Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
023523383902432021-02-0937.48.65.151Safari
tierdomaincountregistrarname_serversorg
0tier_1piratecrack.info1DYNADOT LLCNS1.COMMONMX.COMNone
1tier_1aiaicili.info1DYNADOT LLCNS1.COMMONMX.COMNone
2tier_1boardof.info1NoneNoneNone
3tier_1humanitarianservice.info1Dynadot, LLCNS1.COMMONMX.COMNone
4tier_1ofkgnhb.info1GoDaddy.com, LLCNS1.COMMONMX.COMNone
5tier_1komikhentai.info1Dynadot, LLCNS1.COMMONMX.COMNone
6tier_1lapharma.info1GoDaddy.com, LLCNS1.COMMONMX.COMNone
7tier_1paramaribo.info1Dynadot, LLCNS1.COMMONMX.COMNone
8tier_1safemeat.info1Dynadot, LLCNS1.COMMONMX.COMNone
9tier_1airconservicing.info1Dynadot, LLCNS1.COMMONMX.COMNone
10tier_2click.expmediadirect.com101NAMECHEAP INCNS1.LINODE.COMWhoisGuard, Inc.
11tier_2dprtb.com821API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
12tier_2rqhere2.com69NAMECHEAP INCJEROME.NS.CLOUDFLARE.COMWhoisGuard, Inc.
13tier_2alfik-fik.com55Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
14tier_21496.wcitianka.com38GoDaddy Online Services Cayman Islands LTDNS-1096.AWSDNS-09.ORGNone
15tier_2americanlisted.com37ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
16tier_2btpnative.com111API GmbHNS1.DNSIMPLE.COMRegistrant of btpnative.com
17tier_2infopicked.com10NAMECHEAP INCNS0.DNSMADEEASY.COMWhoisGuard, Inc.
18tier_2rtbstream.com81API GmbHNS1.DNSIMPLE.COMRegistrant of rtbstream.com
19tier_2search.eproute.info8GoDaddy.com, LLCNS22.DOMAINCONTROL.COMDomains By Proxy, LLC
20tier_3generouscare.info69GoDaddy.com, LLCMOLLY.NS.CLOUDFLARE.COMNone
21tier_3irl.com49GoDaddy.com, LLCNS-106.AWSDNS-13.COMDomains By Proxy, LLC
22tier_3us.tideri.com37united domains AGNS.UDAG.DENone
23tier_3thefatburner.info19GoDaddy.com, LLCMOLLY.NS.CLOUDFLARE.COMNone
24tier_3searchfrequently.com8GoDaddy.com, LLCNEIL.NS.CLOUDFLARE.COMDomains By Proxy, LLC
25tier_3iosrecommendedvpn.com5NoneNoneNone
26tier_3kbb.com3CSC CORPORATE DOMAINS, INC.PDNS164.ULTRADNS.BIZAutotrader.com
27tier_3netradioplayer.com2GoDaddy.com, LLCNS41.DOMAINCONTROL.COMDomains By Proxy, LLC
28tier_3peachsecureus.com2NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
29tier_3squirt.org1NAMECHEAP INCNS5.DNSMADEEASY.COMWhoisGuard, Inc.
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_149nannan
1207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_132nannan
2207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_126nannan
3206.221.176.184NewarkNew JerseyAS23470 ReliableSite.Net LLC07175United Statestier_115nannan
4104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_112nannan
5104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_112nannan
6104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_111nannan
737.48.65.148SoestUtrechtAS60781 LeaseWeb Netherlands B.V.3765Netherlandstier_16nannan
8185.107.56.199AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_15nannan
937.48.65.151SoestUtrechtAS60781 LeaseWeb Netherlands B.V.3765Netherlandstier_15nannan
10198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_2102nannan
11209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_2101nannan
12167.99.3.175North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_269nannan
13198.54.112.216San JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_240nannan
1435.209.61.240Council BluffsIowaAS15169 Google LLC51502United Statestier_237240.61.209.35.bc.googleusercontent.comnan
1554.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_228ec2-54-84-27-165.compute-1.amazonaws.comnan
1634.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_227ec2-34-200-146-95.compute-1.amazonaws.comnan
17173.192.101.24DallasTexasAS36351 SoftLayer Technologies Inc.75270United Statestier_21118.65.c0ad.ip4.static.sl-reverse.comnan
1834.210.173.239PortlandOregonAS16509 Amazon.com, Inc.97207United Statestier_26ec2-34-210-173-239.us-west-2.compute.amazonaws.comnan
19149.28.63.209New York CityNew YorkAS20473 Choopa, LLC10004United Statestier_25149.28.63.209.vultr.comnan
20172.67.207.224San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_346nanTrue
2135.246.171.123Frankfurt am MainHesseAS15169 Google LLC60311Germanytier_337123.171.246.35.bc.googleusercontent.comnan
22104.21.22.245San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_323nanTrue
23172.67.218.143San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_316nanTrue
2413.56.125.91Los AngelesCaliforniaAS16509 Amazon.com, Inc.90084United Statestier_38ec2-13-56-125-91.us-west-1.compute.amazonaws.comnan
25159.65.216.232North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_37nannan
26192.81.212.192North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_35nannan
27104.248.60.43North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_35nannan
28104.21.8.61San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_35nanTrue
29100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_35pool-100-37-135-2.nycmny.fios.verizon.netnan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website