Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
02392441005092021-04-07185.107.56.199Android
tierdomaincountregistrarname_serversorg
0tier_1ehacker.co1Dynadot LLCns2.commonmx.comNone
1tier_1foto-ramki.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
2tier_1focoonline.info1Dynadot, LLCNS1.COMMONMX.COMNone
3tier_1azulholisticspa.com1GoDaddy.com, LLCNS1.COMMONMX.COMDomains By Proxy, LLC
4tier_1coupeclub.cc1Zinc Domain Names LLCNS1.COMMONMX.COMNone
5tier_1bexinhs.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
6tier_1hao678.info1Dynadot, LLCNS1.COMMONMX.COMNone
7tier_1apknyot.info1Dynadot, LLCNS1.COMMONMX.COMNone
8tier_1camkiss.info1SiteName Ltd.NS1.COMMONMX.COMNone
9tier_1dinosriverwest.com1GoDaddy.com, LLCNS1.COMMONMX.COMDomains By Proxy, LLC
10tier_2btpnav.com1531API GmbHNS1.DNSIMPLE.COMRegistrant of btpnav.com
11tier_2rugab-ans.com140Amazon Registrar, Inc.NS-1165.AWSDNS-17.ORGWhois Privacy Service
12tier_2atnpx.com114GoDaddy.com, LLCBECKY.NS.CLOUDFLARE.COMDomains By Proxy, LLC
13tier_2click.expmediadirect.com19NAMECHEAP INCNS1.LINODE.COMPrivacy service provided by Withheld for Privacy ehf
14tier_2api.apptap.com18Amazon Registrar, Inc.NS-1256.AWSDNS-29.ORGWhois Privacy Service
15tier_2redirect.viglink.com18Amazon Registrar, Inc.NS1.VIGLINK.COMWhois Privacy Service
16tier_2link.sylikes.com18MarkMonitor, Inc.NS-1063.AWSDNS-04.ORGConnexity, Inc.
17tier_2api.mplayit.com16Amazon Registrar, Inc.NS-1236.AWSDNS-26.ORGWhois Privacy Service
18tier_2nizephoros-pom.com13Amazon Registrar, Inc.NS-1192.AWSDNS-21.ORGWhois Privacy Service
19tier_2get.popplunder.com13NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMPrivacy service provided by Withheld for Privacy ehf
20tier_2trustedpush.com13NAMECHEAP INCNS-1142.AWSDNS-14.ORGPrivacy service provided by Withheld for Privacy ehf
21tier_2ad.doubleclick.net13MarkMonitor, Inc.NS1.GOOGLE.COMGoogle Inc.
22tier_2win1.trustedpush.com12NoneNoneNone
23tier_2rd.bizrate.com9MarkMonitor, Inc.NS-1189.AWSDNS-20.ORGMeredith Corporation
24tier_2rd.connexity.net8NoneNoneNone
25tier_2win2.trustedpush.com7NoneNoneNone
26tier_2win3.trustedpush.com6NoneNoneNone
27tier_262881.click.validclick.net5Safenames LtdNS1.FULLMAILBOX.COMNone
28tier_2btpnative.com51API GmbHNS1.DNSIMPLE.COMRegistrant of btpnative.com
29tier_2infopicked.com5NoneNoneNone
30tier_3kbb.com72CSC CORPORATE DOMAINS, INC.PDNS164.ULTRADNS.BIZAutotrader.com
31tier_3robogarden.io42GoDaddy.com, LLCBECKY.NS.CLOUDFLARE.COMNone
32tier_3storystudio.sfgate.com22CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Communications, Inc.
33tier_3rd.bizrate.com9MarkMonitor, Inc.NS-1189.AWSDNS-20.ORGMeredith Corporation
34tier_3opticsplanet.com6GoDaddy.com, LLCNS1.ECENTRIA.COMECENTRIA IPH, LLC
35tier_3win2.trustedpush.com5NoneNoneNone
36tier_3win4.trustedpush.com3NAMECHEAP INCNS-1142.AWSDNS-14.ORGPrivacy service provided by Withheld for Privacy ehf
37tier_3win5.trustedpush.com3NoneNoneNone
38tier_3bing.com2MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
39tier_3beyourxfriend.com2GoDaddy.com, LLCNS0.DNSMADEEASY.COMNone
40tier_3win3.trustedpush.com1NoneNoneNone
41tier_3venus.com1GoDaddy.com, LLCNS0.DNSMADEEASY.COMVenus Fashion, Inc.
42tier_3goldstar.com1ENOM, INC.NS-102.AWSDNS-12.COMREDACTED FOR PRIVACY
43tier_3win1.trustedpush.com1NoneNoneNone
44tier_3go-x34n7wbcoes-ok.live1NoneNoneNone
45tier_3owletcare.com_LOOP_11NoneNoneNone
46tier_3wayfair.com_LOOP_11NoneNoneNone
47tier_3filter.onwardclick.com1NoneNoneNone
48tier_3a.dollarsurvey365.online1URL Solutions Inc.CRYSTAL.NS.CLOUDFLARE.COMNone
ipcityregionorgpostalcountry_nametiercountanycasthostname
0207.244.67.215WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_133nannan
1207.244.67.216WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_125nannan
2207.244.67.214WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_122nannan
3207.244.67.218WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_122nannan
4104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_117nannan
5104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_18nannan
6206.221.176.184NewarkNew JerseyAS23470 ReliableSite.Net LLC07175United Statestier_18nannan
7104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_17nannan
837.48.65.148AmsterdamNorth HollandAS60781 LeaseWeb Netherlands B.V.1012Netherlandstier_16nannan
9185.107.56.199RotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_14nannan
10209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_2159nannan
11104.26.10.53San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_264Truenan
12172.67.74.77San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_239Truenan
1318.235.67.128AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_238nanec2-18-235-67-128.compute-1.amazonaws.com
1452.72.29.7AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_233nanec2-52-72-29-7.compute-1.amazonaws.com
15192.138.218.207SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_39nanrd.bizrate.com
1634.207.43.7AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_224nanec2-34-207-43-7.compute-1.amazonaws.com
1752.206.108.38AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_223nanec2-52-206-108-38.compute-1.amazonaws.com
18204.44.79.214Los AngelesCaliforniaAS8100 QuadraNet Enterprises LLC90014United Statestier_222nan204.44.79.214.static.quadranet.com
1934.197.176.2AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_219nanec2-34-197-176-2.compute-1.amazonaws.com
20198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_219nannan
2199.84.114.98NewarkNew JerseyAS16509 Amazon.com, Inc.07175United Statestier_34nanserver-99-84-114-98.ewr52.r.cloudfront.net
2234.197.67.232AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_218nanec2-34-197-67-232.compute-1.amazonaws.com
2354.208.107.202AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_216nanec2-54-208-107-202.compute-1.amazonaws.com
2499.84.114.90NewarkNew JerseyAS16509 Amazon.com, Inc.07175United Statestier_31nanserver-99-84-114-90.ewr52.r.cloudfront.net
2534.199.180.187AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_213nanec2-34-199-180-187.compute-1.amazonaws.com
2634.225.128.119AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_211nanec2-34-225-128-119.compute-1.amazonaws.com
27104.26.11.53San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_211Truenan
2852.205.177.114AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_210nanec2-52-205-177-114.compute-1.amazonaws.com
29192.138.218.139SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_28nanrd.connexity.net
3023.44.217.143NewarkNew JerseyAS16625 Akamai Technologies, Inc.07175United Statestier_372nana23-44-217-143.deploy.static.akamaitechnologies.com
31104.21.80.8San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_329Truenan
3298.129.228.57DallasTexasAS33070 Rackspace Hosting75270United Statestier_322nannan
33172.67.172.143San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_313Truenan
34100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_310nanpool-100-37-135-2.nycmny.fios.verizon.net
35192.138.218.207SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_39nanrd.bizrate.com
36152.195.32.168AshburnVirginiaAS15133 MCI Communications Services, Inc. d/b/a Verizon Business20147United Statestier_36Truenan
3799.84.114.98NewarkNew JerseyAS16509 Amazon.com, Inc.07175United Statestier_34nanserver-99-84-114-98.ewr52.r.cloudfront.net
3813.107.21.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_32Truenan
3945.33.8.244RichardsonTexasAS63949 Linode, LLC75080United Statestier_32nanli962-244.members.linode.com
40184.85.12.70NewarkNew JerseyAS16625 Akamai Technologies, Inc.07175United Statestier_31nana184-85-12-70.deploy.static.akamaitechnologies.com
4199.84.114.90NewarkNew JerseyAS16509 Amazon.com, Inc.07175United Statestier_31nanserver-99-84-114-90.ewr52.r.cloudfront.net
4250.18.212.168San JoseCaliforniaAS16509 Amazon.com, Inc.95103United Statestier_31nanec2-50-18-212-168.us-west-1.compute.amazonaws.com
43172.67.214.202San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_31Truenan
44173.239.53.32New York CityNew YorkAS27257 Webair Internet Development Company Inc.10004United Statestier_31nannan
45104.26.14.226San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_31Truenan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website