Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
025727012651382021-03-10207.244.67.215Android
tierdomaincountregistrarname_serversorg
0tier_1joniscoffee.com1GoDaddy.com, LLCNS1.COMMONMX.COMDomains By Proxy, LLC
1tier_1atransmissionclinic.com1! #1 Host Canada, Inc.NS1.COMMONMX.COMNone
2tier_1flinzo.com1DYNADOT5 LLCNS1.COMMONMX.COMNone
3tier_1danube.info1DYNADOT LLCNS1.COMMONMX.COMNone
4tier_1abndn.us1Communigal Communication Ltdns1.commonmx.comNone
5tier_1interests.pro1Dynadot, LLCNS1.COMMONMX.COMNone
6tier_1bangaloreonlinemall.com1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0158853938
7tier_1azherofactory.com1DYNADOT, LLCNS1.COMMONMX.COMNone
8tier_1durablehomesinvestment.com1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0158843206
9tier_1cubanadeaviacion.com.co1Communigal Communication Ltdns2.commonmx.comNone
10tier_2dprtb.com1271API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
11tier_2alfik-fik.com105Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
12tier_2nicanor-the.com36Amazon Registrar, Inc.NS-1242.AWSDNS-27.ORGWhois Privacy Service
13tier_2get.popplunder.com36NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
14tier_2trustedpush.com36NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
15tier_2win1.trustedpush.com36NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
16tier_2win2.trustedpush.com34NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
17tier_2win3.trustedpush.com29NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
18tier_2ads35.adtelligent.com25DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
19tier_2dsp35.adtelligent.com25DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
20tier_3bing.com25MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
21tier_3preview.houstonchronicle.com22CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMThe Hearst Corporation
22tier_3storystudio.sfgate.com18CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Communications, Inc.
23tier_3win6.trustedpush.com13NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
24tier_3irl.com12GoDaddy.com, LLCNS-106.AWSDNS-13.COMDomains By Proxy, LLC
25tier_3fwsxqc.cn11四川域趣网络科技有限公司elisabeth.ns.cloudflare.comNone
26tier_3win4.trustedpush.com6NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
27tier_3win5.trustedpush.com6NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
28tier_3ashtdi.cn5四川域趣网络科技有限公司elisabeth.ns.cloudflare.comNone
29tier_3win3.trustedpush.com5NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_135nannan
1207.244.67.218ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_129nannan
2207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_127nannan
3207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_126nannan
4104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_112nannan
5104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_17nannan
6206.221.176.184WillingboroNew JerseyAS23470 ReliableSite.Net LLC08046United Statestier_15nannan
7104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_14nannan
874.63.241.29Los AngelesCaliforniaAS46475 Limestone Networks, Inc.90009United Statestier_1329-241-63-74.static.reverse.lstn.netnan
937.48.65.151SoestUtrechtAS60781 LeaseWeb Netherlands B.V.3765Netherlandstier_12nannan
10209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_2150nannan
1134.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_281ec2-34-200-146-95.compute-1.amazonaws.comnan
1213.225.218.47New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_272server-13-225-218-47.jfk51.r.cloudfront.netnan
1313.225.218.79New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_36server-13-225-218-79.jfk51.r.cloudfront.netnan
1454.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_260ec2-54-84-27-165.compute-1.amazonaws.comnan
15204.44.79.214Los AngelesCaliforniaAS8100 QuadraNet Enterprises LLC90014United Statestier_247204.44.79.214.static.quadranet.comnan
1634.199.180.187Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_236ec2-34-199-180-187.compute-1.amazonaws.comnan
17192.138.218.207SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_225rd.bizrate.comnan
18209.205.202.42New York CityNew YorkAS55081 24 SHELLS10004United Statestier_225static-42-202-205-209.24shells.netnan
19209.205.202.43New York CityNew YorkAS55081 24 SHELLS10004United Statestier_225static-43-202-205-209.24shells.netnan
20100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_326pool-100-37-135-2.nycmny.fios.verizon.netnan
21151.101.0.200San FranciscoCaliforniaAS54113 Fastly94107United Statestier_325nanTrue
2298.129.228.57DallasTexasAS33070 Rackspace Hosting75270United Statestier_322nannan
23204.79.197.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_321a-0001.a-msedge.netTrue
24104.21.53.104San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_39nanTrue
2564.91.232.212LansingMichiganAS32244 Liquid Web, L.L.C48901United Statestier_38host.encontext.comnan
2613.225.218.79New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_36server-13-225-218-79.jfk51.r.cloudfront.netnan
2713.225.218.113New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_34server-13-225-218-113.jfk51.r.cloudfront.netnan
2813.107.21.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_34nanTrue
2952.73.87.228Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_33ec2-52-73-87-228.compute-1.amazonaws.comnan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website