Check-Host.cc

Domain

nodejs.org

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

Run a live full scan of nodejs.org

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now
Hosting IPs
6
A/AAAA targets
Subdomains
21
CT + scan + body
Record Types
5
seen in DNS
Observed Certs
10
in our scans

DNS Records

A
104.16.212.131, 104.16.213.131
AAAA
2606:4700::6810:d483, 2606:4700::6810:d583
MX
10 aspmx.l.google.com, 20 alt1.aspmx.l.google.com, 20 alt2.aspmx.l.google.com, 30 aspmx2.googlemail.com, 30 aspmx3.googlemail.com
NS
meera.ns.cloudflare.com, pablo.ns.cloudflare.com
TXT
google-site-verification=v0MKccGKHVIlJbu0s9K45qnPGB7EBWnKzjpsd010r4E, v=spf1 include:aspmx.googlemail.com -all
CNAME
CAA

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

Subject: *.nodejs.org
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.nodejs.org, nodejs.org
Subject: *.nodejs.org
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.nodejs.org, nodejs.org
Subject: unofficial-builds.nodejs.org
Issuer: R13
SANs: unofficial-builds.nodejs.org
Subject: *.nodejs.org
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.nodejs.org, nodejs.org
Subject: dev.claroshop.com
Issuer: ClaroShop int Router CA
SANs: *.cloudflare.docker.com, *.dev-ng.claroshop.com, *.dev.claroshop.com, *.docker.com, *.docker.io, *.github.com, *.jenkins.io, *.k3s.io, *.obs.ap-southeast-3.myhuaweicloud.com, *.quay.io, *.rancher.io, *.s3.amazonaws.com, api.mercadolibre.com, api.sandbox.claropagos.com, api.yotpo.com, asset-packagist.org, claroshop.anteater.ai, cuponessearsws.dev.handel-bit.io, dev.claroshop.com, develop.claroshopplus.com, docker-source-registry.amxdigital.net, docker.io, docs.projectcalico.org, feedsclaroshop-dev.buscador.amarello.com.mx, gcr.io, get.k3s.io, getcomposer.org, github-releases.githubusercontent.com, github.com, graph.facebook.com, heimdallr.amxdigital.net, ics2wstest.ic3.com, infracode.amxdigital.net, k8s.gcr.io, kubernetes.io, loginclaro.com, mirror.xmission.com, mrcapi.dev.sears.com.mx, nodejs.org, obs.ap-southeast-3.myhuaweicloud.com, onest-s4.com, packages.cloud.google.com, packagist.org, pagossearsws.dev.handel-bit.io, proxy_ssl_on, quay.io, saas-us-west-2.instana.io, seapi.dev.sears.com.mx, sears.anteater.ai, sso.dev-ng.claroshop.com, storage.googleapis.com
Subject: unofficial-builds.nodejs.org
Issuer: R13
SANs: unofficial-builds.nodejs.org
Subject: *.nodejs.org
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.nodejs.org, nodejs.org
Subject: unofficial-builds.nodejs.org
Issuer: R13
SANs: unofficial-builds.nodejs.org

IPs Citing This Domain

No citing IPs found yet

As the world-sweep progresses, hosts referencing this domain in their HTML will surface here.

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

Origin IP Origin ASN CDN ASN Confidence Reasoning
150.230.107.25 AS31898 AS13335 95% cert 01e45871… served by 150.230.107.25 (AS31898) carries SAN nodejs.org which currently resolves through Cloudflare (AS13335) at 104.16.212.131, 104.16.213.131, 2606:4700::6810:d483, 2606:4700::6810:d583
138.197.224.240 AS14061 AS13335 95% cert 01e45871… served by 138.197.224.240 (AS14061) carries SAN nodejs.org which currently resolves through Cloudflare (AS13335) at 104.16.212.131, 104.16.213.131, 2606:4700::6810:d483, 2606:4700::6810:d583

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.

Type Value First seen Last seen
A 104.16.213.131 2026-05-25 22:00:50.546 2026-07-28 20:31:39.973
A 104.16.212.131 2026-05-25 22:00:50.546 2026-07-28 20:31:39.973
AAAA 2606:4700::6810:d483 2026-05-25 22:00:50.546 2026-07-28 20:31:39.973
AAAA 2606:4700::6810:d583 2026-05-25 22:00:50.546 2026-07-28 20:31:39.973
MX 20 alt1.aspmx.l.google.com 2026-05-25 22:07:29.493 2026-07-28 20:31:39.973
MX 30 aspmx2.googlemail.com 2026-05-25 22:07:29.493 2026-07-28 20:31:39.973
MX 20 alt2.aspmx.l.google.com 2026-05-25 22:07:29.493 2026-07-28 20:31:39.973
TXT google-site-verification=v0MKccGKHVIlJbu0s9K45qnPGB7EBWnKzjpsd010r4E 2026-05-25 22:07:29.493 2026-07-28 20:31:39.973
NS pablo.ns.cloudflare.com 2026-05-25 22:07:29.493 2026-07-28 20:31:39.973
NS meera.ns.cloudflare.com 2026-05-25 22:07:29.493 2026-07-28 20:31:39.973
MX 10 aspmx.l.google.com 2026-05-25 22:07:29.493 2026-07-28 20:31:39.973
TXT v=spf1 include:aspmx.googlemail.com -all 2026-05-25 22:07:29.493 2026-07-28 20:31:39.973
MX 30 aspmx3.googlemail.com 2026-05-25 22:07:29.493 2026-07-28 20:31:39.973