Malware Discoverer Github Homepage.

Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
0252443012021-04-16185.53.177.73Chrome
tierdomaincountregistrarname_serversorg
0tier_1aevangelism.org1GoDaddy.com, LLCNS1.PARKINGCREW.NETNone
1tier_1elitetrader.org11API GmbHNS1.PARKINGCREW.NET['adaspect media UG haftungsbeschraenkt', 'REDACTED FOR PRIVACY']
2tier_1420rx.org1GoDaddy.com, LLCNS1.PARKINGCREW.NETCTI Holdings Inc.
3tier_1canadatrips.org1Epik Inc.NS1.PARKINGCREW.NETHunley Media Group LLC
4tier_1cellphones.org1Moniker Online Services LLCNS1.FASTPARK.NETMoniker Privacy Services
5tier_1beingme.org1Domain.com, LLCNS1.PARKINGCREW.NET['Glocal Commerce Limited', 'REDACTED FOR PRIVACY']
6tier_1booking-flights.org1INWX GmbH & Co. KGNS1.PARKINGCREW.NET-
7tier_1bihar.org1Dynadot, LLCNS1.PARKINGCREW.NETNone
8tier_2katie.v4.omgtnc.com8PSI-USA, Inc. dba Domain RobotNS-1133.AWSDNS-13.ORGNone
9tier_2aristo-hag.com4Amazon Registrar, Inc.NS-1226.AWSDNS-25.ORGWhois Privacy Service
10tier_2noclick.connexity.com3MarkMonitor, Inc.NS-1235.AWSDNS-26.ORGConnexity, Inc.
11tier_2rd.bizrate.com3MarkMonitor Inc.NS-1189.AWSDNS-20.ORGNone
12tier_2rd.connexity.net3NoneNoneNone
13tier_2recode.pw1GANDI SASNS-1611.AWSDNS-09.CO.UKPPCBUZZ
14tier_2158635592.pub.ezanga.com1GoDaddy.com, LLCNS1.SOFTLAYER.COMeZanga.com, Inc.
15tier_2bridge.lga1.ap01.net1MarkMonitor, Inc.A1-230.AKAM.NETDNStination Inc.
16tier_2298126900.lga1.ampverified.com1NoneNoneNone
17tier_2clixtrac.com1NAMECHEAP INCNS1.CLIXTRAC.COMWhoisGuard, Inc.
18tier_2secure.adnxs.com1MarkMonitor, Inc.NS1.GSLB.COMAppNexus Inc
19tier_3wayfair.com3MarkMonitor, Inc.A1-100.AKAM.NETWayfair, LLC
20tier_3rpa21.proasdf.com1GoDaddy.com, LLCNS61.DOMAINCONTROL.COMDomains By Proxy, LLC
21tier_3ram21.proasdf.com1GoDaddy.com, LLCNS61.DOMAINCONTROL.COMDomains By Proxy, LLC
22tier_3dropped-click.com1NAMECHEAP INCINES.NS.CLOUDFLARE.COMPrivacy service provided by Withheld for Privacy ehf
23tier_3visitmusiccity.com1GoDaddy.com, LLCNS-1504.AWSDNS-60.ORGNashville Convention & Visitors Corp.
24tier_3irl.com1GoDaddy.com, LLCNS-106.AWSDNS-13.COMDomains By Proxy, LLC
ipcityregionorgpostalcountry_nametiercounthostname
0104.247.81.73WyandotteMichiganAS206834 Team Internet AG48192United Statestier_18nan
152.22.6.66AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_25ec2-52-22-6-66.compute-1.amazonaws.com
252.72.29.7AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_24ec2-52-72-29-7.compute-1.amazonaws.com
3192.138.218.215SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_23noclick.connexity.com
4192.138.218.207SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_23rd.bizrate.com
5192.138.218.139SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_23rd.connexity.net
63.220.46.255AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_22ec2-3-220-46-255.compute-1.amazonaws.com
7104.218.72.13New York CityNew YorkAS63190 adMarketplace, Inc.10016United Statestier_22nan
852.45.77.217AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_21ec2-52-45-77-217.compute-1.amazonaws.com
966.232.112.75TampaFloridaAS29802 HIVELOCITY, Inc.33606United Statestier_2166-232-112-75.static.hvvc.us
10169.63.237.195DallasTexasAS36351 SoftLayer Technologies Inc.75270United Statestier_21c3.ed.3fa9.ip4.static.sl-reverse.com
11208.100.38.218ChicagoIllinoisAS32748 Steadfast60607United Statestier_21clixtrac.com
1268.67.179.173New York CityNew YorkAS29990 AppNexus, Inc10004United Statestier_21569.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
1323.39.32.237NewarkNew JerseyAS16625 Akamai Technologies, Inc.07175United Statestier_33a23-39-32-237.deploy.static.akamaitechnologies.com
14162.243.10.151New York CityNew YorkAS14061 DigitalOcean, LLC10011United Statestier_32nan
1575.126.45.196DallasTexasAS36351 SoftLayer Technologies Inc.75270United Statestier_31c4.2d.7e4b.ip4.static.sl-reverse.com
1654.164.213.169AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_31ec2-54-164-213-169.compute-1.amazonaws.com
1752.73.87.228AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_31ec2-52-73-87-228.compute-1.amazonaws.com

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website