Check-Host.cc

Try 1.1.1.1 AS13335 check-host.cc /country/de /tld/cc
Domain

nighthawk.moe

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .moe TLD

Run a live full scan of nighthawk.moe

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now
Hosting IPs
14
A/AAAA targets
Subdomains
48
CT + scan + body
Record Types
5
seen in DNS
Observed Certs
9
in our scans

DNS Records

A
107.172.62.194
AAAA
—
MX
11 route3.mx.cloudflare.net, 60 route2.mx.cloudflare.net, 64 route1.mx.cloudflare.net
NS
ingrid.ns.cloudflare.com, zeus.ns.cloudflare.com
TXT
did=did:plc:bhjlvrekomilytj2y6unb7jx, v=spf1 include:_spf.mx.cloudflare.net ~all, v=spf1 mx -all
CNAME
—
CAA
0 issue "\ndigicert.com", 0 issue "comodoca.com", 0 issue "digicert.com; cansignhttpexchanges=yes", 0 issue "letsencrypt.org", 0 issue "pki.goog; cansignhttpexchanges=yes", 0 issue "ssl.com", 0 issuewild "comodoca.com", 0 issuewild "digicert.com; cansignhttpexchanges=yes"

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.

Subdomain Resolves to Last seen
manyfold.nighthawk.moe
188.114.97.0 2a06:98c1:3120::3 172.67.203.20 104.21.77.10 +8
2026-07-16 11:08:25.783
2fa.nighthawk.moe
104.21.77.10 2a06:98c1:3121::3 2a06:98c1:3120:: 2a06:98c1:3121:: +6
2026-07-16 11:08:25.783
git.nighthawk.moe
188.114.96.0 2606:4700:3037::6815:4d0a 172.67.203.20 104.21.77.10 +6
2026-07-16 11:08:25.783
photos.nighthawk.moe
104.21.77.10 2606:4700:3032::ac43:cb14 2a06:98c1:3121:: 2a06:98c1:3120:: +6
2026-07-16 11:08:25.783
jellyfin.nighthawk.moe
188.114.96.0 188.114.97.3 188.114.96.3 2a06:98c1:3121::3 +4
2026-07-16 11:08:25.783
navidrome.nighthawk.moe
188.114.96.0 2a06:98c1:3120:: 188.114.96.3 188.114.97.3 +4
2026-07-16 11:08:25.783
windrose.nighthawk.moe
188.114.97.3 2a06:98c1:3120:: 2a06:98c1:3121:: 188.114.96.3 +4
2026-07-16 11:08:25.783
audiobookshelf.nighthawk.moe
188.114.96.3 188.114.97.3 2a06:98c1:3121::3 2a06:98c1:3120::3 +1
2026-07-16 11:08:25.783
bambuddy.nighthawk.moe
188.114.96.3 188.114.97.3 2a06:98c1:3121::3 2a06:98c1:3120::3
2026-05-26 02:26:35.941
budget.nighthawk.moe
172.67.203.20 104.21.77.10 2a06:98c1:3121::3 2a06:98c1:3120::3
2026-06-19 14:40:13.127
apollo.nighthawk.moe
1970-01-01 00:00:00.000
charybdis.nighthawk.moe
107.172.62.194
2026-07-16 11:08:25.783
invidious.nighthawk.moe
1970-01-01 00:00:00.000
mail.nighthawk.moe
107.172.62.194
2026-07-16 11:08:25.783
nighthawk.moe
107.172.62.194
2026-07-16 11:08:25.783
sillytavern.nighthawk.moe
192.168.192.200
2026-05-26 02:26:35.941
synclounge.nighthawk.moe
1970-01-01 00:00:00.000
vpn.nighthawk.moe
107.172.62.194
2026-07-16 11:08:25.783

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

107.172.62.194:443 542f58635bc5…
Subject: charybdis.nighthawk.moe
Issuer: Cosmos Root CA jVzq8
SANs: 2fa.nighthawk.moe, audiobookshelf.nighthawk.moe, charybdis.nighthawk.moe, git.nighthawk.moe, jellyfin.nighthawk.moe, mail.nighthawk.moe, manyfold.nighthawk.moe, navidrome.nighthawk.moe, nighthawk.moe, photos.nighthawk.moe, recurverescue.com, vpn.nighthawk.moe, windrose.nighthawk.moe
107.172.62.194:443 7932cb292d42…
Subject: charybdis.nighthawk.moe
Issuer: Cosmos Root CA jVzq8
SANs: 2fa.nighthawk.moe, audiobookshelf.nighthawk.moe, bambuddy.nighthawk.moe, charybdis.nighthawk.moe, git.nighthawk.moe, jellyfin.nighthawk.moe, manyfold.nighthawk.moe, navidrome.nighthawk.moe, nighthawk.moe, photos.nighthawk.moe, recurverescue.com, sillytavern.nighthawk.moe, vpn.nighthawk.moe, windrose.nighthawk.moe

IPs Citing This Domain

No citing IPs found yet

As the world-sweep progresses, hosts referencing this domain in their HTML will surface here.

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

Origin IP Origin ASN CDN ASN Confidence Reasoning
107.172.62.194 AS36352 AS13335 95% cert 542f5863… served by 107.172.62.194 (AS36352) carries SAN 2fa.nighthawk.moe which currently resolves through Cloudflare (AS13335) at 172.67.203.20, 104.21.77.10, 2a06:98c1:3120::3, 2a06:98c1:3121::3
107.172.62.194 AS36352 AS13335 95% cert 7932cb29… served by 107.172.62.194 (AS36352) carries SAN 2fa.nighthawk.moe which currently resolves through Cloudflare (AS13335) at 172.67.203.20, 104.21.77.10, 2606:4700:3032::ac43:cb14, 2606:4700:3037::6815:4d0a

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.

Type Value First seen Last seen
TXT v=spf1 include:_spf.mx.cloudflare.net ~all 2026-05-26 02:26:35.941 2026-07-16 11:08:25.783
A 107.172.62.194 2026-05-26 02:26:35.941 2026-07-16 11:08:25.783
MX 60 route2.mx.cloudflare.net 2026-05-26 02:26:35.941 2026-07-16 11:08:25.783
MX 64 route1.mx.cloudflare.net 2026-05-26 02:26:35.941 2026-07-16 11:08:25.783
NS zeus.ns.cloudflare.com 2026-05-26 02:26:35.941 2026-07-16 11:08:25.783
MX 11 route3.mx.cloudflare.net 2026-05-26 02:26:35.941 2026-07-16 11:08:25.783
TXT did=did:plc:bhjlvrekomilytj2y6unb7jx 2026-05-26 02:26:35.941 2026-07-16 11:08:25.783
NS ingrid.ns.cloudflare.com 2026-05-26 02:26:35.941 2026-07-16 11:08:25.783
CAA 0 issue "\ndigicert.com" 2026-06-19 14:40:13.127 2026-07-16 11:08:25.783
CAA 0 issue "ssl.com" 2026-06-19 14:40:13.127 2026-07-16 11:08:25.783
CAA 0 issuewild "digicert.com; cansignhttpexchanges=yes" 2026-06-19 14:40:13.127 2026-07-16 11:08:25.783
CAA 0 issuewild "ssl.com" 2026-06-19 14:40:13.127 2026-07-16 11:08:25.783
CAA 0 issue "digicert.com; cansignhttpexchanges=yes" 2026-06-19 14:40:13.127 2026-07-16 11:08:25.783
CAA 0 issuewild "comodoca.com" 2026-06-19 14:40:13.127 2026-07-16 11:08:25.783
CAA 0 issuewild "letsencrypt.org" 2026-06-19 14:40:13.127 2026-07-16 11:08:25.783
CAA 0 issuewild "pki.goog; cansignhttpexchanges=yes" 2026-06-19 14:40:13.127 2026-07-16 11:08:25.783
TXT v=spf1 mx -all 2026-06-19 14:40:13.127 2026-06-19 14:40:13.127
CAA 0 issue "letsencrypt.org" 2026-06-19 14:40:13.127 2026-07-16 11:08:25.783
CAA 0 issue "comodoca.com" 2026-06-19 14:40:13.127 2026-07-16 11:08:25.783
CAA 0 issue "pki.goog; cansignhttpexchanges=yes" 2026-06-19 14:40:13.127 2026-07-16 11:08:25.783