Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
026426693402532021-03-1237.48.65.149Iphone
tierdomaincountregistrarname_serversorg
0tier_1arrecharge.in1Dynadot LLCns1.commonmx.comNone
1tier_1biit.info1Dynadot, LLCNS1.COMMONMX.COMNone
2tier_1anhdep.pro1Dynadot, LLCNS1.COMMONMX.COMNone
3tier_1flutterdoc.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
4tier_1beactivedentist.com1SNAPNAMES 7, LLCNS1.COMMONMX.COMNone
5tier_1apidoc.me1Dynadot, LLCNoneNone
6tier_1bexinhs.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
7tier_1abhinavyedla.me1GoDaddy.com, LLCNoneNone
8tier_1gazcelebs.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
9tier_1cankaroto.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
10tier_2changeslots.com69Instra Corporation Pty Ltd.CLEO.NS.CLOUDFLARE.COMREDACTED FOR PRIVACY
11tier_2click.expmediadirect.com59NAMECHEAP INCNS1.LINODE.COMWhoisGuard, Inc.
12tier_2btpnative.com561API GmbHNS1.DNSIMPLE.COMRegistrant of btpnative.com
13tier_2infopicked.com55NAMECHEAP INCNS0.DNSMADEEASY.COMWhoisGuard, Inc.
14tier_2p274639.infopicked.com51NAMECHEAP INCNS0.DNSMADEEASY.COMWhoisGuard, Inc.
15tier_2alfik-fik.com19Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
16tier_2btpnav.com181API GmbHNS1.DNSIMPLE.COMRegistrant of btpnav.com
17tier_2c.clickprotects.com16GoDaddy.com, LLCNS63.DOMAINCONTROL.COMDomains By Proxy, LLC
18tier_211165151.addotnet.com16GoDaddy.com, LLCNS75.DOMAINCONTROL.COMDomains By Proxy, LLC
19tier_2nicanor-the.com13Amazon Registrar, Inc.NS-1242.AWSDNS-27.ORGWhois Privacy Service
20tier_3theconnectvpn.com69DonDominio (SCIP)ARNOLD.NS.CLOUDFLARE.COMSoluciones Corporativas IP, c/o Whois Proxy
21tier_3bestappland.me29NAMECHEAP INCNoneNone
22tier_3cselfconnect.com13NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
23tier_3iosrecommendedvpn.com13NoneNoneNone
24tier_3glbltraffic.com_LOOP_111NoneNoneNone
25tier_3apple.com8CSC CORPORATE DOMAINS, INC.A.NS.APPLE.COMApple Inc.
26tier_3storystudio.sfgate.com7CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Communications, Inc.
27tier_3bing.com7MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
28tier_3music.apple.com6CSC CORPORATE DOMAINS, INC.A.NS.APPLE.COMApple Inc.
29tier_3intimepoint.com6GoDaddy.com, LLCNS25.DOMAINCONTROL.COMInfo Bridge Ltd
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_140nannan
1207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_132nannan
2207.244.67.218ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_123nannan
3207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_123nannan
4104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_113nannan
5104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_19nannan
6104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_19nannan
7206.221.176.184WillingboroNew JerseyAS23470 ReliableSite.Net LLC08046United Statestier_16nannan
837.48.65.151SoestUtrechtAS60781 LeaseWeb Netherlands B.V.3765Netherlandstier_15nannan
937.48.65.150SoestUtrechtAS60781 LeaseWeb Netherlands B.V.3765Netherlandstier_13nannan
10173.192.101.26DallasTexasAS36351 SoftLayer Technologies Inc.75270United Statestier_21151a.65.c0ad.ip4.static.sl-reverse.comnan
11209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_32nannan
1234.207.32.33Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_269ec2-34-207-32-33.compute-1.amazonaws.comnan
13198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_259nannan
14209.132.243.15Los AngelesCaliforniaAS7296 Alchemy Communications, Inc.90009United Statestier_232nannan
1554.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_219ec2-54-84-27-165.compute-1.amazonaws.comnan
1634.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_214ec2-34-200-146-95.compute-1.amazonaws.comnan
17206.189.170.229Santa ClaraCaliforniaAS14061 DigitalOcean, LLC95051United Statestier_213nannan
18149.28.63.209New York CityNew YorkAS20473 The Constant Company, LLC10004United Statestier_213149.28.63.209.vultr.comnan
19100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_332pool-100-37-135-2.nycmny.fios.verizon.netnan
20172.67.181.234San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_342nanTrue
21100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_332pool-100-37-135-2.nycmny.fios.verizon.netnan
22142.93.4.215North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_329nannan
23104.21.91.236San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_327nanTrue
24178.128.64.93Santa ClaraCaliforniaAS14061 DigitalOcean, LLC95051United Statestier_313nannan
2523.38.172.250NewarkNew JerseyAS16625 Akamai Technologies, Inc.07175United Statestier_38a23-38-172-250.deploy.static.akamaitechnologies.comnan
2698.129.228.57DallasTexasAS33070 Rackspace Hosting75270United Statestier_37nannan
27204.79.197.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_36nanTrue
28178.128.246.195AmsterdamNorth HollandAS14061 DigitalOcean, LLC1012Netherlandstier_36nannan
29209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_32nannan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website