Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
027728496711052021-02-0237.48.65.151Safari
tierdomaincountregistrarname_serversorg
0tier_1saxenda.info1DYNADOT LLCNS1.COMMONMX.COMNone
1tier_1biit.info1DYNADOT LLCNS1.COMMONMX.COMNone
2tier_1dinz.info1DYNADOT LLCNS1.COMMONMX.COMNone
3tier_1iphonepoetry.info1DYNADOT LLCNS1.COMMONMX.COMNone
4tier_1pods.info1Dynadot, LLCNS1.COMMONMX.COMNone
5tier_1mrchat.info1Dynadot, LLCNS1.COMMONMX.COMNone
6tier_1bezlohotrona.info1Dynadot, LLCNS1.COMMONMX.COMNone
7tier_1rfcity.info1Dynadot, LLCNS1.COMMONMX.COMNone
8tier_1bigporno.info1NoneNoneNone
9tier_1ggbk.info1Dynadot, LLCNS1.COMMONMX.COMNone
10tier_2click.expmediadirect.com86NAMECHEAP INCNS1.LINODE.COMWhoisGuard, Inc.
11tier_2dprtb.com731API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
12tier_2qqnhwxpz.ancientopossum.com52NAMECHEAP INCIAN.NS.CLOUDFLARE.COMWhoisGuard, Inc.
13tier_2salo41.admedit.net51NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
14tier_2alfik-fik.com50Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
15tier_21496.wcitianka.com28GoDaddy Online Services Cayman Islands LTDNS-1096.AWSDNS-09.ORGNone
16tier_2americanlisted.com26ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
17tier_2click.appcast.io25101Domain GRS LtdNS-85.AWSDNS-10.COMNone
18tier_2rqhere2.com23NAMECHEAP INCJEROME.NS.CLOUDFLARE.COMWhoisGuard, Inc.
19tier_2rd.vierjobs.com19GoDaddy.com, LLCNS-1003.AWSDNS-61.NETDomains By Proxy, LLC
20tier_3irl.com46GoDaddy.com, LLCNS-106.AWSDNS-13.COMDomains By Proxy, LLC
21tier_3healthyparker.info23GoDaddy.com, LLCMOLLY.NS.CLOUDFLARE.COMNone
22tier_3join.assurance.com11GoDaddy.com, LLCNS-1503.AWSDNS-59.ORGDomains By Proxy, LLC
23tier_3online.yourbettercleanplayer.info7NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
24tier_3click.appcast.io_LOOP_17NoneNoneNone
25tier_3healthreportsweb.info6GoDaddy.com, LLCMOLLY.NS.CLOUDFLARE.COMNone
26tier_3free2update.yourbettercleanplayers.info5NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
27tier_3zhmymoqfkqomepbimzpycdxyddarsl.s3.amazonaws.com5MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
28tier_3free2update.thebettercleanplayers.info4NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
29tier_3nowupdate4free.bettercleanplayer.info4NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_139nannan
1207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_129nannan
2207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_120nannan
3206.221.176.184East MeadowNew YorkAS23470 ReliableSite.Net LLC11554United Statestier_114nannan
4104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_112nannan
5104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_111nannan
6104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_110nannan
7185.107.56.200AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_18nannan
8185.107.56.198AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_17nannan
982.192.82.228AmsterdamNorth HollandAS60781 LeaseWeb Netherlands B.V.1012Netherlandstier_14nannan
10209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_299nannan
11198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_287nannan
12137.74.180.226StrasbourgGrand EstAS16276 OVH SAS67000Francetier_251ip226.ip-137-74-180.eunan
13172.67.198.249San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_234nanTrue
1454.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_232ec2-54-84-27-165.compute-1.amazonaws.comnan
15198.54.112.216San JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_231nannan
16100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_313pool-100-37-135-2.nycmny.fios.verizon.netnan
1735.209.61.240Council BluffsIowaAS15169 Google LLC51502United Statestier_226240.61.209.35.bc.googleusercontent.comnan
1834.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_226ec2-34-200-146-95.compute-1.amazonaws.comnan
19167.99.3.175North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_223nannan
2054.162.183.76Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_351ec2-54-162-183-76.compute-1.amazonaws.comnan
21104.21.51.169San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_322nanTrue
22100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_313pool-100-37-135-2.nycmny.fios.verizon.netnan
2313.57.64.34Los AngelesCaliforniaAS16509 Amazon.com, Inc.90084United Statestier_37ec2-13-57-64-34.us-west-1.compute.amazonaws.comnan
24104.248.63.231North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_36nannan
25159.65.216.232North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_36nannan
26172.67.155.194San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_35nanTrue
27157.245.130.6North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_35nannan
2834.198.185.176Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_35ec2-34-198-185-176.compute-1.amazonaws.comnan
29192.81.212.192North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_34nannan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website