Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
01992185291462021-01-0837.48.65.149Android
tierdomaincountregistrarname_serversorg
0tier_1capitalpluscreditunion.com1Sea Wasp, LLCNS1.DNSNUTS.COMSavvy Investments, LLC Privacy ID# 786236
1tier_1bjjlaos-teaminfinity.com1Betterthanaveragedomains.com LLCNS1.DNSNUTS.COMNone
2tier_1bestideas4yours.com1SNAPNAMES 33, LLCNS1.DNSNUTS.COMNone
3tier_1camluminarias.com1Domainamania.com LLCNS1.DNSNUTS.COMNone
4tier_1accastiboat.com1Domainplace LLCNS1.DNSNUTS.COMNone
5tier_1282hook.com1Namecatch Zone LLCNS1.DNSNUTS.COMNone
6tier_135ink.com1CloudBreakDomains, LLCNS1.DNSNUTS.COMNone
7tier_1aro-aandv.com1DropFall.com, LLCNS1.DNSNUTS.COMNone
8tier_1abrahamlincolnhistory.com1Sea Wasp, LLCNS1.DNSNUTS.COMSavvy Investments, LLC Privacy ID# 733409
9tier_1areapintura.com1Chipshot Domains LLCNS1.DNSNUTS.COMNone
10tier_2alfik-fik.com78Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
11tier_2track.vcdc.com55Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
12tier_2dprtb.com191API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
13tier_2atnpx.com19GoDaddy.com, LLCBECKY.NS.CLOUDFLARE.COMDomains By Proxy, LLC
14tier_261995.click.validclick.net6Safenames LtdNS1.FULLMAILBOX.COMNone
15tier_261997.click.validclick.net6Safenames LtdNS1.FULLMAILBOX.COMNone
16tier_22893.wcitianka.com5GoDaddy Online Services Cayman Islands LTDNS-1096.AWSDNS-09.ORGNone
17tier_2cpakd.com5GoDaddy Online Services Cayman Islands LTDHUGH.NS.CLOUDFLARE.COMNone
18tier_2infopicked.com5NAMECHEAP INCNS0.DNSMADEEASY.COMWhoisGuard, Inc.
19tier_262039.click.validclick.net4Safenames LtdNS1.FULLMAILBOX.COMNone
20tier_3blog.chron.com23CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Newspapers, LLC
21tier_3kbb.com19CSC CORPORATE DOMAINS, INC.PDNS164.ULTRADNS.BIZAutotrader.com
22tier_3blog.sfgate.com17CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Communications, Inc.
23tier_3storystudio.hearstnp.com9CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMThe Hearst Corporation
24tier_3track.vcdc.com8Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
25tier_3htvnativeadsolutions.com6CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Television Inc.
26tier_3delightcmain.xyz4Epik LLCMARJORY.NS.CLOUDFLARE.COMAnonymize, Inc.
27tier_3toprevenuecpmnetwork.com3ENOM, INC.NS1.CLOUD-DNS-TECH.COMREDACTED FOR PRIVACY
28tier_3e.upbeatmway.xyz3Epik LLCMARJORY.NS.CLOUDFLARE.COMAnonymize, Inc.
29tier_3experian.com2Network Solutions, LLCEXP1.EXPERIAN.COMNone
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_127nannan
1207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_126nannan
2207.244.67.218ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_121nannan
3207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_117nannan
437.48.65.150AmsterdamNorth HollandAS60781 LeaseWeb Netherlands B.V.1012Netherlandstier_15nannan
537.48.65.149AmsterdamNorth HollandAS60781 LeaseWeb Netherlands B.V.1012Netherlandstier_13nannan
664.32.8.67Los AngelesCaliforniaAS46844 Sharktech90009United Statestier_12customer.sharktech.netnan
764.32.8.70Los AngelesCaliforniaAS46844 Sharktech90009United Statestier_12customer.sharktech.netnan
8185.107.56.58AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_12nannan
964.32.8.69Los AngelesCaliforniaAS46844 Sharktech90009United Statestier_11customer.sharktech.netnan
10204.44.79.214Los AngelesCaliforniaAS8100 QuadraNet Enterprises LLC90014United Statestier_255204.44.79.214.static.quadranet.comnan
1134.202.98.117Virginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_241ec2-34-202-98-117.compute-1.amazonaws.comnan
1234.226.113.11Virginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_240ec2-34-226-113-11.compute-1.amazonaws.comnan
13209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_224nannan
1494.130.186.231NürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_215static.231.186.130.94.clients.your-server.denan
15144.76.1.130NürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_215static.130.1.76.144.clients.your-server.denan
1694.130.185.237NürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_213static.237.185.130.94.clients.your-server.denan
17144.76.0.242NürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_212static.242.0.76.144.clients.your-server.denan
18173.192.101.24DallasTexasAS36351 SoftLayer Technologies Inc.75270United Statestier_21018.65.c0ad.ip4.static.sl-reverse.comnan
19172.67.74.77San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_210nanTrue
20151.101.0.200San FranciscoCaliforniaAS54113 Fastly94107United Statestier_346nanTrue
2123.44.217.143NewarkNew JerseyAS16625 Akamai Technologies, Inc.07175United Statestier_319a23-44-217-143.deploy.static.akamaitechnologies.comnan
2298.129.228.57BrookhavenMississippiAS33070 Rackspace Hosting39601United Statestier_39nannan
23195.201.92.254NürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_38static.254.92.201.195.clients.your-server.denan
24104.18.82.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_36nanTrue
25192.243.59.20WashingtonWashington, D.C.AS39572 DataWeb Global Group B.V.20045United Statestier_32nannan
26205.174.34.33DallasTexasAS14799 Experian75270United Statestier_32www.experianautomotive.comnan
27100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_32pool-100-37-135-2.nycmny.fios.verizon.netnan
28104.18.78.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_32nanTrue
29159.203.172.80CliftonNew JerseyAS14061 DigitalOcean, LLC07014United Statestier_31nannan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website