Check-Host.cc

Try 1.1.1.1 AS13335 check-host.cc /country/de /tld/cc
Domain

vpn.ht

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .ht TLD

Run a live full scan of vpn.ht

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now
Hosting IPs
2
A/AAAA targets
Subdomains
3
CT + scan + body
Record Types
4
seen in DNS
Observed Certs
2
in our scans

DNS Records

A
195.154.162.240
AAAA
—
MX
1 alt1.aspmx.l.google.com, 1 aspmx.l.google.com, 10 alt3.aspmx.l.google.com, 10 alt4.aspmx.l.google.com, 5 alt2.aspmx.l.google.com
NS
ns1.vpn.ht, ns2.vpn.ht
TXT
v=spf1 a include:_spf.google.com include:mailgun.org ip4:62.210.70.3/32 ~all
CNAME
—
CAA
—

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Subdomain enumeration pending

Every subdomain ever issued a TLS cert under this apex — extracted from Certificate Transparency logs, our own scan observations and body references.

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

217.23.13.24:443 12f3cb4358d0…
Subject: *.vpn.ht
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.vpn.ht, vpn.ht
141.57.108.3:443 741aa305f4d9…
Subject: vpn.htwk-leipzig.de
Issuer: GEANT TLS RSA 1
SANs: vpn.htwk-leipzig.de
46.225.193.12:443 4328d10f81e7…
Subject: vpn.htz.zncr.pro
Issuer: YE1
SANs: vpn.htz.zncr.pro
159.69.233.194:443 097de294b303…
Subject: vpn.htz.smlabs.net
Issuer: YR2
SANs: vpn.htz.smlabs.net
212.211.224.89:443 0499aad82f8d…
Subject: webvpn.htw-o.de
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: webvpn.htw-o.de, www.webvpn.htw-o.de
141.18.1.237:443 42a22e5e1a50…
Subject: vpn.htw-aalen.de
Issuer: GEANT TLS RSA 1
SANs: vpn.hs-aalen.de, vpn.htw-aalen.de
141.57.199.21:443 fd26e1234896…
Subject: verw-vpn.htwk-leipzig.de
Issuer: GEANT TLS RSA 1
SANs: verw-vpn.htwk-leipzig.de, vpn-verw.htwk-leipzig.de, vpn.verw.htwk-leipzig.de
213.182.7.52:443 3b346c82fcfb…
Subject: vpn.htm-automotive.de
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: vpn.htm-automotive.de, www.vpn.htm-automotive.de
79.134.108.6:443 5bc51e0954e4…
Subject: sslvpn.htj.fi
Issuer: R12
SANs: sslvpn.htj.fi
192.121.66.40:443 d79d97678296…
Subject: vpn.htd.se
Issuer: Go Daddy Secure Certificate Authority - G2
SANs: vpn.htd.se, vpn2.htd.se, www.vpn.htd.se
85.128.87.243:8443 c3bde54d0ce4…
Subject: vpn.htl-strefa.pl
Issuer: Sectigo RSA Domain Validation Secure Server CA
SANs: vpn.htl-strefa.pl, www.vpn.htl-strefa.pl
159.69.12.245:443 e7757e9fcfd1…
Subject: ampe-vpn.htz.rexalto.tech
Issuer: E7
SANs: ampe-vpn.htz.rexalto.tech
72.234.166.149:8443 b7cd883f40cf…
Subject: vpn.hth-am.com
Issuer: FGT40FTK23061588
SANs: vpn.hth-am.com
52.166.249.225:443 6a4b807563de…
Subject: cloudvpn.htm.nl
Issuer: Thawte TLS RSA CA G1
SANs: cloudvpn.htm.nl
77.75.204.8:443 54ef31bf9503…
Subject: vpn.ht-feinkost.de
Issuer: R12
SANs: vpn.ht-feinkost.de
193.170.206.242:443 e23373238ad3…
Subject: sslvpn.htl-hl.ac.at
Issuer: R12
SANs: sslvpn.htl-hl.ac.at

IPs Citing This Domain

Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.

103.51.145.55:8080 href · ×1

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

No origin-IP leaks detected (yet)

Either this domain doesn't sit behind a CDN, or we haven't seen a TLS cert from a non-CDN IP matching this hostname. Run a fullscan to refresh the cert→IP cross-reference.

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.

Type Value First seen Last seen
A 195.154.162.240 2026-05-26 22:19:32.341 2026-07-28 18:09:13.258
MX 1 alt1.aspmx.l.google.com 2026-05-26 22:19:32.341 2026-07-28 18:09:13.258
NS ns1.vpn.ht 2026-05-26 22:19:32.341 2026-07-28 18:09:13.258
TXT v=spf1 a include:_spf.google.com include:mailgun.org ip4:62.210.70.3/32 ~all 2026-05-26 22:19:32.341 2026-07-28 18:09:13.258
MX 5 alt2.aspmx.l.google.com 2026-05-26 22:19:32.341 2026-07-28 18:09:13.258
MX 10 alt4.aspmx.l.google.com 2026-05-26 22:19:32.341 2026-07-28 18:09:13.258
MX 1 aspmx.l.google.com 2026-05-26 22:19:32.341 2026-07-28 18:09:13.258
MX 10 alt3.aspmx.l.google.com 2026-05-26 22:19:32.341 2026-07-28 18:09:13.258
NS ns2.vpn.ht 2026-05-26 22:19:32.341 2026-07-28 18:09:13.258