Malware Discoverer Github Homepage.

Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
0246244109001062021-04-0437.48.65.151Iphone
tierdomaincountregistrarname_serversorg
0tier_1checkvin.us1Communigal Communication Ltdns1.commonmx.comNone
1tier_1merakhitam.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
2tier_1shbwh.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
3tier_1devochki-online.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
4tier_1sextort.net1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0158838419
5tier_1femalesexoffenders.com1NamePal.com #8015, LLCNS1.COMMONMX.COMNone
6tier_1coinpy.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
7tier_1filtersindo.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
8tier_1conectandoalmas.net1SNAPNAMES 6, LLCNS1.COMMONMX.COMNone
9tier_1javfreeporn.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
10tier_21496.wcitianka.com148GoDaddy Online Services Cayman Islands LTDNS-1096.AWSDNS-09.ORGNone
11tier_2americanlisted.com148ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
12tier_29nl.es82NoneNoneNone
13tier_2newre-conversions.clickmeter.com82REGISTER S.P.A.NS-1498.AWSDNS-59.ORGREDACTED FOR PRIVACY
14tier_2ring.joveo.com82Go Canada Domains, LLCNS-1256.AWSDNS-29.ORGDomains By Proxy, LLC
15tier_2api.quotes.com38Internet Domain Service BS Corp.NS-CANADA.TOPDNS.COMWhois Privacy Corp.
16tier_2changeslots.com38Instra Corporation Pty Ltd.CLEO.NS.CLOUDFLARE.COMREDACTED FOR PRIVACY
17tier_2click.expmediadirect.com23NAMECHEAP INCNS1.LINODE.COMPrivacy service provided by Withheld for Privacy ehf
18tier_2api.apptap.com2Amazon Registrar, Inc.NS-1256.AWSDNS-29.ORGWhois Privacy Service
19tier_2redirect.viglink.com2Amazon Registrar, Inc.NS1.VIGLINK.COMWhois Privacy Service
20tier_3signup.surveyvoices.com82GoDaddy.com, LLCALEXIS.NS.CLOUDFLARE.COMNone
21tier_3google.com66MarkMonitor, Inc.NS1.GOOGLE.COMGoogle LLC
22tier_3theconnectvpn.com38DonDominio (SCIP)ARNOLD.NS.CLOUDFLARE.COMSoluciones Corporativas IP, c/o Whois Proxy
23tier_3bestappland.me21NAMECHEAP INCNoneNone
24tier_3reebok.com2CSC CORPORATE DOMAINS, INC.NS1.NETNAMES.NETReebok International, Ltd.
25tier_3fiverr.com1GoDaddy.com, LLCLUCY.NS.CLOUDFLARE.COMFiverr International Limited
26tier_3mbest.aliexpress.com1Alibaba Cloud Computing (Beijing) Co., Ltd.NS1.ALIBABADNS.COMNone
27tier_3alkaskakalka.com1NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMPrivacy service provided by Withheld for Privacy ehf
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.215WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_137nannan
1207.244.67.214WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_128nannan
2207.244.67.216WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_126nannan
3207.244.67.218WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_123nannan
4206.221.176.184New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_119nannan
5104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_118nannan
6104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_113nannan
7104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_16nannan
874.63.241.30DallasTexasAS46475 Limestone Networks, Inc.75270United Statestier_1430-241-63-74.static.reverse.lstn.netnan
982.192.82.228AmsterdamNorth HollandAS60781 LeaseWeb Netherlands B.V.1012Netherlandstier_14nannan
10198.54.112.216San JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_2148nannan
1135.209.61.240Council BluffsIowaAS15169 Google LLC51502United Statestier_2148240.61.209.35.bc.googleusercontent.comnan
1254.197.247.190AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_245ec2-54-197-247-190.compute-1.amazonaws.comnan
1354.235.205.204AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_245ec2-54-235-205-204.compute-1.amazonaws.comnan
145.79.68.236AmsterdamNorth HollandAS60781 LeaseWeb Netherlands B.V.1012Netherlandstier_238nannan
1534.207.32.33AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_238ec2-34-207-32-33.compute-1.amazonaws.comnan
1623.21.166.230AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_237ec2-23-21-166-230.compute-1.amazonaws.comnan
1723.21.53.13AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_237ec2-23-21-53-13.compute-1.amazonaws.comnan
1813.225.230.105New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_226server-13-225-230-105.jfk51.r.cloudfront.netnan
19198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_223nannan
20104.21.71.177San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_350nanTrue
21172.67.147.244San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_332nanTrue
22104.21.91.236San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_321nanTrue
23142.93.4.215North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_321nannan
24172.67.181.234San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_317nanTrue
25172.217.165.132Los AngelesCaliforniaAS15169 Google LLC90009United Statestier_312lax30s03-in-f4.1e100.netnan
26172.217.10.132CliftonNew JerseyAS15169 Google LLC07015United Statestier_312lga34s16-in-f4.1e100.netnan
27172.217.9.228CliftonNew JerseyAS15169 Google LLC07015United Statestier_310lga34s11-in-f4.1e100.netnan
28142.250.64.100Mountain ViewCaliforniaAS15169 Google LLC94043United Statestier_310lga34s31-in-f4.1e100.netnan
29142.250.64.68Mountain ViewCaliforniaAS15169 Google LLC94043United Statestier_37lga34s30-in-f4.1e100.netnan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website