Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
02692741577052021-03-0937.48.65.151Android
tierdomaincountregistrarname_serversorg
0tier_1learnbuddy.info1DYNADOT LLCNS1.COMMONMX.COMNone
1tier_1zmaj.info1Dynadot, LLCNS1.COMMONMX.COMNone
2tier_1saxenda.info1Dynadot, LLCNS1.COMMONMX.COMNone
3tier_1livred.info1GoDaddy.com, LLCNS1.COMMONMX.COMNone
4tier_1thlist.info1GoDaddy.com, LLCNS1.COMMONMX.COMNone
5tier_1technewshunt24.info1GoDaddy.com, LLCNS1.COMMONMX.COMNone
6tier_1vast-scoop-to-carrygoing-forth.info1GoDaddy.com, LLCNS1.COMMONMX.COMNone
7tier_19kmovies.info1GoDaddy.com, LLCNS1.COMMONMX.COMNone
8tier_1bloem.info1Dynadot, LLCNS1.COMMONMX.COMNone
9tier_1madagasikara.info1Dynadot, LLCNS1.COMMONMX.COMNone
10tier_2dprtb.com1371API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
11tier_2alfik-fik.com102Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
12tier_2ads35.adtelligent.com62DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
13tier_2dsp35.adtelligent.com62DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
14tier_2aibm1.mysearch.space62NoneNoneNone
15tier_2externals-1953518744.us-east-1.elb.amazonaws.com62MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
16tier_2search.snjsearch.com62GoDaddy.com, LLCNS73.DOMAINCONTROL.COMDomains By Proxy, LLC
17tier_2nicanor-the.com60Amazon Registrar, Inc.NS-1242.AWSDNS-27.ORGWhois Privacy Service
18tier_2get.popplunder.com58NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
19tier_2trustedpush.com58NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
20tier_3bing.com62MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
21tier_3storystudio.sfgate.com20CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Communications, Inc.
22tier_3win4.trustedpush.com17NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
23tier_3win5.trustedpush.com16NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
24tier_3win3.trustedpush.com15NoneNoneNone
25tier_3b.delightcmain.xyz14Epik LLCMARJORY.NS.CLOUDFLARE.COMAnonymize, Inc.
26tier_3happymakesite.xyz9Epik LLCMARJORY.NS.CLOUDFLARE.COMAnonymize, Inc.
27tier_3win6.trustedpush.com8NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
28tier_3m.fastspotb.xyz8Sav.comLLCHUGH.NS.CLOUDFLARE.COMPrivacy Protection
29tier_3m.placesiteb.xyz7Sav.comLLCHUGH.NS.CLOUDFLARE.COMPrivacy Protection
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_131nannan
1207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_127nannan
2207.244.67.218ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_126nannan
3207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_126nannan
4104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_117nannan
5104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_114nannan
6206.221.176.184WillingboroNew JerseyAS23470 ReliableSite.Net LLC08046United Statestier_19nannan
7104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_18nannan
8185.107.56.197RotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_16nannan
974.63.241.29Los AngelesCaliforniaAS46475 Limestone Networks, Inc.90009United Statestier_1329-241-63-74.static.reverse.lstn.netnan
1099.84.120.110NewarkNew JerseyAS16509 Amazon.com, Inc.07175United Statestier_2141server-99-84-120-110.ewr52.r.cloudfront.netnan
11209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_2139nannan
1234.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_282ec2-34-200-146-95.compute-1.amazonaws.comnan
1354.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_280ec2-54-84-27-165.compute-1.amazonaws.comnan
14209.205.202.42New York CityNew YorkAS55081 24 SHELLS10004United Statestier_262static-42-202-205-209.24shells.netnan
15209.205.202.43New York CityNew YorkAS55081 24 SHELLS10004United Statestier_262static-43-202-205-209.24shells.netnan
1635.162.164.74PortlandOregonAS16509 Amazon.com, Inc.97256United Statestier_262ec2-35-162-164-74.us-west-2.compute.amazonaws.comnan
1734.199.180.187Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_258ec2-34-199-180-187.compute-1.amazonaws.comnan
18192.241.229.243San FranciscoCaliforniaAS14061 DigitalOcean, LLC94124United Statestier_241nannan
1954.210.170.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_240ec2-54-210-170-165.compute-1.amazonaws.comnan
20100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_339pool-100-37-135-2.nycmny.fios.verizon.netnan
21204.79.197.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_327a-0001.a-msedge.netTrue
2298.129.228.57DallasTexasAS33070 Rackspace Hosting75270United Statestier_320nannan
2313.107.21.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_316nanTrue
24104.18.81.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_313nanTrue
25104.18.80.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_311nanTrue
26131.253.33.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_310a-0001.dc-msedge.netTrue
27104.18.82.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_310nanTrue
28104.18.78.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_39nanTrue
2913.107.22.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_39nanTrue

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website