Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
024624785501432021-02-02207.244.67.215Safari
tierdomaincountregistrarname_serversorg
0tier_1btalk.us1NoneNoneNone
1tier_1amazons.us1NoneNoneNone
2tier_1ballance.us1Dynadot LLCns2.commonmx.comNone
3tier_1biz-rate.us1Dynadot LLCns2.commonmx.comNone
4tier_1airtemail.in1Dynadot LLCns1.commonmx.comNone
5tier_1animeai2.net1Slow Putt Domains LLCNS1.COMMONMX.COMNone
6tier_1atifaslam.us1NoneNoneNone
7tier_1briefmarke.us1NoneNoneNone
8tier_1funeruption.com1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0158842680
9tier_1aktivwatch.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
10tier_2click.expmediadirect.com89NAMECHEAP INCNS1.LINODE.COMWhoisGuard, Inc.
11tier_2qqnhwxpz.ancientopossum.com84NAMECHEAP INCIAN.NS.CLOUDFLARE.COMWhoisGuard, Inc.
12tier_2salo41.admedit.net81NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
13tier_2alfik-fik.com65Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
14tier_2dprtb.com551API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
15tier_2btpnative.com201API GmbHNS1.DNSIMPLE.COMRegistrant of btpnative.com
16tier_2infopicked.com19NAMECHEAP INCNS0.DNSMADEEASY.COMWhoisGuard, Inc.
17tier_2rtbstream.com181API GmbHNS1.DNSIMPLE.COMRegistrant of rtbstream.com
18tier_2bradamante-per.com15Amazon Registrar, Inc.NS-1026.AWSDNS-00.ORGWhois Privacy Service
19tier_2managerformula.com6NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
20tier_3irl.com61GoDaddy.com, LLCNS-106.AWSDNS-13.COMDomains By Proxy, LLC
21tier_3s3.amazonaws.com9MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
22tier_3upalways.bettercleanplayer.info9NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
23tier_3upalways.thebettercleanplayers.info9NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
24tier_3nowupdate4free.thebettercleanplayer.info7NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
25tier_3nowupdate4free.thebettercleanplayers.info7NameCheap, IncDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
26tier_3online.thebettercleanplayer.info6NoneNoneNone
27tier_3managerformula.com6NoneNoneNone
28tier_3free2update.yourbettercleanplayer.info5NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
29tier_3nowupdate4free.bettercleanplayers.info4NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_132nannan
1207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_130nannan
2207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_129nannan
3206.221.176.184East MeadowNew YorkAS23470 ReliableSite.Net LLC11554United Statestier_114nannan
4104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_112nannan
5104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_111nannan
6185.107.56.199AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_16nannan
7104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_16nannan
882.192.82.226AmsterdamNorth HollandAS60781 LeaseWeb Netherlands B.V.1012Netherlandstier_15nannan
9185.107.56.198AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_13nannan
10209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_293nannan
11198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_289nannan
12137.74.180.226StrasbourgGrand EstAS16276 OVH SAS67000Francetier_281ip226.ip-137-74-180.eunan
13172.67.198.249San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_245nanTrue
1454.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_242ec2-54-84-27-165.compute-1.amazonaws.comnan
15104.21.68.220San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_239nanTrue
1634.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_238ec2-34-200-146-95.compute-1.amazonaws.comnan
17173.192.101.24DallasTexasAS36351 SoftLayer Technologies Inc.75270United Statestier_22018.65.c0ad.ip4.static.sl-reverse.comnan
18100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_36pool-100-37-135-2.nycmny.fios.verizon.netnan
19192.138.218.207SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_25rd.bizrate.comnan
2054.162.183.76Virginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_381ec2-54-162-183-76.compute-1.amazonaws.comnan
21162.243.166.170North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_38nannan
22104.248.63.231North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_38nannan
2313.57.64.34Los AngelesCaliforniaAS16509 Amazon.com, Inc.90084United Statestier_38ec2-13-57-64-34.us-west-1.compute.amazonaws.comnan
24104.248.63.248North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_37nannan
25100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_36pool-100-37-135-2.nycmny.fios.verizon.netnan
26159.65.216.232North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_35nannan
27157.245.130.6North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_35nannan
2850.18.217.105Los AngelesCaliforniaAS16509 Amazon.com, Inc.90084United Statestier_34ec2-50-18-217-105.us-west-1.compute.amazonaws.comnan
29192.81.212.192North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_34nannan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website