok.io
IPs Citing This Domain
Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.
143.110.236.196:443
og:url · ×4
143.110.236.196:443
href · ×4
143.198.157.117:443
href · ×2
64.23.140.125:443
href · ×2
143.198.157.117:443
og:url · ×2
209.38.159.222:443
og:url · ×2
209.38.159.222:443
href · ×2
64.23.140.125:443
og:url · ×2
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
| Origin IP | Origin ASN | CDN ASN | Confidence | Reasoning |
|---|---|---|---|---|
| 64.225.91.181 | AS14061 | AS13335 | 95% | cert 3bf9cf82… served by 64.225.91.181 (AS14061) carries SAN collok.io which currently resolves through Cloudflare (AS13335) at 172.66.0.96, 2a06:98c1:58::60, 2606:4700:7::60, 162.159.140.98 |
| 64.23.189.231 | AS14061 | AS13335 | 95% | cert 3bf9cf82… served by 64.23.189.231 (AS14061) carries SAN collok.io which currently resolves through Cloudflare (AS13335) at 172.66.0.96, 2a06:98c1:58::60, 2606:4700:7::60, 162.159.140.98 |
| 64.23.140.125 | AS14061 | AS13335 | 95% | cert 3bf9cf82… served by 64.23.140.125 (AS14061) carries SAN collok.io which currently resolves through Cloudflare (AS13335) at 172.66.0.96, 2a06:98c1:58::60, 2606:4700:7::60, 162.159.140.98 |
| 64.225.88.172 | AS14061 | AS13335 | 95% | cert c75a88e8… served by 64.225.88.172 (AS14061) carries SAN collok.io which currently resolves through Cloudflare (AS13335) at 172.66.0.96, 2a06:98c1:58::60, 2606:4700:7::60, 162.159.140.98 |
| 147.182.241.45 | AS14061 | AS13335 | 95% | cert 3bf9cf82… served by 147.182.241.45 (AS14061) carries SAN collok.io which currently resolves through Cloudflare (AS13335) at 172.66.0.96, 2a06:98c1:58::60, 2606:4700:7::60, 162.159.140.98 |
| 143.110.236.196 | AS14061 | AS13335 | 95% | cert 3bf9cf82… served by 143.110.236.196 (AS14061) carries SAN collok.io which currently resolves through Cloudflare (AS13335) at 172.66.0.96, 2a06:98c1:58::60, 2606:4700:7::60, 162.159.140.98 |
| 143.244.209.210 | AS14061 | AS13335 | 95% | cert 3bf9cf82… served by 143.244.209.210 (AS14061) carries SAN collok.io which currently resolves through Cloudflare (AS13335) at 172.66.0.96, 2a06:98c1:58::60, 2606:4700:7::60, 162.159.140.98 |
| 143.198.79.30 | AS14061 | AS13335 | 95% | cert 3bf9cf82… served by 143.198.79.30 (AS14061) carries SAN collok.io which currently resolves through Cloudflare (AS13335) at 172.66.0.96, 2a06:98c1:58::60, 2606:4700:7::60, 162.159.140.98 |
| 143.110.158.150 | AS14061 | AS13335 | 95% | cert 3bf9cf82… served by 143.110.158.150 (AS14061) carries SAN collok.io which currently resolves through Cloudflare (AS13335) at 172.66.0.96, 2a06:98c1:58::60, 2606:4700:7::60, 162.159.140.98 |
CT-Log Evidence
Certificates from public Certificate Transparency logs whose subject or SAN names this domain — including historic certs we never observed live.
3bf9cf824e467eca…
google · argon2026h2
Subject: *.collok.io
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.collok.io, collok.io
Valid: 2025-12-12 00:00:00 → 2026-12-18 23:59:59
ff9d607b279e94f6…
google · argon2026h2
Subject: *.collok.io
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.collok.io, collok.io
Valid: 2025-12-12 00:00:00 → 2026-12-18 23:59:59
Threat Intelligence
Domain threat-intel pending
Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.
History
Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.
| Type | Value | First seen | Last seen |
|---|---|---|---|
| A | 162.159.140.98 | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| TXT | v=spf1 include:_spf.google.com ~all | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| AAAA | 2a06:98c1:58::60 | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| A | 172.66.0.96 | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| NS | ns1.digitalocean.com | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| NS | ns3.digitalocean.com | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| TXT | google-site-verification=mKVULobqrTZBRw-umlvEEnX8_lj8E218Ox_5meIqqOU | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| NS | ns2.digitalocean.com | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| MX | 5 alt2.aspmx.l.google.com | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| MX | 10 alt4.aspmx.l.google.com | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| MX | 1 aspmx.l.google.com | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| AAAA | 2606:4700:7::60 | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| TXT | google-site-verification=iAa1FF71ubSWQV9eNcVifj4ibYKUBQg3Qv7876yFhRs | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| MX | 5 alt1.aspmx.l.google.com | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |
| MX | 10 alt3.aspmx.l.google.com | 2026-05-26 07:29:14.780 | 2026-07-26 10:20:06.546 |