Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
024624798001042021-02-1437.48.65.151Android
tierdomaincountregistrarname_serversorg
0tier_1animestorm.net1Noteworthydomains, LLCNS1.COMMONMX.COMNone
1tier_1decimalindustries.com1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0159846547
2tier_1beritake.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
3tier_1boost.asia1DYNADOT LLCNS1.COMMONMX.COMNone
4tier_1freedom-251.in1Dynadot LLCns1.commonmx.comNone
5tier_1deadchicksarecoolmodels.com1CommuniGal Communication Ltd.NS1.COMMONMX.COMNone
6tier_1frozenroms.in1Dynadot LLCns1.commonmx.comNone
7tier_1bangaloreonlinemall.com1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0158853938
8tier_1amritsarcorp.in1Dynadot LLCns1.commonmx.comNone
9tier_1bexindonesia.com1Domaintimemachine.com LLCNS1.COMMONMX.COMNone
10tier_2alfik-fik.com144Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
11tier_2dprtb.com1271API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
12tier_2atnpx.com119GoDaddy.com, LLCBECKY.NS.CLOUDFLARE.COMDomains By Proxy, LLC
13tier_2click.expmediadirect.com23NAMECHEAP INCNS1.LINODE.COMWhoisGuard, Inc.
14tier_2rtbstream.com151API GmbHNS1.DNSIMPLE.COMRegistrant of rtbstream.com
15tier_2search.eproute.info15GoDaddy.com, LLCNS22.DOMAINCONTROL.COMDomains By Proxy, LLC
16tier_2trackyourmpg.com13GoDaddy Online Services Cayman Islands LTDHUGH.NS.CLOUDFLARE.COMNone
17tier_2btpnative.com111API GmbHNS1.DNSIMPLE.COMRegistrant of btpnative.com
18tier_2media-px.com11GoDaddy.com, LLCBECKY.NS.CLOUDFLARE.COMDomains By Proxy, LLC
19tier_2servedby.flashtalking.com11MESH DIGITAL LIMITEDNS1.P09.DYNECT.NETFlashtalking, Inc.
20tier_3kbb.com104CSC CORPORATE DOMAINS, INC.PDNS164.ULTRADNS.BIZAutotrader.com
21tier_3robogarden.io15GoDaddy.com, LLCBECKY.NS.CLOUDFLARE.COMNone
22tier_3m.placesiteb.xyz11Sav.comLLCHUGH.NS.CLOUDFLARE.COMPrivacy Protection
23tier_3socalhondadealers.com11NoneNoneNone
24tier_3happymakesite.xyz9Epik LLCMARJORY.NS.CLOUDFLARE.COMAnonymize, Inc.
25tier_3findoffers.co8Key-Systems GmbHns4.monikerdns.netMoniker Privacy Services
26tier_3searchfrequently.com7GoDaddy.com, LLCNEIL.NS.CLOUDFLARE.COMDomains By Proxy, LLC
27tier_3macys.com4Network Solutions, LLCA1-135.AKAM.NETMacy's Systems and Technology, Inc.
28tier_3win2.trustedpush.com2NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
29tier_3win1.trustedpush.com2NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_135nannan
1207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_134nannan
2207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_129nannan
3104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_119nannan
4206.221.176.184New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_110nannan
5104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_19nannan
6104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_19nannan
7185.107.56.199AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_14nannan
8185.107.56.200AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_13nannan
937.48.65.151SoestUtrechtAS60781 LeaseWeb Netherlands B.V.3765Netherlandstier_13nannan
10209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_2157nannan
1154.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_286ec2-54-84-27-165.compute-1.amazonaws.comnan
1234.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_263ec2-34-200-146-95.compute-1.amazonaws.comnan
13172.67.74.77San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_247nanTrue
14104.26.11.53San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_241nanTrue
15104.26.10.53San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_231nanTrue
16198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_223nannan
17192.138.218.207SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_213rd.bizrate.comnan
18173.192.101.24DallasTexasAS36351 SoftLayer Technologies Inc.75270United Statestier_21118.65.c0ad.ip4.static.sl-reverse.comnan
19104.18.24.3San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_210nanTrue
2023.36.197.209PhiladelphiaPennsylvaniaAS16625 Akamai Technologies, Inc.19099United Statestier_358a23-36-197-209.deploy.static.akamaitechnologies.comnan
2123.66.194.233New York CityNew YorkAS16625 Akamai Technologies, Inc.10004United Statestier_337a23-66-194-233.deploy.static.akamaitechnologies.comnan
22172.67.172.143San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_313nanTrue
2323.44.217.143NewarkNew JerseyAS16625 Akamai Technologies, Inc.07175United Statestier_39a23-44-217-143.deploy.static.akamaitechnologies.comnan
2434.207.4.240Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_39ec2-34-207-4-240.compute-1.amazonaws.comnan
25104.18.80.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_38nanTrue
2618.190.1.57ColumbusOhioAS16509 Amazon.com, Inc.43219United Statestier_38ec2-18-190-1-57.us-east-2.compute.amazonaws.comnan
27104.18.78.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_37nanTrue
28104.21.8.61San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_36nanTrue
29100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_34pool-100-37-135-2.nycmny.fios.verizon.netnan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website