wannacry.cc - robtex.com

wannacry.cc

DNSSEC⚠️ Not signed
A2606:4700:3031::ac43:b47f🇺🇸 Cloudflare2606:4700:3031::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US ✓ In HTTPS hints
A2606:4700:3037::6815:53b7🇺🇸 Cloudflare2606:4700:3037::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US ✓ In HTTPS hints
A104.21.83.183Cloudflare104.21.80.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US ✓ In HTTPS hints
A172.67.180.127🇺🇸 Cloudflare172.67.176.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US ✓ In HTTPS hints
NSbrett.ns.cloudflare.com ⭐
A2606:4700:58::adf5:3b4c🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRbrett.ns.cloudflare.com
A2803:f800:50::6ca2:c14c🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L
PTRbrett.ns.cloudflare.com
A2a06:98c1:50::ac40:214c🇺🇸 Cloudflare2a06:98c1:50::/45
PTRbrett.ns.cloudflare.com
A108.162.193.76🇺🇸 Cloudflare108.162.193.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRbrett.ns.cloudflare.com
A172.64.33.76🇺🇸 Cloudflare172.64.33.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRbrett.ns.cloudflare.com
A173.245.59.76🇺🇸 Cloudflare173.245.59.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRbrett.ns.cloudflare.com
NSluciana.ns.cloudflare.com
A2606:4700:50::a29f:2683🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRluciana.ns.cloudflare.com
A2803:f800:50::6ca2:c283🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L
PTRluciana.ns.cloudflare.com
A2a06:98c1:50::ac40:2283🇺🇸 Cloudflare2a06:98c1:50::/45
PTRluciana.ns.cloudflare.com
A108.162.194.131🇺🇸 Cloudflare108.162.194.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRluciana.ns.cloudflare.com
A162.159.38.131Cloudflare162.159.32.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRluciana.ns.cloudflare.com
A172.64.34.131🇺🇸 Cloudflare172.64.34.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US
PTRluciana.ns.cloudflare.com
MXeforward2.registrar-servers.com ⭐
A162.255.118.52🇺🇸 NAMCHEAP-PH162.255.118.0/24 Namecheap, Inc. 11400 W. Olympic Blvd. Suite 200 Los Angeles, CA 90064 UNITED STATES
PTReforward2.registrar-servers.com
MXeforward3.registrar-servers.com ⭐
A162.255.118.51🇺🇸 NAMCHEAP-PH162.255.118.0/24 Namecheap, Inc. 11400 W. Olympic Blvd. Suite 200 Los Angeles, CA 90064 UNITED STATES
PTReforward1.registrar-servers.com
PTReforward3.registrar-servers.com
MXeforward4.registrar-servers.com(15)
A162.255.118.52🇺🇸 NAMCHEAP-PH162.255.118.0/24 Namecheap, Inc. 11400 W. Olympic Blvd. Suite 200 Los Angeles, CA 90064 UNITED STATES
PTReforward2.registrar-servers.com
MXeforward5.registrar-servers.com(20)
A162.255.118.51🇺🇸 NAMCHEAP-PH162.255.118.0/24 Namecheap, Inc. 11400 W. Olympic Blvd. Suite 200 Los Angeles, CA 90064 UNITED STATES
PTReforward1.registrar-servers.com
PTReforward3.registrar-servers.com
TXTv=spf1 include:spf.efwd.registrar-servers.com ~all
HTTPSHTTP/3, HTTP/2 ✓ hints match
IPv4 hints104.21.83.183, 172.67.180.127
IPv6 hints2606:4700:3031::ac43:b47f, 2606:4700:3037::6815:53b7
ECHX25519, HKDF-SHA256 + AES-128-GCM draft, id=73, name=cloudflare-ech.com
SOAbrett.ns.cloudflare.comdns@cloudflare.com serial=2402322705

cc

DNSSEC🔒 Signed (DS record present)
NSac1.nstld.com ⭐
NSac2.nstld.com
NSac3.nstld.com
NSac4.nstld.com
SOAac1.nstld.cominfo@verisign-grs.com serial=1776981062

Same first word

wannacry.net
wannacry.com
wannacry.cc

DNS History

10 records (10 active, 0 former)

NSbrett.ns.cloudflare.comluciana.ns.cloudflare.comMXeforward2.registrar-servers.comeforward3.registrar-servers.comeforward4.registrar-servers.comeforward5.registrar-servers.comA104.21.83.183172.67.180.1272606:4700:3031::ac43:b47f2606:4700:3037::6815:53b7
●NSbrett.ns.cloudflare.com2026-03-31 → 2026-04-23 · 2 obs
● 2026-03-31 17:54:48
● 2026-04-23 21:53:22
●NSluciana.ns.cloudflare.com2026-03-31 → 2026-04-23 · 2 obs
● 2026-03-31 17:54:48
● 2026-04-23 21:53:22
●MXeforward2.registrar-servers.com2026-03-31 → 2026-04-23 · 2 obs
● 2026-03-31 17:54:48
● 2026-04-23 21:53:22
●MXeforward3.registrar-servers.com2026-03-31 → 2026-04-23 · 2 obs
● 2026-03-31 17:54:48
● 2026-04-23 21:53:22
●MXeforward4.registrar-servers.com2026-03-31 → 2026-04-23 · 2 obs
● 2026-03-31 17:54:48
● 2026-04-23 21:53:22
●MXeforward5.registrar-servers.com2026-03-31 → 2026-04-23 · 2 obs
● 2026-03-31 17:54:48
● 2026-04-23 21:53:22
●A104.21.83.1832026-03-31 → 2026-04-23 · 2 obs
● 2026-03-31 17:54:48
● 2026-04-23 21:53:22
●A172.67.180.1272026-03-31 → 2026-04-23 · 2 obs
● 2026-03-31 17:54:48
● 2026-04-23 21:53:22
●A2606:4700:3031::ac43:b47f2026-03-31 → 2026-04-23 · 2 obs
● 2026-03-31 17:54:48
● 2026-04-23 21:53:22
●A2606:4700:3037::6815:53b72026-03-31 → 2026-04-23 · 2 obs
● 2026-03-31 17:54:48
● 2026-04-23 21:53:22

🔍 DNS Trace

📋 Delegation Chain

ZoneNameserversGlue
ccac3.nstld.com, ac1.nstld.com, ac4.nstld.com, ac2.nstld.com-
wannacry.ccluciana.ns.cloudflare.com, brett.ns.cloudflare.com-

✅ Authoritative Response

Server:108.162.193.76

NS records: luciana.ns.cloudflare.com, brett.ns.cloudflare.com

🔒 DNSSEC Status

⚠️ Insecure (no DNSSEC)

No DS record for wannacry.cc (unsigned zone)

⏱️ Timing

Total: 353ms | Queries: -

📄 Records

TypeCountSample Data
A2104.21.83.183, 172.67.180.127
AAAA22606:4700:3031::ac43:b47f, 2606:4700:3037::6815:53b7
NS2brett.ns.cloudflare.com, luciana.ns.cloudflare.com
MX4eforward2.registrar-servers.com (pri: 10, eforward3.registrar-servers.com (pri: 10...
TXT1v=spf1 include:spf.efwd.registrar-server
HTTPS1{"priority":1,"target":".","alpn":["h3",
SOA1brett.ns.cloudflare.com dns.cloudflare.c

Analysis

IP Addresses

wannacry.cc maps to four IP numbers: 2606:4700:3031::ac43:b47f, 2606:4700:3037::6815:53b7, 104.21.83.183 and 172.67.180.127.

Other host names such as americantechassociation.org, ceslc.net, cargoholidays.com, q345c.com.cn and macchiadolmo.com share IPs with wannacry.cc.

Name Servers

Two name servers brett.ns.cloudflare.com and luciana.ns.cloudflare.com handle the delegation for wannacry.cc.

wannacry.cc shares the same name server setup as other domains, for example mooreadvisors.com, letzholiday.com, kubet11.name, formulistasdeandalucia.es and sofakroken.net.

wannacry.cc at least partially shares name servers with other domains, for example indiasovenmontreal.ca, larslaj.com.ua, darodijihiaresources.digital, garasogaexresources.click and brindlelabsio.click.

these name servers are commonly used alongside sean.ns.cloudflare.com name servers.

Host names with six IP numbers:

brett.ns.cloudflare.com points to 2606:4700:58::adf5:3b4c, 2803:f800:50::6ca2:c14c, 2a06:98c1:50::ac40:214c, 108.162.193.76, 172.64.33.76 and 173.245.59.76.

luciana.ns.cloudflare.com points to 2606:4700:50::a29f:2683, 2803:f800:50::6ca2:c283, 2a06:98c1:50::ac40:2283, 108.162.194.131, 162.159.38.131 and 172.64.34.131.

Mail Servers

wannacry.cc is served by four mail servers: eforward2.registrar-servers.com, eforward3.registrar-servers.com, eforward4.registrar-servers.com and eforward5.registrar-servers.com.

wannacry.cc shares at least partially some mail servers with other domains, for instance clyr.io, wglxvkpybhnxhfv.com, luxuryopticalshop.com, creativestud.com and hellabites.com.

these mail servers are often used together with eforward1.registrar-servers.com, eforward6.registrar-servers.com and eforward7.registrar-servers.com.

Host names with a single IP:

eforward2.registrar-servers.com points to 162.255.118.52.

eforward3.registrar-servers.com points to 162.255.118.51.

eforward4.registrar-servers.com points to 162.255.118.52.

eforward5.registrar-servers.com points to 162.255.118.51.

Reverse mappings:

eforward2.registrar-servers.com and eforward4.registrar-servers.com point to 162.255.118.52.

eforward3.registrar-servers.com and eforward5.registrar-servers.com point to 162.255.118.51.