Check-Host.cc

Try 1.1.1.1 AS13335 check-host.cc /country/de /tld/cc
Domain

cursor-cdn.com

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .com TLD

Run a live full scan of cursor-cdn.com

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now
Hosting IPs
6
A/AAAA targets
Subdomains
10
CT + scan + body
Record Types
3
seen in DNS
Observed Certs
11
in our scans

DNS Records

A
104.26.8.156, 104.26.9.156, 172.67.71.187
AAAA
2606:4700:20::681a:89c, 2606:4700:20::681a:99c, 2606:4700:20::ac43:47bb
MX
—
NS
melany.ns.cloudflare.com, scott.ns.cloudflare.com
TXT
—
CNAME
—
CAA
—

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.

Subdomain Resolves to Last seen
cursor-cdn.com
172.67.71.187 2606:4700:20::681a:89c 2606:4700:20::681a:99c 2606:4700:20::ac43:47bb +2
2026-06-22 18:27:36.562

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

98.159.111.69:443 66af4c63a21b…
Subject: *.cursor.sh
Issuer: *.cursor.sh
SANs: *.cursor.sh, 98.159.111.69, agentn.api5.cursor.sh, agentn.global.api5.cursor.sh, api2.cursor.sh, api3.cursor.sh, api4.cursor.sh, api5.cursor.sh, asia.api5.cursor.sh, authentication.cursor.sh, authenticator.cursor.sh, cursor-cdn.com, downloads.cursor.com, eu.api5.cursor.sh, eu.authentication.cursor.sh, marketplace.cursorapi.com, metrics.cursor.sh, repo42.cursor.sh, us-only.gcpp.cursor.sh, us.api5.cursor.sh, us.authentication.cursor.sh

IPs Citing This Domain

No citing IPs found yet

As the world-sweep progresses, hosts referencing this domain in their HTML will surface here.

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

Origin IP Origin ASN CDN ASN Confidence Reasoning
98.159.111.69 AS63023 AS13335 95% cert 66af4c63… served by 98.159.111.69 (AS63023) carries SAN cursor-cdn.com which currently resolves through Cloudflare (AS13335) at 104.26.8.156, 104.26.9.156, 172.67.71.187, 2606:4700:20::681a:89c

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.

Type Value First seen Last seen
AAAA 2606:4700:20::681a:89c 2026-06-01 23:09:42.711 2026-06-22 18:27:36.562
NS scott.ns.cloudflare.com 2026-06-01 23:09:42.711 2026-06-22 18:27:36.562
AAAA 2606:4700:20::681a:99c 2026-06-01 23:09:42.711 2026-06-22 18:27:36.562
A 172.67.71.187 2026-06-01 23:09:42.711 2026-06-22 18:27:36.562
A 104.26.8.156 2026-06-01 23:09:42.711 2026-06-22 18:27:36.562
A 104.26.9.156 2026-06-01 23:09:42.711 2026-06-22 18:27:36.562
NS melany.ns.cloudflare.com 2026-06-01 23:09:42.711 2026-06-22 18:27:36.562
AAAA 2606:4700:20::ac43:47bb 2026-06-01 23:09:42.711 2026-06-22 18:27:36.562