`thenormhotels.com`

DNSSEC	⚠️ Not signed
A	2606:4700:20::681a:e9c^{🇺🇸 Cloudflare2606:4700:20::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	2606:4700:20::681a:f9c^{🇺🇸 Cloudflare2606:4700:20::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	2606:4700:20::ac43:48c1^{🇺🇸 Cloudflare2606:4700:20::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	104.26.14.156^{Cloudflare104.26.0.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	104.26.15.156^{Cloudflare104.26.0.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	172.67.72.193^{🇺🇸 Cloudflare172.67.64.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
NS	`elliot.ns.cloudflare.com` ⭐
		A	2606:4700:58::adf5:3ba2^{🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`elliot.ns.cloudflare.com`
		A	2803:f800:50::6ca2:c1a2^{🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L}
			PTR	`elliot.ns.cloudflare.com`
		A	2a06:98c1:50::ac40:21a2^{🇺🇸 Cloudflare2a06:98c1:50::/45}
			PTR	`elliot.ns.cloudflare.com`
		A	108.162.193.162^{🇺🇸 Cloudflare108.162.193.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`elliot.ns.cloudflare.com`
		A	172.64.33.162^{🇺🇸 Cloudflare172.64.33.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`elliot.ns.cloudflare.com`
		A	173.245.59.162^{🇺🇸 Cloudflare173.245.59.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`elliot.ns.cloudflare.com`
NS	`rihana.ns.cloudflare.com`
		A	2606:4700:50::adf5:3af4^{🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`rihana.ns.cloudflare.com`
		A	2803:f800:50::6ca2:c0f4^{🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L}
			PTR	`rihana.ns.cloudflare.com`
		A	2a06:98c1:50::ac40:20f4^{🇺🇸 Cloudflare2a06:98c1:50::/45}
			PTR	`rihana.ns.cloudflare.com`
		A	108.162.192.244^{🇺🇸 Cloudflare108.162.192.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`rihana.ns.cloudflare.com`
		A	172.64.32.244^{🇺🇸 Cloudflare172.64.32.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`rihana.ns.cloudflare.com`
		A	173.245.58.244^{🇺🇸 Cloudflare173.245.58.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`rihana.ns.cloudflare.com`
MX	`anextour.in.tmes.trendmicro.eu` ⭐
		A	18.185.115.145^{🇩🇪 Amazon18.184.0.0/15 EC2 FRA prefix}
			PTR	`in.tmes.trendmicro.eu`
		A	18.185.115.146^{🇩🇪 Amazon18.184.0.0/15 EC2 FRA prefix}
			PTR	`in.tmes.trendmicro.eu`
		A	18.185.115.147^{🇩🇪 Amazon18.184.0.0/15 EC2 FRA prefix}
			PTR	`in.tmes.trendmicro.eu`
TXT	`MS=ms41654542`
TXT	`tmes=73b15b1e431f0a94fed41464ebd9a5fb`
TXT	`v=spf1 include:spf.protection.outlook.com include:spf-eu.emailsignatures365.c...`
HTTPS	HTTP/3, HTTP/2 ✓ hints match
		IPv4 hints	104.26.14.156, 104.26.15.156, 172.67.72.193
		IPv6 hints	2606:4700:20::681a:e9c, 2606:4700:20::681a:f9c, 2606:4700:20::ac43:48c1
		ECH	X25519, HKDF-SHA256 + AES-128-GCM draft, id=114, name=cloudflare-ech.com
SOA	`elliot.ns.cloudflare.com`dns@cloudflare.com serial=2399706122

`com`

	DNSSEC	🔒 Signed (DS record present)
	NS	`a.gtld-servers.net` ⭐
	NS	`b.gtld-servers.net`
	NS	`c.gtld-servers.net`
	NS	`d.gtld-servers.net`
	NS	`e.gtld-servers.net`
	NS	`f.gtld-servers.net`
	NS	`g.gtld-servers.net`
	NS	`h.gtld-servers.net`
	NS	`i.gtld-servers.net`
	NS	`j.gtld-servers.net`
	NS	`k.gtld-servers.net`
	NS	`l.gtld-servers.net`
	NS	`m.gtld-servers.net`
	SOA	`a.gtld-servers.net`nstld@verisign-grs.com serial=1778377041

Subdomains

www.thenormhotels.com

Same first word

thenormhotels.com

DNS History

9 records (9 active, 0 former)

●NSelliot.ns.cloudflare.com2026-03-29 → 2026-05-10 · 2 obs

● 2026-03-29 09:46:54
● 2026-05-10 02:07:06

●NSrihana.ns.cloudflare.com2026-03-29 → 2026-05-10 · 2 obs

● 2026-03-29 09:46:54
● 2026-05-10 02:07:06

●MXanextour.in.tmes.trendmicro.eu2026-03-29 → 2026-05-10 · 2 obs

● 2026-03-29 09:46:54
● 2026-05-10 02:07:06

●A104.26.14.1562026-03-29 → 2026-05-10 · 2 obs

● 2026-03-29 09:46:54
● 2026-05-10 02:07:06

●A104.26.15.1562026-03-29 → 2026-05-10 · 2 obs

● 2026-03-29 09:46:54
● 2026-05-10 02:07:06

●A172.67.72.1932026-03-29 → 2026-05-10 · 2 obs

● 2026-03-29 09:46:54
● 2026-05-10 02:07:06

●A2606:4700:20::681a:e9c2026-03-29 → 2026-05-10 · 2 obs

● 2026-03-29 09:46:54
● 2026-05-10 02:07:06

●A2606:4700:20::681a:f9c2026-03-29 → 2026-05-10 · 2 obs

● 2026-03-29 09:46:54
● 2026-05-10 02:07:06

●A2606:4700:20::ac43:48c12026-03-29 → 2026-05-10 · 2 obs

● 2026-03-29 09:46:54
● 2026-05-10 02:07:06

🔍 DNS Trace

📋 Delegation Chain

Zone	Nameservers	Glue
com	a.gtld-servers.net, b.gtld-servers.net, c.gtld-servers.net, d.gtld-servers.net...	-
thenormhotels.com	elliot.ns.cloudflare.com, rihana.ns.cloudflare.com	12 records

✅ Authoritative Response

Server:108.162.193.162

NS records: elliot.ns.cloudflare.com, rihana.ns.cloudflare.com

🔒 DNSSEC Status

⚠️ Insecure (no DNSSEC)

No DS record for thenormhotels.com (unsigned zone)

⏱️ Timing

Total: 130ms | Queries: -

📄 Records

Type	Count	Sample Data
A	3	`104.26.14.156, 104.26.15.156...`
AAAA	3	`2606:4700:20::ac43:48c1, 2606:4700:20::681a:e9c...`
NS	2	`elliot.ns.cloudflare.com, rihana.ns.cloudflare.com`
MX	1	`anextour.in.tmes.trendmicro.eu (pri: 0)`
TXT	3	`MS=ms41654542, tmes=73b15b1e431f0a94fed41464ebd9a5fb...`
HTTPS	1	`{"priority":1,"target":".","alpn":["h3",`
SOA	1	`elliot.ns.cloudflare.com dns.cloudflare.`

📌 Glue Records Collected

Total: 12

Out-of-bailiwick: 12 (elliot.ns.cloudflare.com, elliot.ns.cloudflare.com, elliot.ns.cloudflare.com...)

Analysis

Hierarchy

The parent of www.thenormhotels.com is thenormhotels.com.

IP Addresses

thenormhotels.com maps to six IP numbers: 2606:4700:20::681a:e9c, 2606:4700:20::681a:f9c, 2606:4700:20::ac43:48c1, 104.26.14.156, 104.26.15.156 and 172.67.72.193.

Other host names such as www.drdchati.com, thatek.com, netu.com.cy, basant-club.com and payfacile.com share IPs with thenormhotels.com.

Name Servers

Two name servers elliot.ns.cloudflare.com and rihana.ns.cloudflare.com handle the delegation for thenormhotels.com.

thenormhotels.com shares the same name server setup as other domains, for example anextour.lt, anextour.lv, aviaturizm.com, lightingandsigns.co.uk and seoeffekt.de.

thenormhotels.com at least partially shares name servers with other domains, for example selvarionqyx.sbs, silicondrinkabout.com, katalun.co.il, wndch.com and caura-acaru.ca.

These name servers are often used together with magnolia.ns.cloudflare.com and harley.ns.cloudflare.com.

Host names with six IP numbers:

elliot.ns.cloudflare.com points to 2606:4700:58::adf5:3ba2, 2803:f800:50::6ca2:c1a2, 2a06:98c1:50::ac40:21a2, 108.162.193.162, 172.64.33.162 and 173.245.59.162.

rihana.ns.cloudflare.com points to 2606:4700:50::adf5:3af4, 2803:f800:50::6ca2:c0f4, 2a06:98c1:50::ac40:20f4, 108.162.192.244, 172.64.32.244 and 173.245.58.244.

Mail Servers

The anextour.in.tmes.trendmicro.eu mail server handles thenormhotels.com.

thenormhotels.com shares the same mail server setup as other domains, including anexapps.com, xclusivetravel.com, azurair.ua, utopiaworld.com.tr and anextour.de.

thenormhotels.com shares at least partially some mail servers with other domains, for instance skylineexpress.aero, neckermanntravel.co.uk, anextour.ru, a-energy.com.tr and anextour.co.uk.

these mail servers are commonly used with skylineexpress-aero.mail.protection.outlook.com.

Host name anextour.in.tmes.trendmicro.eu resolves to three IP numbers: 18.185.115.145, 18.185.115.146 and 18.185.115.147.

thenormhotels.com - robtex.com