Malware Discoverer Github Homepage.

Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
02362368010482021-04-0437.48.65.151Safari
tierdomaincountregistrarname_serversorg
0tier_1merakhitam.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
1tier_1shbwh.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
2tier_1sextort.net1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0158838419
3tier_1femalesexoffenders.com1NamePal.com #8015 Inc.NS1.COMMONMX.COMNone
4tier_1coinpy.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
5tier_1filtersindo.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
6tier_1conectandoalmas.net1eNom1 Inc.NS1.COMMONMX.COMNone
7tier_1celebrityplastic.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
8tier_1fotofaza.net1TUCOWS, INC.NS1.COMMONMX.COMContact Privacy Inc. Customer 0159163238
9tier_1baltimorephotoboothrentals.com1GoDaddy.com, LLCNS1.COMMONMX.COMDomains By Proxy, LLC
10tier_21496.wcitianka.com100NoneNoneNone
11tier_2americanlisted.com100ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
12tier_2btpnav.com381API GmbHNS1.DNSIMPLE.COMRegistrant of btpnav.com
13tier_29nl.es28NoneNoneNone
14tier_2newre-conversions.clickmeter.com28REGISTER S.P.A.NS-1498.AWSDNS-59.ORGREDACTED FOR PRIVACY
15tier_2ring.joveo.com25Go Canada Domains, LLCNS-1256.AWSDNS-29.ORGDomains By Proxy, LLC
16tier_2us.expand-backend.mindmatch.ai22NoneNoneNone
17tier_2nizephoros-pom.com12Amazon Registrar, Inc.NS-1192.AWSDNS-21.ORGWhois Privacy Service
18tier_2us.allthetopbananas.com9ENOM, INC.DANE.NS.CLOUDFLARE.COMREDACTED FOR PRIVACY
19tier_2managerformula.com8NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMPrivacy service provided by Withheld for Privacy ehf
20tier_3btpnav.com55NoneNoneNone
21tier_3google.com38MarkMonitor, Inc.NS1.GOOGLE.COMGoogle LLC
22tier_3signup.surveyvoices.com21GoDaddy.com, LLCALEXIS.NS.CLOUDFLARE.COMNone
23tier_3us.allthetopbananas.com9ENOM, INC.DANE.NS.CLOUDFLARE.COMREDACTED FOR PRIVACY
24tier_3s3.amazonaws.com8MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
25tier_3careers.homedepot.com5CSC CORPORATE DOMAINS, INC.A1-27.AKAM.NETHome Depot Product Authority, LLC
26tier_3stewartdailyalerts.com4GoDaddy.com, LLCNS-1232.AWSDNS-26.ORGDomains By Proxy, LLC
27tier_3homeadvisorpros.com3GoDaddy.com, LLCARYA.NS.CLOUDFLARE.COMService Magic Inc
28tier_3managerformula.com3NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMPrivacy service provided by Withheld for Privacy ehf
29tier_3emily-recruiter.com3GoDaddy.com, LLCNS17.DOMAINCONTROL.COMDomains By Proxy, LLC
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.218WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_128nannan
1207.244.67.214WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_127nannan
2207.244.67.215WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_124nannan
3207.244.67.216WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_122nannan
4104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_116nannan
5104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_112nannan
6206.221.176.184New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_19nannan
7104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_16nannan
837.48.65.150SoestUtrechtAS60781 LeaseWeb Netherlands B.V.3765Netherlandstier_14nannan
982.192.82.226AmsterdamNorth HollandAS60781 LeaseWeb Netherlands B.V.1012Netherlandstier_13nannan
10198.54.112.216San JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_2100nannan
1135.209.61.240Council BluffsIowaAS15169 Google LLC51502United Statestier_2100240.61.209.35.bc.googleusercontent.comnan
12209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_354nannan
1334.120.235.106Kansas CityMissouriAS15169 Google LLC64121United Statestier_222106.235.120.34.bc.googleusercontent.comTrue
1454.197.247.190AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_215ec2-54-197-247-190.compute-1.amazonaws.comnan
1554.235.205.204AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_215ec2-54-235-205-204.compute-1.amazonaws.comnan
1623.21.53.13AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_213ec2-23-21-53-13.compute-1.amazonaws.comnan
1723.21.166.230AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_213ec2-23-21-166-230.compute-1.amazonaws.comnan
1854.84.27.165AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_211ec2-54-84-27-165.compute-1.amazonaws.comnan
1913.225.230.122New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_211server-13-225-230-122.jfk51.r.cloudfront.netnan
20209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_354nannan
21104.21.71.177San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_312nanTrue
22172.67.147.244San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_39nanTrue
23172.217.10.132CliftonNew JerseyAS15169 Google LLC07015United Statestier_37lga34s16-in-f4.1e100.netnan
24104.26.13.236San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_37nanTrue
25142.250.64.68Mountain ViewCaliforniaAS15169 Google LLC94043United Statestier_36lga34s30-in-f4.1e100.netnan
26172.217.11.36New York CityNew YorkAS15169 Google LLC10004United Statestier_36lga25s61-in-f4.1e100.netnan
27172.217.7.4MillbrookNew YorkAS15169 Google LLC12545United Statestier_35lga25s56-in-f4.1e100.netnan
28172.217.165.132Los AngelesCaliforniaAS15169 Google LLC90009United Statestier_35lax30s03-in-f4.1e100.netnan
29142.250.80.4New York CityNew YorkAS15169 Google LLC10004United Statestier_35lga34s33-in-f4.1e100.netnan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website