Malware Discoverer Github Homepage.

Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
0201944002021-04-16185.53.177.73Iphone
tierdomaincountregistrarname_serversorg
0tier_1aevangelism.org1GoDaddy.com, LLCNS1.PARKINGCREW.NETNone
1tier_1elitetrader.org11API GmbHNS1.PARKINGCREW.NET['adaspect media UG haftungsbeschraenkt', 'REDACTED FOR PRIVACY']
2tier_1420rx.org1GoDaddy.com, LLCNS1.PARKINGCREW.NETCTI Holdings Inc.
3tier_1canadatrips.org1Epik Inc.NS1.PARKINGCREW.NETHunley Media Group LLC
4tier_1cellphones.org1Moniker Online Services LLCNS1.FASTPARK.NETMoniker Privacy Services
5tier_1beingme.org1Domain.com, LLCNS1.PARKINGCREW.NET['Glocal Commerce Limited', 'REDACTED FOR PRIVACY']
6tier_1booking-flights.org1INWX GmbH & Co. KGNS1.PARKINGCREW.NET-
7tier_1bihar.org1DYNADOT LLCNS1.PARKINGCREW.NETNone
8tier_2katie.v4.omgtnc.com8PSI-USA, Inc. dba Domain RobotNS-1133.AWSDNS-13.ORGNone
9tier_2aristo-hag.com4Amazon Registrar, Inc.NS-1226.AWSDNS-25.ORGWhois Privacy Service
10tier_2noclick.connexity.com4MarkMonitor, Inc.NS-1235.AWSDNS-26.ORGConnexity, Inc.
11tier_2rd.bizrate.com4NoneNoneNone
12tier_2rd.connexity.net4NoneNoneNone
13tier_2bridge.lga1.ap01.net1MarkMonitor Inc.A1-230.AKAM.NETNone
14tier_2298126900.lga1.ampverified.com1NoneNoneNone
15tier_2clixtrac.com1NAMECHEAP INCNS1.CLIXTRAC.COMWhoisGuard, Inc.
16tier_2secure.adnxs.com1NoneNoneNone
17tier_3wayfair.com4MarkMonitor, Inc.A1-100.AKAM.NETWayfair, LLC
18tier_3ram21.proasdf.com3GoDaddy.com, LLCNS61.DOMAINCONTROL.COMDomains By Proxy, LLC
19tier_3visitmusiccity.com1GoDaddy.com, LLCNS-1504.AWSDNS-60.ORGNashville Convention & Visitors Corp.
ipcityregionorgpostalcountry_nametiercounthostname
0104.247.81.73WyandotteMichiganAS206834 Team Internet AG48192United Statestier_18nan
1192.138.218.215SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_24noclick.connexity.com
2192.138.218.207SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_24rd.bizrate.com
3192.138.218.139SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_24rd.connexity.net
452.45.77.217AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_24ec2-52-45-77-217.compute-1.amazonaws.com
53.220.46.255AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_23ec2-3-220-46-255.compute-1.amazonaws.com
654.208.107.202AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_22ec2-54-208-107-202.compute-1.amazonaws.com
7104.218.72.13New York CityNew YorkAS63190 adMarketplace, Inc.10016United Statestier_22nan
852.22.6.66AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_21ec2-52-22-6-66.compute-1.amazonaws.com
952.72.29.7AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_21ec2-52-72-29-7.compute-1.amazonaws.com
1018.235.67.128AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_21ec2-18-235-67-128.compute-1.amazonaws.com
11208.100.38.218ChicagoIllinoisAS32748 Steadfast60607United Statestier_21clixtrac.com
1268.67.178.15New York CityNew YorkAS29990 AppNexus, Inc10004United Statestier_21633.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
1323.39.32.237NewarkNew JerseyAS16625 Akamai Technologies, Inc.07175United Statestier_34a23-39-32-237.deploy.static.akamaitechnologies.com
14162.243.10.151New York CityNew YorkAS14061 DigitalOcean, LLC10011United Statestier_33nan
1554.164.213.169AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_31ec2-54-164-213-169.compute-1.amazonaws.com

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website