Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
025826299001402021-03-0937.48.65.151Iphone
tierdomaincountregistrarname_serversorg
0tier_1learnbuddy.info1DYNADOT LLCNS1.COMMONMX.COMNone
1tier_1zmaj.info1DYNADOT LLCNS1.COMMONMX.COMNone
2tier_1saxenda.info1Dynadot, LLCNS1.COMMONMX.COMNone
3tier_1livred.info1GoDaddy.com, LLCNS1.COMMONMX.COMNone
4tier_1thlist.info1GoDaddy.com, LLCNS1.COMMONMX.COMNone
5tier_1technewshunt24.info1GoDaddy.com, LLCNS1.COMMONMX.COMNone
6tier_1vast-scoop-to-carrygoing-forth.info1GoDaddy.com, LLCNS1.COMMONMX.COMNone
7tier_19kmovies.info1GoDaddy.com, LLCNS1.COMMONMX.COMNone
8tier_1batteri.info1Dynadot, LLCNS1.COMMONMX.COMNone
9tier_1bloem.info1Dynadot, LLCNS1.COMMONMX.COMNone
10tier_2click.expmediadirect.com110NAMECHEAP INCNS1.LINODE.COMWhoisGuard, Inc.
11tier_2changeslots.com59Instra Corporation Pty Ltd.CLEO.NS.CLOUDFLARE.COMREDACTED FOR PRIVACY
12tier_2btpnative.com521API GmbHNS1.DNSIMPLE.COMRegistrant of btpnative.com
13tier_2infopicked.com49NoneNoneNone
14tier_2p274639.infopicked.com48NAMECHEAP INCNS0.DNSMADEEASY.COMWhoisGuard, Inc.
15tier_2clk.rtpdn12.com31NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
16tier_2rqhere2.com28NAMECHEAP INCJEROME.NS.CLOUDFLARE.COMWhoisGuard, Inc.
17tier_2dprtb.com271API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
18tier_2top-conttent.com18NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
19tier_2trackanchor.com18NoneNoneNone
20tier_3bestappland.me64NoneNoneNone
21tier_3theconnectvpn.com59DonDominio (SCIP)ARNOLD.NS.CLOUDFLARE.COMSoluciones Corporativas IP, c/o Whois Proxy
22tier_3iosrecommendedvpn.com18NoneNoneNone
23tier_3glbltraffic.com_LOOP_114NoneNoneNone
24tier_3intimepoint.com9GoDaddy.com, LLCNS25.DOMAINCONTROL.COMInfo Bridge Ltd
25tier_3storystudio.sfgate.com8CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Communications, Inc.
26tier_3minecraft.net6TUCOWS, INC.NS-1395.AWSDNS-46.ORGContact Privacy Inc. Customer 0120735043
27tier_3play.google.com6MarkMonitor, Inc.NS1.GOOGLE.COMGoogle LLC
28tier_3glbltraffic.com4NAMECHEAP INCNS1.DIGITALOCEAN.COMWhoisGuard, Inc.
29tier_3ad.monetizer.co4NoneNoneNone
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.214ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_137nannan
1207.244.67.218ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_131nannan
2207.244.67.215ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_125nannan
3207.244.67.216ManassasVirginiaAS30633 Leaseweb USA, Inc.20108United Statestier_123nannan
4104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_115nannan
5104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_113nannan
6104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_110nannan
7185.107.56.197RotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_16nannan
882.192.82.225AmsterdamNorth HollandAS60781 LeaseWeb Netherlands B.V.1012Netherlandstier_16nannan
9206.221.176.184WillingboroNew JerseyAS23470 ReliableSite.Net LLC08046United Statestier_14nannan
10198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_2110nannan
11173.192.101.24DallasTexasAS36351 SoftLayer Technologies Inc.75270United Statestier_210018.65.c0ad.ip4.static.sl-reverse.comnan
12209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_279nannan
1334.207.32.33Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_259ec2-34-207-32-33.compute-1.amazonaws.comnan
14173.239.53.32New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_244nannan
15167.99.3.175North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_228nannan
16100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_332pool-100-37-135-2.nycmny.fios.verizon.netnan
1754.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_218ec2-54-84-27-165.compute-1.amazonaws.comnan
1834.226.252.28Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_218ec2-34-226-252-28.compute-1.amazonaws.comnan
19149.28.63.209New York CityNew YorkAS20473 The Constant Company, LLC10004United Statestier_218149.28.63.209.vultr.comnan
20142.93.4.215North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_364nannan
21172.67.181.234San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_333nanTrue
22100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_332pool-100-37-135-2.nycmny.fios.verizon.netnan
23104.21.91.236San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_326nanTrue
24178.128.246.195AmsterdamNorth HollandAS14061 DigitalOcean, LLC1012Netherlandstier_39nannan
2598.129.228.57DallasTexasAS33070 Rackspace Hosting75270United Statestier_38nannan
2623.197.193.32NewarkNew JerseyAS20940 Akamai International B.V.07175United Statestier_34a23-197-193-32.deploy.static.akamaitechnologies.comnan
2764.227.11.5North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_34nannan
28172.217.10.14WestburyNew YorkAS15169 Google LLC11590United Statestier_34lga34s12-in-f14.1e100.netnan
29108.163.203.125ChicagoIllinoisAS32475 SingleHop LLC60666United Statestier_34server04.com-2.mobinan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website