Check-Host.cc

Try 1.1.1.1 AS13335 check-host.cc /country/de /tld/cc
Domain

readermode.io

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

DNS Check HTTP Check Run Full Scan .io TLD

Run a live full scan of readermode.io

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now
Hosting IPs
—
A/AAAA targets
Subdomains
—
CT + scan + body
Record Types
—
seen in DNS
Observed Certs
—
in our scans

DNS Records

A
104.21.18.119, 172.67.181.206
AAAA
2606:4700:3031::ac43:b5ce, 2606:4700:3034::6815:1277
MX
10 mxa.mailgun.org, 10 mxb.mailgun.org
NS
adi.ns.cloudflare.com, lakas.ns.cloudflare.com
TXT
google-site-verification=0YkSnEyjNSJp51dPkMNfNrmDmlx1JyLZqrDZv7DATXs, v=spf1 include:mailgun.org ~all
CNAME
—
CAA
—

WHOIS / Registration

Registration data planned

Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.

Subdomains

Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.

Subdomain Resolves to Last seen
help.readermode.io
104.18.40.47 172.64.147.209 2606:4700:4402::ac40:93d1 2606:4700:4407::6812:282f
2026-06-22 00:29:14.510
readermode.io
104.21.18.119 2606:4700:3031::ac43:b5ce 2606:4700:3034::6815:1277 172.67.181.206
2026-06-22 00:29:14.510
www.readermode.io
104.21.18.119 2606:4700:3031::ac43:b5ce 2606:4700:3034::6815:1277 172.67.181.206
2026-06-22 00:29:14.510

Tech Stack

Tech detection pending

Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.

TLS Certificates

167.99.200.83:443 401eb4cb8d9b…
Subject: readermode.io
Issuer: YR1
SANs: readermode.io, www.readermode.io

IPs Citing This Domain

Hosts whose HTML body references this domain. Strong signal for origin/mirror/embed discovery.

167.99.200.83:443 href · ×6
167.99.200.83:443 og:url · ×1

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

Origin IP Origin ASN CDN ASN Confidence Reasoning
167.99.200.83 AS14061 AS13335 95% cert 401eb4cb… served by 167.99.200.83 (AS14061) carries SAN readermode.io which currently resolves through Cloudflare (AS13335) at 104.21.18.119, 172.67.181.206, 2606:4700:3034::6815:1277, 2606:4700:3031::ac43:b5ce

Threat Intelligence

Domain threat-intel pending

Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.

History

Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.

Type Value First seen Last seen
A 172.67.181.206 2026-06-15 08:38:41.482 2026-06-22 00:29:14.510
MX 10 mxb.mailgun.org 2026-06-15 08:38:41.482 2026-06-22 00:29:14.510
TXT v=spf1 include:mailgun.org ~all 2026-06-15 08:38:41.482 2026-06-22 00:29:14.510
AAAA 2606:4700:3031::ac43:b5ce 2026-06-15 08:38:41.482 2026-06-22 00:29:14.510
MX 10 mxa.mailgun.org 2026-06-15 08:38:41.482 2026-06-22 00:29:14.510
A 104.21.18.119 2026-06-15 08:38:41.482 2026-06-22 00:29:14.510
NS lakas.ns.cloudflare.com 2026-06-15 08:38:41.482 2026-06-22 00:29:14.510
NS adi.ns.cloudflare.com 2026-06-15 08:38:41.482 2026-06-22 00:29:14.510
TXT google-site-verification=0YkSnEyjNSJp51dPkMNfNrmDmlx1JyLZqrDZv7DATXs 2026-06-15 08:38:41.482 2026-06-22 00:29:14.510
AAAA 2606:4700:3034::6815:1277 2026-06-15 08:38:41.482 2026-06-22 00:29:14.510