Stranger IP
Is a stranger answering for your hostname?
When you release a cloud IP but leave the DNS record pointing at it, the next tenant who rents that IP serves your name. We gather your hostnames from Certificate Transparency, resolve each one, and ask every IP which certificate it serves. We tag IPs in AWS, Google Cloud, Azure and Hetzner ranges, and flag CNAMEs that point at deleted S3 buckets, GitHub Pages sites, Heroku apps and other well-known takeover targets.
How to read this
Yours: the IP served a certificate that names this host.
Stranger: the IP answered, but its certificate names someone else (or nobody). If that IP is in a cloud range, check whether you still own it.
Silent: nothing answered TLS on port 443. That can be harmless (no HTTPS service) — we can't tell who holds the IP.
Dangling CNAME: the alias target resolves to nothing, or the provider answers with its “nothing here” page (an S3 NoSuchBucket error, a GitHub Pages 404). If the resource really is unclaimed, whoever registers it can serve your name. A takeover hint is a lead to confirm in your provider account, not proof.
Azure ranges come from Microsoft's published Service Tags (a bundled snapshot); Hetzner has no range file, so we use the prefixes its networks announce. Neither list is guaranteed complete, and an IP outside every list simply has no provider tag.
Background: Borgolte et al., “Cloud Strife” (NDSS 2018); Liu, Hao & Wang, “All Your DNS Records Point to Us” (CCS 2016).