Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
02282249500662021-02-1437.48.65.149Android
tierdomaincountregistrarname_serversorg
0tier_1apbsnl.co.in1Dynadot LLCns1.commonmx.comNone
1tier_1dublikat.in1Dynadot LLCns1.commonmx.comNone
2tier_1airtemail.in1Dynadot LLCns1.commonmx.comNone
3tier_1earabgirls.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
4tier_1djanandmix.in1Dynadot LLCns1.commonmx.comNone
5tier_1celebrityplastic.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
6tier_1cgmusic.in1Dynadot LLCns1.commonmx.comNone
7tier_1apexmoble.info1DYNADOT LLCNS1.COMMONMX.COMNone
8tier_14play-av.com1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0158842299
9tier_1chatkon.us1Communigal Communication Ltdns1.commonmx.comNone
10tier_22893.wcitianka.com102GoDaddy Online Services Cayman Islands LTDNS-1096.AWSDNS-09.ORGNone
11tier_2cpakd.com96GoDaddy Online Services Cayman Islands LTDHUGH.NS.CLOUDFLARE.COMNone
12tier_2dprtb.com571API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
13tier_2bradamante-per.com57Amazon Registrar, Inc.NS-1026.AWSDNS-00.ORGWhois Privacy Service
14tier_2get.popplunder.com57NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
15tier_2trustedpush.com55NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
16tier_2win1.trustedpush.com45NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
17tier_2win2.trustedpush.com22NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
18tier_2click.expmediadirect.com10NAMECHEAP INCNS1.LINODE.COMWhoisGuard, Inc.
19tier_2btpnative.com91API GmbHNS1.DNSIMPLE.COMRegistrant of btpnative.com
20tier_3m.placesiteb.xyz46Sav.comLLCHUGH.NS.CLOUDFLARE.COMPrivacy Protection
21tier_3happymakesite.xyz38NoneNoneNone
22tier_3win2.trustedpush.com23NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
23tier_3win3.trustedpush.com14NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
24tier_3win1.trustedpush.com10NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
25tier_3m.funsiteb.xyz9Sav.comLLCHUGH.NS.CLOUDFLARE.COMPrivacy Protection
26tier_3win4.trustedpush.com8NameCheap, Inc.NS-1142.AWSDNS-14.ORGNone
27tier_3omahasteaks.com3CSC CORPORATE DOMAINS, INC.A1-3.AKAM.NETOmaha Steaks International, Inc.
28tier_3b.playspind.xyz3Sav.comLLCHUGH.NS.CLOUDFLARE.COMPrivacy Protection
29tier_3b.meeryslotspin.xyz3NoneNoneNone
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_136nannan
1207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_135nannan
2207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_127nannan
3206.221.176.184NewarkNew JerseyAS23470 ReliableSite.Net LLC07175United Statestier_112nannan
4104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_111nannan
5104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_19nannan
6104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_16nannan
774.63.241.22DallasTexasAS46475 Limestone Networks, Inc.75270United Statestier_1422-241-63-74.static.reverse.lstn.netnan
837.48.65.149SoestUtrechtAS60781 LeaseWeb Netherlands B.V.3765Netherlandstier_13nannan
9185.107.56.197AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_13nannan
10198.54.112.216San JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_2102nannan
11209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_269nannan
12104.19.217.16San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_269nanTrue
1334.199.180.187Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_257ec2-34-199-180-187.compute-1.amazonaws.comnan
1413.224.215.78SeattleWashingtonAS16509 Amazon.com, Inc.98101United Statestier_312server-13-224-215-78.phl50.r.cloudfront.netnan
1513.224.215.98SeattleWashingtonAS16509 Amazon.com, Inc.98101United Statestier_35server-13-224-215-98.phl50.r.cloudfront.netnan
1634.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_232ec2-34-200-146-95.compute-1.amazonaws.comnan
1713.224.215.96SeattleWashingtonAS16509 Amazon.com, Inc.98101United Statestier_37server-13-224-215-96.phl50.r.cloudfront.netnan
18104.19.218.16San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_227nanTrue
1954.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_226ec2-54-84-27-165.compute-1.amazonaws.comnan
20104.18.81.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_332nanTrue
21100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_330pool-100-37-135-2.nycmny.fios.verizon.netnan
22104.18.79.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_326nanTrue
23104.18.82.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_318nanTrue
24104.18.80.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_316nanTrue
2513.224.215.78SeattleWashingtonAS16509 Amazon.com, Inc.98101United Statestier_312server-13-224-215-78.phl50.r.cloudfront.netnan
26104.18.78.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_311nanTrue
2713.224.215.96SeattleWashingtonAS16509 Amazon.com, Inc.98101United Statestier_37server-13-224-215-96.phl50.r.cloudfront.netnan
2813.224.215.98SeattleWashingtonAS16509 Amazon.com, Inc.98101United Statestier_35server-13-224-215-98.phl50.r.cloudfront.netnan
2913.224.215.55SeattleWashingtonAS16509 Amazon.com, Inc.98101United Statestier_34server-13-224-215-55.phl50.r.cloudfront.netnan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website