Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
01741686280892021-01-1937.48.65.149Android
tierdomaincountregistrarname_serversorg
0tier_1acnedoctor.us1Communigal Communication Ltdns2.commonmx.comNone
1tier_1ahiretrehberi.com1Domainsnapper LLCNS1.COMMONMX.COMNone
2tier_1blender90.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
3tier_1bifg.us1Communigal Communication Ltdns2.commonmx.comNone
4tier_1backthebadge.us1Dynadot LLCns2.commonmx.comNone
5tier_1ahnr.us1Communigal Communication Ltdns2.commonmx.comNone
6tier_1android-vsem.org1Atomicdomainnames.com LLCNS1.COMMONMX.COMNone
7tier_18eapp.com1Swordfish Domains LLCNS1.COMMONMX.COMNone
8tier_1angelicacastro.us1Communigal Communication Ltdns2.commonmx.comNone
9tier_1babierus.com1NameSilo, LLCNS1.DNSNUTS.COMSee PrivacyGuardian.org
10tier_2bradamante-per.com36Amazon Registrar, Inc.NS-1026.AWSDNS-00.ORGWhois Privacy Service
11tier_2get.popplunder.com36NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
12tier_2click.expmediadirect.com36NAMECHEAP INCNS1.LINODE.COMWhoisGuard, Inc.
13tier_2trustedpush.com34NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
14tier_2dprtb.com321API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
15tier_2win1.trustedpush.com32NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
16tier_2win2.trustedpush.com28NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
17tier_22893.wcitianka.com22GoDaddy Online Services Cayman Islands LTDNS-1096.AWSDNS-09.ORGNone
18tier_2cpakd.com22GoDaddy Online Services Cayman Islands LTDHUGH.NS.CLOUDFLARE.COMNone
19tier_2win3.trustedpush.com19NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
20tier_3a.upbeatcboulevard.xyz16Epik LLCMARJORY.NS.CLOUDFLARE.COMAnonymize, Inc.
21tier_3agatrck.com14Amazon Registrar, Inc.NS-1518.AWSDNS-61.ORGWhois Privacy Service
22tier_3searchfrequently.com12GoDaddy.com, LLCNEIL.NS.CLOUDFLARE.COMDomains By Proxy, LLC
23tier_3delightcmain.xyz12NoneNoneNone
24tier_3win4.trustedpush.com10NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
25tier_3win3.trustedpush.com9NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
26tier_3win5.trustedpush.com6NameCheap, Inc.NS-1142.AWSDNS-14.ORGNone
27tier_3findoffers.co4Key-Systems GmbHns4.monikerdns.netMoniker Privacy Services
28tier_3win2.trustedpush.com4NoneNoneNone
29tier_3win6.trustedpush.com3NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_115nannan
1207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_115nannan
2207.244.67.218ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_114nannan
3104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_114nannan
4104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_112nannan
5206.221.176.184New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_110nannan
6207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_18nannan
7207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_17nannan
837.48.65.149SoestUtrechtAS60781 LeaseWeb Netherlands B.V.3765Netherlandstier_14nannan
9185.107.56.197AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_13nannan
10209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_253nannan
1113.224.215.98SeattleWashingtonAS16509 Amazon.com, Inc.98101United Statestier_243server-13-224-215-98.phl50.r.cloudfront.netnan
1234.199.180.187Virginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_236ec2-34-199-180-187.compute-1.amazonaws.comnan
13198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_236nannan
1413.224.215.96SeattleWashingtonAS16509 Amazon.com, Inc.98101United Statestier_34server-13-224-215-96.phl50.r.cloudfront.netnan
1513.224.215.78SeattleWashingtonAS16509 Amazon.com, Inc.98101United Statestier_229server-13-224-215-78.phl50.r.cloudfront.netnan
1654.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_227ec2-54-84-27-165.compute-1.amazonaws.comnan
1713.224.215.55SeattleWashingtonAS16509 Amazon.com, Inc.98101United Statestier_223server-13-224-215-55.phl50.r.cloudfront.netnan
18198.54.112.216San JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_222nannan
1934.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_216ec2-34-200-146-95.compute-1.amazonaws.comnan
20100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_326pool-100-37-135-2.nycmny.fios.verizon.netnan
2154.205.191.137Virginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_314ec2-54-205-191-137.compute-1.amazonaws.comnan
22104.18.82.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_310nanTrue
23104.21.8.61San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_38nanTrue
24104.18.78.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_37nanTrue
25104.18.81.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_37nanTrue
2618.190.1.57ColumbusOhioAS16509 Amazon.com, Inc.43216United Statestier_34ec2-18-190-1-57.us-east-2.compute.amazonaws.comnan
27172.67.138.156San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_34nanTrue
2813.224.215.96SeattleWashingtonAS16509 Amazon.com, Inc.98101United Statestier_34server-13-224-215-96.phl50.r.cloudfront.netnan
29104.18.80.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_33nanTrue

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website