Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
025225912248492021-03-2237.48.65.149Iphone
tierdomaincountregistrarname_serversorg
0tier_1opitanii.net1NorthNames, LLCNS1.COMMONMX.COMNone
1tier_1yellownovels.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
2tier_1etheldredasplace.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
3tier_1aurbataao.com1NoneNoneNone
4tier_1morebest.net1Register.com, Inc.NS1.COMMONMX.COMNone
5tier_1kadraya.net1Fastball Domains LLCNS1.COMMONMX.COMNone
6tier_1redmarka.net1Shining Star Domains, LLCNS1.COMMONMX.COMNone
7tier_1javweb.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
8tier_1gzqsl.net1Freshbreweddomains.com LLCNS1.COMMONMX.COMNone
9tier_1emonj.net1DYNADOT17 LLCNS1.COMMONMX.COMNone
10tier_2btpnav.com771API GmbHNS1.DNSIMPLE.COMRegistrant of btpnav.com
11tier_2click.expmediadirect.com76NAMECHEAP INCNS1.LINODE.COMPrivacy service provided by Withheld for Privacy ehf
12tier_2aglai-tan.com75Amazon Registrar, Inc.NS-1083.AWSDNS-07.ORGWhois Privacy Service
13tier_2ads35.adtelligent.com50DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
14tier_2dsp35.adtelligent.com50DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
15tier_2aibm1.mysearch.space50NoneNoneNone
16tier_2externals-1953518744.us-east-1.elb.amazonaws.com50MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
17tier_2search.snjsearch.com50GoDaddy.com, LLCNS73.DOMAINCONTROL.COMDomains By Proxy, LLC
18tier_2search-checker.com48Name.com, Inc.BETH.NS.CLOUDFLARE.COMDomain Protection Services, Inc.
19tier_2m.onlineweb.mobi48GoDaddy.com, LLCNoneNone
20tier_3bing.com50MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
21tier_3bestappland.me31NAMECHEAP INCNoneNone
22tier_3irl.com17GoDaddy.com, LLCNS-106.AWSDNS-13.COMDomains By Proxy, LLC
23tier_3iosrecommendedvpn.com15NoneNoneNone
24tier_3glbltraffic.com_LOOP_115NoneNoneNone
25tier_3theconnectvpn.com9DonDominio (SCIP)ARNOLD.NS.CLOUDFLARE.COMSoluciones Corporativas IP, c/o Whois Proxy
26tier_3adameve.com9Network Solutions, LLCA1-75.AKAM.NETNone
27tier_3apptool.me8NAMECHEAP INCNoneNone
28tier_3storystudio.sfgate.com6CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Communications, Inc.
29tier_3google.com5MarkMonitor, Inc.NS1.GOOGLE.COMGoogle LLC
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_131nannan
1207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_131nannan
2207.244.67.218ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_127nannan
3207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_123nannan
4104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_110nannan
5206.221.176.184New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_19nannan
6104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_18nannan
7104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_15nannan
837.48.65.148SoestUtrechtAS60781 LeaseWeb Netherlands B.V.3765Netherlandstier_14nannan
937.48.65.149SoestUtrechtAS60781 LeaseWeb Netherlands B.V.3765Netherlandstier_14nannan
10209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_289nannan
11198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_276nannan
12209.205.202.42New York CityNew YorkAS55081 24 SHELLS10004United Statestier_250static-42-202-205-209.24shells.netnan
13209.205.202.43New York CityNew YorkAS55081 24 SHELLS10004United Statestier_250static-43-202-205-209.24shells.netnan
1435.162.164.74BoardmanOregonAS16509 Amazon.com, Inc.97818United Statestier_250ec2-35-162-164-74.us-west-2.compute.amazonaws.comnan
1534.200.146.95AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_242ec2-34-200-146-95.compute-1.amazonaws.comnan
1654.84.27.165AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_239ec2-54-84-27-165.compute-1.amazonaws.comnan
17172.67.196.184San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_233nanTrue
18173.239.53.32New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_228nannan
19192.241.228.85San FranciscoCaliforniaAS14061 DigitalOcean, LLC94124United Statestier_227nannan
20204.79.197.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_341nanTrue
21142.93.4.215North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_339nannan
22100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_331pool-100-37-135-2.nycmny.fios.verizon.netnan
23172.67.181.234San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_39nanTrue
2413.107.21.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_39nanTrue
25184.85.24.16NewarkNew JerseyAS16625 Akamai Technologies, Inc.07175United Statestier_37a184-85-24-16.deploy.static.akamaitechnologies.comnan
2698.129.228.57DallasTexasAS33070 Rackspace Hosting75270United Statestier_36nannan
2752.73.153.209AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_34ec2-52-73-153-209.compute-1.amazonaws.comnan
2867.207.80.24North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_33nannan
29172.217.10.132CliftonNew JerseyAS15169 Google LLC07015United Statestier_32lga34s16-in-f4.1e100.netnan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website