Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
022823191611412021-03-0637.48.65.151Android
tierdomaincountregistrarname_serversorg
0tier_1alpargatas.co1Communi Gal Communications Ltd.ns2.commonmx.comNone
1tier_1habc.co.in1Dynadot LLCns1.commonmx.comNone
2tier_1oktoberfest.asia1DYNADOT LLCNS1.COMMONMX.COMNone
3tier_1a-r-c.co1Communi Gal Communications Ltd.ns2.commonmx.comNone
4tier_1amaduras.co1Communi Gal Communications Ltd.ns2.commonmx.comNone
5tier_1bluehawk.in1Dynadot LLCns1.commonmx.comNone
6tier_1carees.in1Dynadot LLCns1.commonmx.comNone
7tier_1homemadeonline.in1Dynadot LLCns1.commonmx.comNone
8tier_1hdmobi.in1Dynadot LLCns1.commonmx.comNone
9tier_1apknyot.info1DYNADOT LLCNS1.COMMONMX.COMNone
10tier_2alfik-fik.com167Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
11tier_2dprtb.com1601API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
12tier_2atnpx.com147GoDaddy.com, LLCBECKY.NS.CLOUDFLARE.COMDomains By Proxy, LLC
13tier_2ad.doubleclick.net21MarkMonitor, Inc.NS1.GOOGLE.COMGoogle Inc.
14tier_2btpnative.com71API GmbHNS1.DNSIMPLE.COMRegistrant of btpnative.com
15tier_2infopicked.com6NAMECHEAP INCNS0.DNSMADEEASY.COMWhoisGuard, Inc.
16tier_262252.click.validclick.net6Safenames LtdNS1.FULLMAILBOX.COMNone
17tier_22893.wcitianka.com5GoDaddy Online Services Cayman Islands LTDNS-1096.AWSDNS-09.ORGNone
18tier_2awakeningsco.com5GoDaddy Online Services Cayman Islands LTDHUGH.NS.CLOUDFLARE.COMNone
19tier_2blog.sfgate.com5CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Communications, Inc.
20tier_3kbb.com112CSC CORPORATE DOMAINS, INC.PDNS164.ULTRADNS.BIZAutotrader.com
21tier_3robogarden.io35GoDaddy.com, LLCBECKY.NS.CLOUDFLARE.COMNone
22tier_3storystudio.sfgate.com15CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Communications, Inc.
23tier_3happymakesite.xyz3Epik LLCMARJORY.NS.CLOUDFLARE.COMAnonymize, Inc.
24tier_3m.placesiteb.xyz2Sav.comLLCHUGH.NS.CLOUDFLARE.COMPrivacy Protection
25tier_3irl.com2GoDaddy.com, LLCNS-106.AWSDNS-13.COMDomains By Proxy, LLC
26tier_3win1.trustedpush.com1NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
27tier_3bing.com1MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
28tier_3store.acer.com1Eurodns S.A.NS1.ACER.COMAcer Incorporated
29tier_3ancestry.com1NoneNoneNone
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.218ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_129nannan
1207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_125nannan
2207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_116nannan
3207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_115nannan
4104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_115nannan
5104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_114nannan
6206.221.176.184WillingboroNew JerseyAS23470 ReliableSite.Net LLC08046United Statestier_111nannan
7104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_19nannan
882.192.82.227AmsterdamNorth HollandAS60781 LeaseWeb Netherlands B.V.1012Netherlandstier_15nannan
9185.107.56.199AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_14nannan
10209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_2167nannan
1154.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_290ec2-54-84-27-165.compute-1.amazonaws.comnan
12172.67.74.77San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_290nanTrue
1334.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_278ec2-34-200-146-95.compute-1.amazonaws.comnan
14104.26.10.53San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_230nanTrue
15104.26.11.53San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_227nanTrue
16204.44.79.214Los AngelesCaliforniaAS8100 QuadraNet Enterprises LLC90014United Statestier_216204.44.79.214.static.quadranet.comnan
17173.192.101.24DallasTexasAS36351 SoftLayer Technologies Inc.75270United Statestier_2718.65.c0ad.ip4.static.sl-reverse.comnan
18198.54.112.216San JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_25nannan
19151.101.0.200San FranciscoCaliforniaAS54113 Fastly94107United Statestier_25nanTrue
2023.44.217.143NewarkNew JerseyAS16625 Akamai Technologies, Inc.07175United Statestier_3112a23-44-217-143.deploy.static.akamaitechnologies.comnan
21172.67.172.143San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_318nanTrue
22104.21.80.8San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_317nanTrue
2398.129.228.57DallasTexasAS33070 Rackspace Hosting75270United Statestier_315nannan
24104.18.81.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_32nanTrue
25104.18.78.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_32nanTrue
26104.18.80.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_31nanTrue
27167.172.139.120North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_31nannan
2813.225.65.102NewarkNew JerseyAS16509 Amazon.com, Inc.07175United Statestier_31server-13-225-65-102.ewr53.r.cloudfront.netnan
2913.107.21.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_31nanTrue

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website