Malware Discoverer Github Homepage.

Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
0212040002021-04-16185.53.177.73Android
tierdomaincountregistrarname_serversorg
0tier_1aevangelism.org1GoDaddy.com, LLCNS1.PARKINGCREW.NETNone
1tier_1elitetrader.org11API GmbHNS1.PARKINGCREW.NET['adaspect media UG haftungsbeschraenkt', 'REDACTED FOR PRIVACY']
2tier_1420rx.org1GoDaddy.com, LLCNS1.PARKINGCREW.NETCTI Holdings Inc.
3tier_1canadatrips.org1Epik Inc.NS1.PARKINGCREW.NETHunley Media Group LLC
4tier_1cellphones.org1Moniker Online Services LLCNS1.FASTPARK.NETMoniker Privacy Services
5tier_1beingme.org1Domain.com, LLCNS1.PARKINGCREW.NET['Glocal Commerce Limited', 'REDACTED FOR PRIVACY']
6tier_1booking-flights.org1INWX GmbH & Co. KGNS1.PARKINGCREW.NET-
7tier_1bihar.org1Dynadot, LLCNS1.PARKINGCREW.NETNone
8tier_2katie.v4.omgtnc.com8PSI-USA, Inc. dba Domain RobotNS-1133.AWSDNS-13.ORGNone
9tier_2aristo-hag.com3Amazon Registrar, Inc.NS-1226.AWSDNS-25.ORGWhois Privacy Service
10tier_2noclick.connexity.com3MarkMonitor, Inc.NS-1235.AWSDNS-26.ORGConnexity, Inc.
11tier_2rd.bizrate.com3NoneNoneNone
12tier_2rd.connexity.net3NoneNoneNone
13tier_2bridge.lga1.ap01.net1NoneNoneNone
14tier_2298126900.lga1.ampverified.com1NoneNoneNone
15tier_2clixtrac.com1NAMECHEAP INCNS1.CLIXTRAC.COMWhoisGuard, Inc.
16tier_2secure.adnxs.com1MarkMonitor, Inc.NS1.GSLB.COMAppNexus Inc
17tier_3ram21.proasdf.com3GoDaddy.com, LLCNS61.DOMAINCONTROL.COMDomains By Proxy, LLC
18tier_3wayfair.com3MarkMonitor, Inc.A1-100.AKAM.NETWayfair, LLC
19tier_3rpa21.proasdf.com1GoDaddy.com, LLCNS61.DOMAINCONTROL.COMDomains By Proxy, LLC
20tier_3visitmusiccity.com1GoDaddy.com, LLCNS-1504.AWSDNS-60.ORGNashville Convention & Visitors Corp.
ipcityregionorgpostalcountry_nametiercounthostname
0104.247.81.73WyandotteMichiganAS206834 Team Internet AG48192United Statestier_18nan
152.45.77.217AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_26ec2-52-45-77-217.compute-1.amazonaws.com
2192.138.218.215SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_23noclick.connexity.com
3192.138.218.207SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_23rd.bizrate.com
4192.138.218.139SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_23rd.connexity.net
554.208.107.202AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_22ec2-54-208-107-202.compute-1.amazonaws.com
6104.218.72.13New York CityNew YorkAS63190 adMarketplace, Inc.10016United Statestier_22nan
73.220.46.255AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_21ec2-3-220-46-255.compute-1.amazonaws.com
852.22.6.66AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_21ec2-52-22-6-66.compute-1.amazonaws.com
918.235.67.128AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_21ec2-18-235-67-128.compute-1.amazonaws.com
10208.100.38.218ChicagoIllinoisAS32748 Steadfast60607United Statestier_21clixtrac.com
1168.67.160.74New York CityNew YorkAS29990 AppNexus, Inc10004United Statestier_21671.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
12162.243.10.151New York CityNew YorkAS14061 DigitalOcean, LLC10011United Statestier_34nan
1323.39.32.237NewarkNew JerseyAS16625 Akamai Technologies, Inc.07175United Statestier_33a23-39-32-237.deploy.static.akamaitechnologies.com
1454.164.213.169AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_31ec2-54-164-213-169.compute-1.amazonaws.com

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website