Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
01761886112952021-01-23207.244.67.215Safari
tierdomaincountregistrarname_serversorg
0tier_1addcomponent.com1Slow Putt Domains LLCNS1.DNSNUTS.COMThe Management Group II
1tier_152lu.co1NoneNoneNone
2tier_1bicarbonato.co1NoneNoneNone
3tier_1ah4u.us1NoneNoneNone
4tier_1aplikasi.co1GoDaddy.com, LLCns2.commonmx.comNone
5tier_14play-av.com1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0158842299
6tier_1amazazon.co.uk1EPAG Domainservices GmbH [Tag = EPAG-DE]nNone
7tier_1askdevops.org1GoDaddy.com, LLCNS1.COMMONMX.COMNone
8tier_1best-video.co1NoneNoneNone
9tier_1bont4.com1eNomTen, Inc.NS1.DNSNUTS.COMThe Management Group II
10tier_3down.onegowc.pw19NAMECHEAP INCBUCK.NS.CLOUDFLARE.COMWhoisGuard, Inc.
11tier_3bing.com14MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
12tier_3securityrenewals.com13NAMECHEAP INCANNA.NS.CLOUDFLARE.COMWhoisGuard, Inc.
13tier_3us.redirectbuzz.club10Gandi SASns-2.awsdns-00.comPPCBUZZ
14tier_3blog.sfgate.com7CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Communications, Inc.
15tier_3aaeyqkhprmsmshytiyukwfqialedur.s3.amazonaws.com5MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
16tier_3careerbuilder.com4CSC CORPORATE DOMAINS, INC.BROCK.CBJOBS.NETCareerBuilder, LLC
17tier_3resignation.top4URL Solutions Inc.ns2.p06.dynect.netGLOBAL DOMAIN PRIVACY SERVICES INC
18tier_3track.vcdc.com2Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
19tier_3baocwqismcuvqhllseayziidapdgmp.s3.amazonaws.com2MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
20tier_2alfik-fik.com41Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
21tier_2dprtb.com371API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
22tier_2click.expmediadirect.com35NAMECHEAP INCNS1.LINODE.COMWhoisGuard, Inc.
23tier_2btpnative.com231API GmbHNS1.DNSIMPLE.COMRegistrant of btpnative.com
24tier_2infopicked.com23NAMECHEAP INCNS0.DNSMADEEASY.COMWhoisGuard, Inc.
25tier_2onegowc.pw19NAMECHEAP INCBUCK.NS.CLOUDFLARE.COMWhoisGuard, Inc.
26tier_2api.searchlinker.com15GoDaddy.com, LLCNS-1158.AWSDNS-16.ORGDomains By Proxy, LLC
27tier_2bestresults.xyz14NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
28tier_2vpnostracking.com13NoneNoneNone
29tier_2track.vcdc.com12Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
ipcityregionorgpostalcountry_nametiercountanycasthostname
0104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_118nannan
1206.221.176.184New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_114nannan
2104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_113nannan
3104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_112nannan
4207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_18nannan
5207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_18nannan
6207.244.67.218ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_15nannan
7185.107.56.199AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_14nannan
8207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_13nannan
9185.107.56.200AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_13nannan
10172.67.136.83San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_218Truenan
11204.79.197.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_313Truea-0001.a-msedge.net
12151.101.0.200San FranciscoCaliforniaAS54113 Fastly94107United Statestier_38Truenan
13172.67.152.171San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_38Truenan
14104.21.82.40San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_35Truenan
1566.232.112.74TampaFloridaAS29802 HIVELOCITY, Inc.33606United Statestier_34nan66-232-112-74.static.hvvc.us
16104.21.89.24San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_33Truenan
1766.232.112.83TampaFloridaAS29802 HIVELOCITY, Inc.33606United Statestier_33nan66-232-112-83.static.hvvc.us
18195.201.92.254NürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_32nanstatic.254.92.201.195.clients.your-server.de
1913.225.218.48New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_32nanserver-13-225-218-48.jfk51.r.cloudfront.net
20209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_271nannan
21198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_235nannan
2234.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_229nanec2-34-200-146-95.compute-1.amazonaws.com
2354.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_228nanec2-54-84-27-165.compute-1.amazonaws.com
24173.192.101.24DallasTexasAS36351 SoftLayer Technologies Inc.75270United Statestier_223nan18.65.c0ad.ip4.static.sl-reverse.com
25100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_220nanpool-100-37-135-2.nycmny.fios.verizon.net
26172.67.136.83San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_218Truenan
2745.77.230.200LondonEnglandAS20473 Choopa, LLCEC1AUnited Kingdomtier_213nan45.77.230.200.vultr.com
28204.44.79.214Los AngelesCaliforniaAS8100 QuadraNet Enterprises LLC90014United Statestier_28nan204.44.79.214.static.quadranet.com
293.213.168.177Virginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_28nanec2-3-213-168-177.compute-1.amazonaws.com

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website