Check-Host.cc

Try 1.1.1.1 AS13335 check-host.cc /country/de /tld/cc
Domain

killer.sh

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .sh TLD

Run a live full scan of killer.sh

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now
Hosting IPs
6
A/AAAA targets
Subdomains
6
CT + scan + body
Record Types
5
seen in DNS
Observed Certs
13
in our scans

DNS Records

A
104.26.10.136, 104.26.11.136, 172.67.68.150
AAAA
2606:4700:20::681a:a88, 2606:4700:20::681a:b88, 2606:4700:20::ac43:4496
MX
10 mail.protonmail.ch, 20 mailsec.protonmail.ch
NS
jermaine.ns.cloudflare.com, mariah.ns.cloudflare.com
TXT
protonmail-verification=37d946b477a7273030ace3878ee2176dec20a2fd, v=spf1 include:_spf.protonmail.ch mx ~all
CNAME
—
CAA
—

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.

Subdomain Resolves to Last seen
killer.sh
104.26.10.136 2606:4700:20::ac43:4496 2606:4700:20::681a:b88 104.26.11.136 +2
2026-07-27 11:30:55.038
test.killer.sh
172.67.68.150 104.26.11.136 104.26.10.136 2606:4700:20::681a:a88 +2
2026-05-26 11:11:25.820

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

130.162.228.208:443 643f27234167…
Subject: *.killer.sh
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.killer.sh, killer.sh
132.226.109.89:443 643f27234167…
Subject: *.killer.sh
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.killer.sh, killer.sh
140.245.127.193:443 643f27234167…
Subject: *.killer.sh
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.killer.sh, killer.sh
92.5.104.195:443 652efd40c809…
Subject: *.test.killer.sh
Issuer: R12
SANs: *.test.killer.sh, test.killer.sh

IPs Citing This Domain

Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.

106.54.242.3:8000 href · ×1
3.91.24.108:443 href · ×1

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

Origin IP Origin ASN CDN ASN Confidence Reasoning
51.89.20.154 AS16276 AS13335 95% cert 229f3544… served by 51.89.20.154 (AS16276) carries SAN killer.sh which currently resolves through Cloudflare (AS13335) at 104.26.10.136, 104.26.11.136, 172.67.68.150, 2606:4700:20::ac43:4496
198.27.75.15 AS16276 AS13335 95% cert 229f3544… served by 198.27.75.15 (AS16276) carries SAN killer.sh which currently resolves through Cloudflare (AS13335) at 104.26.10.136, 104.26.11.136, 172.67.68.150, 2606:4700:20::ac43:4496
130.162.228.208 AS31898 AS13335 95% cert 643f2723… served by 130.162.228.208 (AS31898) carries SAN killer.sh which currently resolves through Cloudflare (AS13335) at 104.26.10.136, 104.26.11.136, 172.67.68.150, 2606:4700:20::ac43:4496
141.94.74.69 AS16276 AS13335 95% cert 229f3544… served by 141.94.74.69 (AS16276) carries SAN killer.sh which currently resolves through Cloudflare (AS13335) at 104.26.10.136, 104.26.11.136, 172.67.68.150, 2606:4700:20::ac43:4496
132.226.109.89 AS31898 AS13335 95% cert 643f2723… served by 132.226.109.89 (AS31898) carries SAN killer.sh which currently resolves through Cloudflare (AS13335) at 104.26.10.136, 104.26.11.136, 172.67.68.150, 2606:4700:20::ac43:4496
51.161.116.178 AS16276 AS13335 95% cert 229f3544… served by 51.161.116.178 (AS16276) carries SAN killer.sh which currently resolves through Cloudflare (AS13335) at 104.26.10.136, 104.26.11.136, 172.67.68.150, 2606:4700:20::ac43:4496
15.235.216.45 AS16276 AS13335 95% cert 229f3544… served by 15.235.216.45 (AS16276) carries SAN killer.sh which currently resolves through Cloudflare (AS13335) at 104.26.10.136, 104.26.11.136, 172.67.68.150, 2606:4700:20::ac43:4496
51.79.99.40 AS16276 AS13335 95% cert 229f3544… served by 51.79.99.40 (AS16276) carries SAN killer.sh which currently resolves through Cloudflare (AS13335) at 104.26.10.136, 104.26.11.136, 172.67.68.150, 2606:4700:20::ac43:4496
54.36.110.160 AS16276 AS13335 95% cert 229f3544… served by 54.36.110.160 (AS16276) carries SAN killer.sh which currently resolves through Cloudflare (AS13335) at 104.26.10.136, 104.26.11.136, 172.67.68.150, 2606:4700:20::ac43:4496
140.245.127.193 AS31898 AS13335 95% cert 643f2723… served by 140.245.127.193 (AS31898) carries SAN killer.sh which currently resolves through Cloudflare (AS13335) at 104.26.10.136, 104.26.11.136, 172.67.68.150, 2606:4700:20::ac43:4496
151.80.20.48 AS16276 AS13335 95% cert 229f3544… served by 151.80.20.48 (AS16276) carries SAN killer.sh which currently resolves through Cloudflare (AS13335) at 104.26.10.136, 104.26.11.136, 172.67.68.150, 2606:4700:20::ac43:4496
92.5.104.195 AS31898 AS13335 95% cert 652efd40… served by 92.5.104.195 (AS31898) carries SAN test.killer.sh which currently resolves through Cloudflare (AS13335) at 104.26.10.136, 104.26.11.136, 172.67.68.150, 2606:4700:20::ac43:4496
15.235.216.43 AS16276 AS13335 95% cert 229f3544… served by 15.235.216.43 (AS16276) carries SAN killer.sh which currently resolves through Cloudflare (AS13335) at 104.26.10.136, 104.26.11.136, 172.67.68.150, 2606:4700:20::ac43:4496

CT-Log Evidence

Certificates from public Certificate Transparency logs whose subject or SAN names this domain — including historic certs we never observed live.

2cbf2aceec3cd360… google · argon2026h2
Subject: *.killer.sh
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.killer.sh, killer.sh
Valid: 2025-07-31 00:00:00 → 2026-08-31 23:59:59
643f27234167bc22… google · xenon2026h2
Subject: *.killer.sh
Issuer: Sectigo Public Server Authentication CA DV R36
SANs: *.killer.sh, killer.sh
Valid: 2025-07-31 00:00:00 → 2026-08-31 23:59:59

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.

Type Value First seen Last seen
AAAA 2606:4700:20::ac43:4496 2026-05-26 06:14:31.784 2026-07-27 11:30:55.038
AAAA 2606:4700:20::681a:b88 2026-05-26 06:14:31.784 2026-07-27 11:30:55.038
A 104.26.10.136 2026-05-26 06:14:31.784 2026-07-27 11:30:55.038
A 104.26.11.136 2026-05-26 06:14:31.784 2026-07-27 11:30:55.038
AAAA 2606:4700:20::681a:a88 2026-05-26 06:14:31.784 2026-07-27 11:30:55.038
A 172.67.68.150 2026-05-26 06:14:31.784 2026-07-27 11:30:55.038
NS jermaine.ns.cloudflare.com 2026-05-26 06:14:31.784 2026-07-27 11:30:55.038
MX 20 mailsec.protonmail.ch 2026-05-26 06:14:31.784 2026-07-27 11:30:55.038
TXT v=spf1 include:_spf.protonmail.ch mx ~all 2026-05-26 06:14:31.784 2026-07-27 11:30:55.038
MX 10 mail.protonmail.ch 2026-05-26 06:14:31.784 2026-07-27 11:30:55.038
NS mariah.ns.cloudflare.com 2026-05-26 06:14:31.784 2026-07-27 11:30:55.038
TXT protonmail-verification=37d946b477a7273030ace3878ee2176dec20a2fd 2026-05-26 06:14:31.784 2026-07-27 11:30:55.038