`saythat.sh`

DNSSEC	🔒 Signed (DS record present)
A	2606:4700:3033::6815:169f^{🇺🇸 Cloudflare2606:4700:3033::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	2606:4700:3033::ac43:cd83^{🇺🇸 Cloudflare2606:4700:3033::/48 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	104.21.22.159^{Cloudflare104.21.16.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
A	172.67.205.131^{🇺🇸 Cloudflare172.67.192.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US} ✓ In HTTPS hints
NS	`cory.ns.cloudflare.com` ⭐
		A	2606:4700:58::adf5:3b5d^{🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`cory.ns.cloudflare.com`
		A	2803:f800:50::6ca2:c15d^{🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L}
			PTR	`cory.ns.cloudflare.com`
		A	2a06:98c1:50::ac40:215d^{🇺🇸 Cloudflare2a06:98c1:50::/45}
			PTR	`cory.ns.cloudflare.com`
		A	108.162.193.93^{🇺🇸 Cloudflare108.162.193.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`cory.ns.cloudflare.com`
		A	172.64.33.93^{🇺🇸 Cloudflare172.64.33.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`cory.ns.cloudflare.com`
		A	173.245.59.93^{🇺🇸 Cloudflare173.245.59.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`cory.ns.cloudflare.com`
NS	`gigi.ns.cloudflare.com`
		A	2606:4700:50::a29f:260c^{🇺🇸 Cloudflare2606:4700:50::/44 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`gigi.ns.cloudflare.com`
		A	2803:f800:50::6ca2:c20c^{🇨🇷 Cloudflare2803:f800:50::/45 LACNIC generated route6 for CloudFlare Latin America S.R.L}
			PTR	`gigi.ns.cloudflare.com`
		A	2a06:98c1:50::ac40:220c^{🇺🇸 Cloudflare2a06:98c1:50::/45}
			PTR	`gigi.ns.cloudflare.com`
		A	108.162.194.12^{🇺🇸 Cloudflare108.162.194.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`gigi.ns.cloudflare.com`
		A	162.159.38.12^{Cloudflare162.159.32.0/20 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`gigi.ns.cloudflare.com`
		A	172.64.34.12^{🇺🇸 Cloudflare172.64.34.0/24 , Inc. 101 Townsend Street, San Francisco, California 94107, US}
			PTR	`gigi.ns.cloudflare.com`
MX	`mail.protonmail.ch` ⭐
		A	176.119.200.128^{🇨🇭 Proton176.119.200.0/24}
			PTR	`mail.protonmail.ch`
		A	185.70.42.128^{🇨🇭 Proton185.70.42.0/24}
			PTR	`mail.protonmail.ch`
		A	185.205.70.128^{🇫🇷 Proton185.205.70.0/24}
			PTR	`mail.protonmail.ch`
MX	`mailsec.protonmail.ch`⁽²⁰⁾
		A	176.119.200.129^{🇨🇭 Proton176.119.200.0/24}
			PTR	`mailsec.protonmail.ch`
		A	185.70.42.129^{🇨🇭 Proton185.70.42.0/24}
			PTR	`mailsec.protonmail.ch`
		A	185.205.70.129^{🇫🇷 Proton185.205.70.0/24}
			PTR	`mailsec.protonmail.ch`
TXT	`google-site-verification=REWcLri88vyAe_oIbAvckrZ5J6bJMYwKtlKGGLzhap0`
TXT	`protonmail-verification=2fd0b96ceef7180e1481ed0e5628cd4078fd3dbf`
TXT	`v=spf1 include:_spf.protonmail.ch ~all`
HTTPS	HTTP/3, HTTP/2 ✓ hints match
		IPv4 hints	104.21.22.159, 172.67.205.131
		IPv6 hints	2606:4700:3033::6815:169f, 2606:4700:3033::ac43:cd83
		ECH	X25519, HKDF-SHA256 + AES-128-GCM draft, id=169, name=cloudflare-ech.com
SOA	`cory.ns.cloudflare.com`dns@cloudflare.com serial=2403639780

`sh`

	DNSSEC	🔒 Signed (DS record present)
	NS	`a0.nic.sh` ⭐
	NS	`a2.nic.sh`
	NS	`b0.nic.sh`
	NS	`c0.nic.sh`
	SOA	`a0.nic.sh`hostmaster@donuts.email serial=1778635775

🔒 HSTS Preload (+subdomains)

Same first word

saythat.sh

Similar names

ahtasty.com

DNS History

8 records (8 active, 0 former)

●NScory.ns.cloudflare.com2026-05-07 → 2026-05-13 · 2 obs

● 2026-05-07 19:59:44
● 2026-05-13 02:11:48

●NSgigi.ns.cloudflare.com2026-05-07 → 2026-05-13 · 2 obs

● 2026-05-07 19:59:44
● 2026-05-13 02:11:48

●MXmail.protonmail.ch2026-05-07 → 2026-05-13 · 2 obs

● 2026-05-07 19:59:44
● 2026-05-13 02:11:48

●MXmailsec.protonmail.ch2026-05-07 → 2026-05-13 · 2 obs

● 2026-05-07 19:59:44
● 2026-05-13 02:11:48

●A104.21.22.1592026-05-07 → 2026-05-13 · 2 obs

● 2026-05-07 19:59:44
● 2026-05-13 02:11:48

●A172.67.205.1312026-05-07 → 2026-05-13 · 2 obs

● 2026-05-07 19:59:44
● 2026-05-13 02:11:48

●A2606:4700:3033::6815:169f2026-05-07 → 2026-05-13 · 2 obs

● 2026-05-07 19:59:44
● 2026-05-13 02:11:48

●A2606:4700:3033::ac43:cd832026-05-07 → 2026-05-13 · 2 obs

● 2026-05-07 19:59:44
● 2026-05-13 02:11:48

🔍 DNS Trace

📋 Delegation Chain

Zone	Nameservers	Glue
sh	a0.nic.sh, a2.nic.sh, b0.nic.sh, c0.nic.sh	8 records
saythat.sh	gigi.ns.cloudflare.com, cory.ns.cloudflare.com	-

✅ Authoritative Response

Server:172.64.33.93

NS records: gigi.ns.cloudflare.com, cory.ns.cloudflare.com

🔒 DNSSEC Status

🔐 Secure (DNSSEC validated)

Chain of trust verified from root to domain

⏱️ Timing

Total: 817ms | Queries: -

📄 Records

Type	Count	Sample Data
A	2	`104.21.22.159, 172.67.205.131`
AAAA	2	`2606:4700:3033::ac43:cd83, 2606:4700:3033::6815:169f`
NS	2	`cory.ns.cloudflare.com, gigi.ns.cloudflare.com`
MX	2	`mail.protonmail.ch (pri: 10), mailsec.protonmail.ch (pri: 20)`
TXT	3	`google-site-verification=REWcLri88vyAe_o, protonmail-verification=2fd0b96ceef7180e...`
HTTPS	1	`{"priority":1,"target":".","alpn":["h3",`
SOA	1	`cory.ns.cloudflare.com dns.cloudflare.co`

📌 Glue Records Collected

Total: 8

In-bailiwick: 8 (a0.nic.sh, a2.nic.sh, b0.nic.sh...)

Analysis

IP Addresses

saythat.sh points to four IP numbers: 2606:4700:3033::6815:169f, 2606:4700:3033::ac43:cd83, 104.21.22.159 and 172.67.205.131.

Other host names, for instance ru.soltop.ru, www.026qq.com, jinqiu111.com, hydroidchemical.com and ptspae.com share IP numbers with saythat.sh.

Name Servers

saythat.sh is delegated to two name servers: cory.ns.cloudflare.com and gigi.ns.cloudflare.com.

saythat.sh uses the same name server setup as other domains, for instance aikido-argentina.com.ar, g4yimages.workers.dev, privdna.com, gz-la.com and genomeprivate.com.

saythat.sh shares name servers with other domains at least partially, for instance csc-scs.com, udcorp.co.zw, bfmold.com, crossroadstech.net and casibo.net.

Host names with six IP numbers: cory.ns.cloudflare.com points to 2606:4700:58::adf5:3b5d, 2803:f800:50::6ca2:c15d, 2a06:98c1:50::ac40:215d, 108.162.193.93, 172.64.33.93 and 173.245.59.93; gigi.ns.cloudflare.com points to 2606:4700:50::a29f:260c, 2803:f800:50::6ca2:c20c, 2a06:98c1:50::ac40:220c, 108.162.194.12, 162.159.38.12 and 172.64.34.12.

Mail Servers

saythat.sh is handled by two mail servers: mail.protonmail.ch and mailsec.protonmail.ch.

saythat.sh shares the same mail server setup as other domains, including stopkillinggames.com, otioti.com, citrusspringscongregational.org, blackforestcode.com and thehuliligroup.com.

saythat.sh shares some mail servers with other domains, including zeandrade.com.br, kiyo.ooo, cinemaple.com, mathisen.io and rabidcatsystems.com.

These mail servers are often used with the mail servers alt4.aspmx.l.google.com.

Host names with three IP numbers: mail.protonmail.ch points to 176.119.200.128, 185.70.42.128 and 185.205.70.128; mailsec.protonmail.ch points to 176.119.200.129, 185.70.42.129 and 185.205.70.129.

saythat.sh - robtex.com

saythat.sh

sh

Same first word

Similar names

DNS History

🔍 DNS Trace

📋 Delegation Chain

✅ Authoritative Response

🔒 DNSSEC Status

⏱️ Timing

📄 Records

📌 Glue Records Collected

Analysis

IP Addresses

Name Servers

Mail Servers

`saythat.sh`

`sh`