Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
029730715411562021-03-21207.244.67.215Chrome
tierdomaincountregistrarname_serversorg
0tier_1apbsnl.co.in1Dynadot LLCns1.commonmx.comNone
1tier_1getinvolver.com1DYNADOT10 LLCNS1.COMMONMX.COMNone
2tier_1dapool.me1Dynadot, LLCNoneNone
3tier_1facetime4pc.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
4tier_1allbank.co.in1Dynadot LLCns1.commonmx.comNone
5tier_1hisocraft.net1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0159836646
6tier_1attaqonline.com1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0159172785
7tier_1fx-persia.com1SNAPNAMES 57, LLCNS1.COMMONMX.COMNone
8tier_1etudions.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
9tier_1haberxy.com1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0158499914
10tier_2btpnav.com1491API GmbHNS1.DNSIMPLE.COMRegistrant of btpnav.com
11tier_2aglai-tan.com122Amazon Registrar, Inc.NS-1083.AWSDNS-07.ORGWhois Privacy Service
12tier_2ads35.adtelligent.com66DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
13tier_2dsp35.adtelligent.com66DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
14tier_2externals-1953518744.us-east-1.elb.amazonaws.com66MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
15tier_2search.snjsearch.com66GoDaddy.com, LLCNS73.DOMAINCONTROL.COMDomains By Proxy, LLC
16tier_2aldb1.mysearch.space65NoneNoneNone
17tier_21496.wcitianka.com38GoDaddy Online Services Cayman Islands LTDNS-1096.AWSDNS-09.ORGNone
18tier_2americanlisted.com38ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
19tier_2click.appcast.io37101Domain GRS LtdNS-85.AWSDNS-10.COMNone
20tier_3irl.com53GoDaddy.com, LLCNS-106.AWSDNS-13.COMDomains By Proxy, LLC
21tier_3bing.com49MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
22tier_3search.yahoo.com16NoneNoneNone
23tier_3celojobs.com14GoDaddy.com, LLCNS-141.AWSDNS-17.COMDomains By Proxy, LLC
24tier_3uber.com9MarkMonitor Inc.EDNS126.ULTRADNS.BIZNone
25tier_3aliexpress.com_LOOP_15NoneNoneNone
26tier_3wix.com3GoDaddy.com, LLCDNS1.P03.NSONE.NETWix.com, LTD.
27tier_3neuvoo.com3NoneNoneNone
28tier_3cehappear.fun3DYNADOT LLCAIDEN.NS.CLOUDFLARE.COMNone
29tier_3adidas.com2RegistryGate GmbHSEC1.RCODE0.NETREDACTED FOR PRIVACY
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.218ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_129nannan
1207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_129nannan
2207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_124nannan
3207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_123nannan
4206.221.176.184New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_115nannan
5104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_112nannan
6104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_18nannan
7104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_16nannan
8185.107.56.197RotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_15nannan
974.63.241.29Los AngelesCaliforniaAS46475 Limestone Networks, Inc.90009United Statestier_1329-241-63-74.static.reverse.lstn.netnan
10209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_2172nannan
1134.200.146.95AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_274ec2-34-200-146-95.compute-1.amazonaws.comnan
12209.205.202.42New York CityNew YorkAS55081 24 SHELLS10004United Statestier_266static-42-202-205-209.24shells.netnan
13209.205.202.43New York CityNew YorkAS55081 24 SHELLS10004United Statestier_266static-43-202-205-209.24shells.netnan
1435.162.164.74BoardmanOregonAS16509 Amazon.com, Inc.97818United Statestier_266ec2-35-162-164-74.us-west-2.compute.amazonaws.comnan
1554.84.27.165AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_256ec2-54-84-27-165.compute-1.amazonaws.comnan
16100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_312pool-100-37-135-2.nycmny.fios.verizon.netnan
17198.54.112.216San JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_238nannan
1835.209.61.240Council BluffsIowaAS15169 Google LLC51502United Statestier_238240.61.209.35.bc.googleusercontent.comnan
1954.210.170.165AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_237ec2-54-210-170-165.compute-1.amazonaws.comnan
20204.79.197.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_346nanTrue
2166.218.84.137Atlantic CityNew JerseyAS26101 Oath Holdings Inc.08404United Statestier_316ats1.l7.search.vip.bf1.yahoo.comnan
22100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_312pool-100-37-135-2.nycmny.fios.verizon.netnan
23104.36.195.150WashingtonWashington, D.C.AS63086 Uber Technologies, Inc20045United Statestier_39nannan
2454.205.240.192AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_37ec2-54-205-240-192.compute-1.amazonaws.comnan
2552.73.87.228AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_37ec2-52-73-87-228.compute-1.amazonaws.comnan
26167.172.139.120North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_36nannan
27157.245.242.152North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_36nannan
283.208.141.234AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_35ec2-3-208-141-234.compute-1.amazonaws.comnan
2952.73.153.209AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_35ec2-52-73-153-209.compute-1.amazonaws.comnan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website