`fraudtoday.io`

DNSSEC	⚠️ Not signed
A	2606:4700:3033::ac43:b80f^{🇺🇸 Cloudflare2606:4700:3033::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	2606:4700:3035::6815:4bf8^{🇺🇸 Cloudflare2606:4700:3035::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	104.21.75.248^{Cloudflare104.21.64.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	172.67.184.15^{🇺🇸 Cloudflare172.67.176.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
NS	`clay.ns.cloudflare.com` ⭐
		A	2606:4700:58::adf5:3b58^{🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`clay.ns.cloudflare.com`
		A	2803:f800:50::6ca2:c158^{🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L}
			PTR	`clay.ns.cloudflare.com`
		A	2a06:98c1:50::ac40:2158^{🇺🇸 Cloudflare2a06:98c1:50::/45}
			PTR	`clay.ns.cloudflare.com`
		A	108.162.193.88^{🇺🇸 Cloudflare108.162.193.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`clay.ns.cloudflare.com`
		A	172.64.33.88^{🇺🇸 Cloudflare172.64.33.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`clay.ns.cloudflare.com`
		A	173.245.59.88^{🇺🇸 Cloudflare173.245.59.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`clay.ns.cloudflare.com`
NS	`hazel.ns.cloudflare.com`
		A	2606:4700:50::a29f:269d^{🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`hazel.ns.cloudflare.com`
		A	2803:f800:50::6ca2:c29d^{🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L}
			PTR	`hazel.ns.cloudflare.com`
		A	2a06:98c1:50::ac40:229d^{🇺🇸 Cloudflare2a06:98c1:50::/45}
			PTR	`hazel.ns.cloudflare.com`
		A	108.162.194.157^{🇺🇸 Cloudflare108.162.194.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`hazel.ns.cloudflare.com`
		A	162.159.38.157^{Cloudflare162.159.32.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`hazel.ns.cloudflare.com`
		A	172.64.34.157^{🇺🇸 Cloudflare172.64.34.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`hazel.ns.cloudflare.com`
MX	`mx1.emailsrvr.com` ⭐
		A	146.20.161.1^{🇺🇸 RACKSPACE-IAD146.20.0.0/16 Rackspace US Inc}
			PTR	`mx1.emailsrvr.com`
MX	`mx2.emailsrvr.com`⁽²⁰⁾
		A	108.166.43.2^{🇺🇸 RACKSPACE-ORD108.166.0.0/18 Rackspace}
			PTR	`mx2.emailsrvr.com`
TXT	`google-site-verification=0Ujg7Ds_uBmkTdaNhf5_ss7iG9EGL7SsE_5GIF9Q9rk`
TXT	`v=spf1 include:emailsrvr.com include:mktomail.com -all`
HTTPS	HTTP/3, HTTP/2 ✓ hints match
		IPv4 hints	104.21.75.248, 172.67.184.15
		IPv6 hints	2606:4700:3033::ac43:b80f, 2606:4700:3035::6815:4bf8
		ECH	X25519, HKDF-SHA256 + AES-128-GCM draft, id=172, name=cloudflare-ech.com
SOA	`clay.ns.cloudflare.com`dns@cloudflare.com serial=2408039757

`io`

	DNSSEC	🔒 Signed (DS record present)
	NS	`a0.nic.io` ⭐
	NS	`a2.nic.io`
	NS	`b0.nic.io`
	NS	`c0.nic.io`
	SOA	`a0.nic.io`hostmaster@donuts.email serial=1784465119

Same first word

fraudtoday.io

DNS History

14 records (8 active, 6 former)

●NSclay.ns.cloudflare.com2026-07-17 → 2026-07-19 · 3 obs

○ 2026-05-22 09:27:48
● 2026-07-17 22:01:54
● 2026-07-19 13:40:24

●NShazel.ns.cloudflare.com2026-07-17 → 2026-07-19 · 3 obs

○ 2026-05-22 09:27:48
● 2026-07-17 22:01:54
● 2026-07-19 13:40:24

○NSns69.domaincontrol.com2026-02-28 → 2026-05-22 · 4 obs

● 2026-02-28 22:21:30
● 2026-05-22 09:27:48
○ 2026-07-17 22:01:54
○ 2026-07-19 13:40:24

○NSns70.domaincontrol.com2026-02-28 → 2026-05-22 · 4 obs

● 2026-02-28 22:21:30
● 2026-05-22 09:27:48
○ 2026-07-17 22:01:54
○ 2026-07-19 13:40:24

●MXmx1.emailsrvr.com2026-02-28 → 2026-07-19 · 2 obs

● 2026-02-28 22:21:30
● 2026-07-19 13:40:24

●MXmx2.emailsrvr.com2026-02-28 → 2026-07-19 · 2 obs

● 2026-02-28 22:21:30
● 2026-07-19 13:40:24

●A104.21.75.2482026-07-17 → 2026-07-19 · 3 obs

○ 2026-05-22 09:27:48
● 2026-07-17 22:01:54
● 2026-07-19 13:40:24

○A162.159.140.1642026-02-28 → 2026-05-22 · 4 obs

● 2026-02-28 22:21:30
● 2026-05-22 09:27:48
○ 2026-07-17 22:01:54
○ 2026-07-19 13:40:24

○A172.66.0.1622026-02-28 → 2026-05-22 · 4 obs

● 2026-02-28 22:21:30
● 2026-05-22 09:27:48
○ 2026-07-17 22:01:54
○ 2026-07-19 13:40:24

●A172.67.184.152026-07-17 → 2026-07-19 · 3 obs

○ 2026-05-22 09:27:48
● 2026-07-17 22:01:54
● 2026-07-19 13:40:24

●A2606:4700:3033::ac43:b80f2026-07-17 → 2026-07-19 · 3 obs

○ 2026-05-22 09:27:48
● 2026-07-17 22:01:54
● 2026-07-19 13:40:24

●A2606:4700:3035::6815:4bf82026-07-17 → 2026-07-19 · 3 obs

○ 2026-05-22 09:27:48
● 2026-07-17 22:01:54
● 2026-07-19 13:40:24

○A2606:4700:7::a22026-02-28 → 2026-05-22 · 4 obs

● 2026-02-28 22:21:30
● 2026-05-22 09:27:48
○ 2026-07-17 22:01:54
○ 2026-07-19 13:40:24

○A2a06:98c1:58::a22026-02-28 → 2026-05-22 · 4 obs

● 2026-02-28 22:21:30
● 2026-05-22 09:27:48
○ 2026-07-17 22:01:54
○ 2026-07-19 13:40:24

🔍 DNS Trace

📋 Delegation Chain

Zone	Nameservers	Glue
io	c0.nic.io, b0.nic.io, a0.nic.io, a2.nic.io	-
fraudtoday.io	hazel.ns.cloudflare.com, clay.ns.cloudflare.com	-

✅ Authoritative Response

Server:172.64.34.157

NS records: hazel.ns.cloudflare.com, clay.ns.cloudflare.com

🔒 DNSSEC Status

⚠️ Insecure (no DNSSEC)

No DS record for fraudtoday.io (unsigned zone)

⏱️ Timing

Total: 588ms | Queries: -

📄 Records

Type	Count	Sample Data
A	2	`172.67.184.15, 104.21.75.248`
AAAA	2	`2606:4700:3033::ac43:b80f, 2606:4700:3035::6815:4bf8`
NS	2	`clay.ns.cloudflare.com, hazel.ns.cloudflare.com`
MX	2	`mx1.emailsrvr.com (pri: 10), mx2.emailsrvr.com (pri: 20)`
TXT	2	`google-site-verification=0Ujg7Ds_uBmkTda, v=spf1 include:emailsrvr.com include:mkt`
HTTPS	1	`{"priority":1,"target":".","alpn":["h3",`
SOA	1	`clay.ns.cloudflare.com dns.cloudflare.co`

Analysis

IP Addresses

fraudtoday.io points to the four IP addresses 104.21.75.248, 172.67.184.15, 2606:4700:3033::ac43:b80f and 2606:4700:3035::6815:4bf8.

bfc.vegas, rkands.com, downagram.com and two other host names share IP numbers with fraudtoday.io.

Name Servers

fraudtoday.io is served by two delegated name servers, clay.ns.cloudflare.com and hazel.ns.cloudflare.com.

fraudtoday.io uses the same name servers as several other domains — among them databreachtoday.com, databreachtoday.in, bankinfosecurity.com and two more.

At least some of fraudtoday.io's name servers are shared with other domains, for example mcgeeslandingtx.com, gulata.com, jsm.com.pk and two more.

These name servers are often deployed together with the name servers ulla.ns.cloudflare.com, evangeline.ns.cloudflare.com, rodrigo.ns.cloudflare.com and dakota.ns.cloudflare.com.

Hostnames that resolve to 6 IP addresses:

clay.ns.cloudflare.com carries IP addresses 108.162.193.88, 172.64.33.88 and 173.245.59.88, with 3 other addresses beyond those.

hazel.ns.cloudflare.com carries IP addresses 108.162.194.157, 162.159.38.157 and 172.64.34.157, with 3 other addresses beyond those.

Mail Servers

Mail for fraudtoday.io is handled by two mail servers — mx1.emailsrvr.com and mx2.emailsrvr.com.

fraudtoday.io uses an identical mail server configuration to several other domains — among them theherbsource.com, orocosmetics.info, xtremeracewaypark.com and two more.

At least a portion of fraudtoday.io's mail servers are shared with other domains, among them customcool.com and client-216-57-220-209.bhm.pogozone.net.

Each of mx1.emailsrvr.com and mx2.emailsrvr.com has one IP address: mx1.emailsrvr.com uses 146.20.161.1 and mx2.emailsrvr.com uses 108.166.43.2.

fraudtoday.io - robtex.com

fraudtoday.io

io

Same first word

DNS History

🔍 DNS Trace

📋 Delegation Chain

✅ Authoritative Response

🔒 DNSSEC Status

⏱️ Timing

📄 Records

Analysis

IP Addresses

Name Servers

Mail Servers

`fraudtoday.io`

`io`