Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
0260257108402892021-04-0537.48.65.151Chrome
tierdomaincountregistrarname_serversorg
0tier_1hamden.us1GoDaddy.com, LLCns2.commonmx.comNone
1tier_13waycafe.com1DYNADOT, LLCNS1.COMMONMX.COMNone
2tier_1daily-news.us1Dynadot LLCns2.commonmx.comNone
3tier_1brattprincess.us1Communigal Communication Ltdns2.commonmx.comNone
4tier_1anhdep.pro1Dynadot, LLCNS1.COMMONMX.COMNone
5tier_1albionmedical.us1Communigal Communication Ltdns1.commonmx.comNone
6tier_1ecoschools.us1Communigal Communication Ltdns2.commonmx.comNone
7tier_1adrimarie.us1Dynadot LLCns2.commonmx.comNone
8tier_1akadesu.com1NameSnapper LLCNS1.COMMONMX.COMNone
9tier_1bestbuytech.us1Communigal Communication Ltdns2.commonmx.comNone
10tier_21496.rawlexi.com215GoDaddy Online Services Cayman Islands LTDNS-128.AWSDNS-16.COMNone
11tier_2americanlisted.com205ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
12tier_29nl.es51NoneNoneNone
13tier_2newre-conversions.clickmeter.com51REGISTER S.P.A.NS-1498.AWSDNS-59.ORGREDACTED FOR PRIVACY
14tier_2ring.joveo.com51Go Canada Domains, LLCNS-1256.AWSDNS-29.ORGDomains By Proxy, LLC
15tier_2btpnav.com411API GmbHNS1.DNSIMPLE.COMRegistrant of btpnav.com
16tier_2cyneheard-fau.com2Amazon Registrar, Inc.NS-1355.AWSDNS-41.ORGWhois Privacy Service
17tier_2c.pageprotect.net1GoDaddy.com, LLCNS75.DOMAINCONTROL.COMDomains By Proxy, LLC
18tier_211165151.searchiqnet.com1GoDaddy.com, LLCNS57.DOMAINCONTROL.COMDomains By Proxy, LLC
19tier_2click.expmediadirect.com1NAMECHEAP INCNS1.LINODE.COMPrivacy service provided by Withheld for Privacy ehf
20tier_3google.com130MarkMonitor, Inc.NS1.GOOGLE.COMGoogle LLC
21tier_3signup.surveyvoices.com51GoDaddy.com, LLCALEXIS.NS.CLOUDFLARE.COMNone
22tier_3us.tideri.com24united domains AGNS.UDAG.DENone
23tier_3americanlisted.com9ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
24tier_31496.rawlexi.com3GoDaddy Online Services Cayman Islands LTDNS-128.AWSDNS-16.COMNone
25tier_3groupon.com1CSC CORPORATE DOMAINS, INC.A1-192.AKAM.NETGroupon, Inc.
26tier_3contactlensxchange.com1GoDaddy.com, LLCNS1.CONTACTLENSXCHANGE.COMLens Xchange
27tier_3careerbliss.com1GoDaddy.com, LLCNS10.DNSMADEEASY.COMDomains By Proxy, LLC
28tier_3get.privatewebapp.com1NoneNoneNone
29tier_3wayfair.com1MarkMonitor, Inc.A1-100.AKAM.NETWayfair, LLC
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.218WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_145nannan
1207.244.67.216WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_140nannan
2207.244.67.214WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_132nannan
3207.244.67.215WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_129nannan
4206.221.176.184New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_115nannan
5104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_111nannan
6104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_110nannan
7104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_19nannan
8185.107.56.197RotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_14nannan
9185.107.56.199RotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_14nannan
10198.54.112.216San JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_2215nannan
1135.209.61.240Council BluffsIowaAS15169 Google LLC51502United Statestier_2205240.61.209.35.bc.googleusercontent.comnan
12209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_241nannan
1354.197.247.190AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_228ec2-54-197-247-190.compute-1.amazonaws.comnan
1423.21.53.13AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_227ec2-23-21-53-13.compute-1.amazonaws.comnan
1554.235.205.204AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_224ec2-54-235-205-204.compute-1.amazonaws.comnan
1623.21.166.230AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_223ec2-23-21-166-230.compute-1.amazonaws.comnan
1713.225.230.105New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_215server-13-225-230-105.jfk51.r.cloudfront.netnan
1813.225.230.128New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_213server-13-225-230-128.jfk51.r.cloudfront.netnan
1913.225.230.11New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_212server-13-225-230-11.jfk51.r.cloudfront.netnan
20104.21.71.177San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_338nanTrue
21172.217.6.228MillbrookNew YorkAS15169 Google LLC12545United Statestier_326lga25s55-in-f228.1e100.netnan
2235.246.171.123Frankfurt am MainHesseAS15169 Google LLC60311Germanytier_324123.171.246.35.bc.googleusercontent.comnan
23172.217.10.228CliftonNew JerseyAS15169 Google LLC07015United Statestier_322lga25s59-in-f4.1e100.netnan
24172.217.12.196CliftonNew JerseyAS15169 Google LLC07015United Statestier_318lga25s63-in-f4.1e100.netnan
25172.217.10.100CliftonNew JerseyAS15169 Google LLC07015United Statestier_318lga34s15-in-f4.1e100.netnan
26172.217.10.4WestburyNew YorkAS15169 Google LLC11590United Statestier_318lga34s12-in-f4.1e100.netnan
27172.217.165.132Los AngelesCaliforniaAS15169 Google LLC90009United Statestier_315lax30s03-in-f4.1e100.netnan
28172.67.147.244San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_313nanTrue
29172.217.3.100WestburyNew YorkAS15169 Google LLC11590United Statestier_312lga34s18-in-f4.1e100.netnan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website