Unsure if this has been posted already (I didn't see it) but I was looking at the new dropkiwifarms.net site, specifically where its mailservers are hosted as unlike most traffic on a site reverse proxied through Cloudflare mailservers tend to not have the same treatment. Indeed this is the case here, and its host is quite interesting:
Code:
$ drill MX dropkiwifarms.net
;; QUESTION SECTION:
;; dropkiwifarms.net. IN MX
;; ANSWER SECTION:
dropkiwifarms.net. 300 IN MX 0 _dc-mx.bba238412bf2.dropkiwifarms.net.
;; AUTHORITY SECTION:
dropkiwifarms.net. 172008 IN NS armfazh.ns.cloudflare.com.
dropkiwifarms.net. 172008 IN NS kate.ns.cloudflare.com.
That mail subdomain then points here:
Code:
$ drill _dc-mx.bba238412bf2.dropkiwifarms.net.
;; QUESTION SECTION:
;; _dc-mx.bba238412bf2.dropkiwifarms.net. IN A
;; ANSWER SECTION:
_dc-mx.bba238412bf2.dropkiwifarms.net. 300 IN A 70.40.223.175
;; AUTHORITY SECTION:
dropkiwifarms.net. 172784 IN NS armfazh.ns.cloudflare.com.
dropkiwifarms.net. 172784 IN NS kate.ns.cloudflare.com.
70.40.223.175 is an interesting one, hosted by Unified Layer (AS46606), but more interestingly if you actually send a HTTP request to that IP you get this:
Code:
$ curl 70.40.223.175
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://wiki.vaush.gg/">here</a>.</p>
</body></html>
By that it seems they are hosting this on one of Vaush's servers? Not sure why else a redirect like that would be in place.