Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
022922683401422021-03-0837.48.65.151Chrome
tierdomaincountregistrarname_serversorg
0tier_1funnydognames.us1Dynadot LLCns1.commonmx.comNone
1tier_1neverwinter.us1Communigal Communication Ltdns2.commonmx.comNone
2tier_1comefly.us1Communigal Communication Ltdns2.commonmx.comNone
3tier_1detox-cleanse.us1Communigal Communication Ltdns2.commonmx.comNone
4tier_1massimo.us1Communigal Communication Ltdns2.commonmx.comNone
5tier_1rendition.us1Communigal Communication Ltdns2.commonmx.comNone
6tier_1drinkfinity.us1Communigal Communication Ltdns2.commonmx.comNone
7tier_1animefrost.us1GoDaddy.com, LLCns2.commonmx.comNone
8tier_1holeinthewall.us1Dynadot LLCns2.commonmx.comNone
9tier_1japri.us1GoDaddy.com, LLCns1.commonmx.comNone
10tier_2click.expmediadirect.com57NAMECHEAP INCNS1.LINODE.COMWhoisGuard, Inc.
11tier_2dprtb.com561API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
12tier_21496.wcitianka.com36GoDaddy Online Services Cayman Islands LTDNS-1096.AWSDNS-09.ORGNone
13tier_2americanlisted.com34ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
14tier_2click.appcast.io33101Domain GRS LtdNS-85.AWSDNS-10.COMNone
15tier_2traff0121.com23NAMECHEAP INCHANS.NS.CLOUDFLARE.COMWhoisGuard, Inc.
16tier_2luckymedia.website23NoneNoneNone
17tier_20.luckymedia.website23NoneNoneNone
18tier_21.luckymedia.website22NoneNoneNone
19tier_2alfik-fik.com20Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
20tier_3careerbuilder.com29CSC CORPORATE DOMAINS, INC.BROCK.CBJOBS.NETCareerBuilder, LLC
21tier_3thecryptomoney.info18GoDaddy.com, LLCMOLLY.NS.CLOUDFLARE.COMNone
22tier_3lasatlantispromos.com14DYNADOT, LLCBELLA.NS.CLOUDFLARE.COMNone
23tier_3mergerinvesting.com14NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
24tier_3install.pdfsearchweb.com6GoDaddy.com, LLCISLA.NS.CLOUDFLARE.COMDomains By Proxy, LLC
25tier_3bainushe.com6URL SOLUTIONS INC.NS-1108.AWSDNS-10.ORGGLOBAL DOMAIN PRIVACY SERVICES INC
26tier_32.luckymedia.website4NoneNoneNone
27tier_3install.searchconverterpro.com4GoDaddy.com, LLCISLA.NS.CLOUDFLARE.COMDomains By Proxy, LLC
28tier_3encontextmedia.com4NAMECHEAP INCNS1.ENCONTEXT.COMWhoisGuard, Inc.
29tier_3filter.onwardclick.com3NAMECHEAP INCNS1.ENCONTEXT.COMWhoisGuard, Inc.
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.218ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_126nannan
1207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_125nannan
2207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_123nannan
3207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_121nannan
463.143.32.85DallasTexasAS46475 Limestone Networks, Inc.75270United Statestier_1385-32-143-63.static.reverse.lstn.netnan
574.63.241.25Los AngelesCaliforniaAS46475 Limestone Networks, Inc.90009United Statestier_1225-241-63-74.static.reverse.lstn.netnan
674.63.241.30Los AngelesCaliforniaAS46475 Limestone Networks, Inc.90009United Statestier_1230-241-63-74.static.reverse.lstn.netnan
763.143.32.90DallasTexasAS46475 Limestone Networks, Inc.75270United Statestier_1290-32-143-63.static.reverse.lstn.netnan
882.192.82.225AmsterdamNorth HollandAS60781 LeaseWeb Netherlands B.V.1012Netherlandstier_12nannan
9185.107.56.200RotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_12nannan
10178.62.225.201AmsterdamNorth HollandAS14061 DigitalOcean, LLC1012Netherlandstier_37nannan
11209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_262nannan
12198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_257nannan
1388.99.101.106Hohen NeuendorfBrandenburgAS24940 Hetzner Online GmbH16540Germanytier_239static.106.101.99.88.clients.your-server.denan
14198.54.112.216San JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_236nannan
1535.209.61.240Council BluffsIowaAS15169 Google LLC51502United Statestier_234240.61.209.35.bc.googleusercontent.comnan
16173.239.53.32New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_222nannan
17139.45.197.237MoscowMoscowAS9002 RETN Limited125190Russiatier_218nannan
1895.217.204.250TuusulaUusimaaAS24940 Hetzner Online GmbH04360Finlandtier_216static.250.204.217.95.clients.your-server.denan
1934.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_215ec2-34-200-146-95.compute-1.amazonaws.comnan
2045.55.189.248CliftonNew JerseyAS14061 DigitalOcean, LLC07014United Statestier_314nannan
21104.21.42.202San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_312nanTrue
22104.21.4.23San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_38nanTrue
23178.62.225.201AmsterdamNorth HollandAS14061 DigitalOcean, LLC1012Netherlandstier_37nannan
2413.225.229.46New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_36server-13-225-229-46.jfk51.r.cloudfront.netnan
25172.67.210.14San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_36nanTrue
26172.67.131.144San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_36nanTrue
27139.45.197.239MoscowMoscowAS9002 RETN Limited125190Russiatier_36nannan
2813.225.229.80New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_35server-13-225-229-80.jfk51.r.cloudfront.netnan
2913.225.229.5New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_35server-13-225-229-5.jfk51.r.cloudfront.netnan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website