Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
0256264109511742021-02-0837.48.65.149Chrome
tierdomaincountregistrarname_serversorg
0tier_1blakesreman.com1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0158849653
1tier_1esox.me1Dynadot, LLCNoneNone
2tier_1digaaz.com1NamePal.com #8013, LLCNS1.COMMONMX.COMNone
3tier_1arkadasinpaylasti.com1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0158498422
4tier_110xjw.com1DropCatch.com 1063 LLCNS1.COMMONMX.COMNone
5tier_13kony.com1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0158503801
6tier_1downapk.mobi1DYNADOT LLCNoneNone
7tier_1aweldaw.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
8tier_1assuncionistas.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
9tier_1beritbart.com1ABOVE.COM PTY LTD.NS1.COMMONMX.COMREDACTED FOR PRIVACY
10tier_2dprtb.com1271API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
11tier_2alfik-fik.com69Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
12tier_21496.wcitianka.com37GoDaddy Online Services Cayman Islands LTDNS-1096.AWSDNS-09.ORGNone
13tier_2americanlisted.com35ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
14tier_2bradamante-per.com32Amazon Registrar, Inc.NS-1026.AWSDNS-00.ORGWhois Privacy Service
15tier_2apinew.fpvideoplayer.com30NAMECHEAP INCNS-1200.AWSDNS-22.ORGWhoisGuard, Inc.
16tier_2r65g7vxgee.execute-api.us-east-1.amazonaws.com29MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
17tier_2r65g7vxgee.execute-api.us-east-1.amazonaws.com_LOOP_129NoneNoneNone
18tier_2click.expmediadirect.com20NAMECHEAP INCNS1.LINODE.COMWhoisGuard, Inc.
19tier_2traff0121.com20NAMECHEAP INCHANS.NS.CLOUDFLARE.COMWhoisGuard, Inc.
20tier_3irl.com63GoDaddy.com, LLCNS-106.AWSDNS-13.COMDomains By Proxy, LLC
21tier_3google.com15MarkMonitor, Inc.NS1.GOOGLE.COMGoogle LLC
22tier_3install.streamssitesearch.com15GoDaddy.com, LLCISLA.NS.CLOUDFLARE.COMDomains By Proxy, LLC
23tier_3us.sercanto.com11OVH, SASDNS20.OVH.NETWickedin s.r.l.
24tier_3byfimqrfahzghzboakgtexhrzdfcsu.s3.amazonaws.com11NoneNoneNone
25tier_3vwwrmnhevvelfqsjvmhgoqwbtgnjuv.s3.amazonaws.com8NoneNoneNone
26tier_3neuvoo.com5NoneNoneNone
27tier_3umoiqlfyrywsmkxabtnrginllrnvwv.s3.amazonaws.com4NoneNoneNone
28tier_3jgwfjqnytffafrxtfscduvsilnefrw.s3.amazonaws.com3NoneNoneNone
29tier_3il.betrivers.com3GoDaddy.com, LLCERIN.NS.CLOUDFLARE.COMRivers IP Holdings, LLC
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_136nannan
1207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_128nannan
2207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_123nannan
3206.221.176.184NewarkNew JerseyAS23470 ReliableSite.Net LLC07175United Statestier_111nannan
4104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_110nannan
5104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_18nannan
6104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_17nannan
7185.107.56.200AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_16nannan
874.63.241.28DallasTexasAS46475 Limestone Networks, Inc.75270United Statestier_1428-241-63-74.static.reverse.lstn.netnan
982.192.82.226AmsterdamNorth HollandAS60781 LeaseWeb Netherlands B.V.1012Netherlandstier_14nannan
10209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_2143nannan
11178.62.225.201AmsterdamNorth HollandAS14061 DigitalOcean, LLC1012Netherlandstier_296nannan
12100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_267pool-100-37-135-2.nycmny.fios.verizon.netnan
1354.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_262ec2-54-84-27-165.compute-1.amazonaws.comnan
1434.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_239ec2-34-200-146-95.compute-1.amazonaws.comnan
15198.54.112.216San JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_237nannan
1688.99.101.106Hohen NeuendorfBrandenburgAS24940 Hetzner Online GmbH16540Germanytier_237static.106.101.99.88.clients.your-server.denan
1735.209.61.240Council BluffsIowaAS15169 Google LLC51502United Statestier_235240.61.209.35.bc.googleusercontent.comnan
18173.192.101.24DallasTexasAS36351 SoftLayer Technologies Inc.75270United Statestier_22018.65.c0ad.ip4.static.sl-reverse.comnan
19198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_220nannan
20159.65.216.232North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_313nannan
21172.67.152.171San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_312nanTrue
22192.81.212.192North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_38nannan
23104.248.50.87North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_37nannan
24172.217.10.100Mountain ViewCaliforniaAS15169 Google LLC94043United Statestier_36lga34s15-in-f4.1e100.netnan
2554.177.0.157Los AngelesCaliforniaAS16509 Amazon.com, Inc.90084United Statestier_36ec2-54-177-0-157.us-west-1.compute.amazonaws.comnan
2635.204.107.142GroningenGroningenAS15169 Google LLC9711Netherlandstier_36142.107.204.35.bc.googleusercontent.comnan
2734.90.160.43GroningenGroningenAS15169 Google LLC9711Netherlandstier_3543.160.90.34.bc.googleusercontent.comnan
28172.217.10.4Mountain ViewCaliforniaAS15169 Google LLC94043United Statestier_35lga34s12-in-f4.1e100.netnan
29158.69.76.164MontréalQuebecAS16276 OVH SASH3ACanadatier_35nannan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website