Malware Discoverer Github Homepage.

Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
023723591102702021-04-0537.48.65.151Iphone
tierdomaincountregistrarname_serversorg
0tier_13waycafe.com1DYNADOT, LLCNS1.COMMONMX.COMNone
1tier_1daily-news.us1Dynadot LLCns2.commonmx.comNone
2tier_1brattprincess.us1Communigal Communication Ltdns2.commonmx.comNone
3tier_1ecoschools.us1Communigal Communication Ltdns2.commonmx.comNone
4tier_1akadesu.com1NameSnapper LLCNS1.COMMONMX.COMNone
5tier_1bestbuytech.us1Communigal Communication Ltdns2.commonmx.comNone
6tier_1endominicana.net1GoDaddy.com, LLCNS1.COMMONMX.COMNone
7tier_1cheapjordans.us1Communigal Communication Ltdns2.commonmx.comNone
8tier_1hao678.info1Dynadot, LLCNS1.COMMONMX.COMNone
9tier_1drsureshshuklachandra.com1GoDaddy.com, LLCNS1.COMMONMX.COMNone
10tier_21496.rawlexi.com108GoDaddy Online Services Cayman Islands LTDNS-128.AWSDNS-16.COMNone
11tier_2americanlisted.com107ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
12tier_29nl.es55NoneNoneNone
13tier_2newre-conversions.clickmeter.com55REGISTER S.P.A.NS-1498.AWSDNS-59.ORGREDACTED FOR PRIVACY
14tier_2ring.joveo.com55Go Canada Domains, LLCNS-1256.AWSDNS-29.ORGDomains By Proxy, LLC
15tier_2click.expmediadirect.com50NAMECHEAP INCNS1.LINODE.COMPrivacy service provided by Withheld for Privacy ehf
16tier_2changeslots.com22Instra Corporation Pty Ltd.CLEO.NS.CLOUDFLARE.COMREDACTED FOR PRIVACY
17tier_2api.quotes.com18Internet Domain Service BS Corp.NS-CANADA.TOPDNS.COMWhois Privacy Corp.
18tier_2trackanchor.com8NAMECHEAP INCHAL.NS.CLOUDFLARE.COMRedacted for Privacy Purposes
19tier_2clk.rtpdn12.com7NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMPrivacy service provided by Withheld for Privacy ehf
20tier_3signup.surveyvoices.com55GoDaddy.com, LLCALEXIS.NS.CLOUDFLARE.COMNone
21tier_3google.com52MarkMonitor, Inc.NS1.GOOGLE.COMGoogle LLC
22tier_3bestappland.me30NAMECHEAP INCNoneNone
23tier_3theconnectvpn.com22DonDominio (SCIP)ARNOLD.NS.CLOUDFLARE.COMSoluciones Corporativas IP, c/o Whois Proxy
24tier_3alkaskakalka.com9NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMPrivacy service provided by Withheld for Privacy ehf
25tier_3vpnupdatesnow.com8NAMECHEAP INCHAL.NS.CLOUDFLARE.COMPrivacy service provided by Withheld for Privacy ehf
26tier_3apple.com3CSC CORPORATE DOMAINS, INC.A.NS.APPLE.COMApple Inc.
27tier_3us.norton.com1MarkMonitor, Inc.PDNS1.ULTRADNS.NETNortonLifeLock Inc
28tier_3contactlensxchange.com1GoDaddy.com, LLCNS1.CONTACTLENSXCHANGE.COMLens Xchange
29tier_3macys.com_LOOP_11NoneNoneNone
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0207.244.67.218WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_130nannan
1207.244.67.215WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_130nannan
2207.244.67.216WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_126nannan
3207.244.67.214WashingtonWashington, D.C.AS30633 Leaseweb USA, Inc.20045United Statestier_119nannan
4206.221.176.184New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_115nannan
5104.243.45.179New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_112nannan
6104.243.45.178New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_19nannan
7104.243.45.190New York CityNew YorkAS23470 ReliableSite.Net LLC10004United Statestier_18nannan
8185.107.56.199RotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_14nannan
974.63.241.27DallasTexasAS46475 Limestone Networks, Inc.75270United Statestier_1327-241-63-74.static.reverse.lstn.netnan
10198.54.112.216San JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_2108nannan
1135.209.61.240Council BluffsIowaAS15169 Google LLC51502United Statestier_2107240.61.209.35.bc.googleusercontent.comnan
12198.134.116.30New York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_250nannan
1354.235.205.204AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_230ec2-54-235-205-204.compute-1.amazonaws.comnan
1423.21.166.230AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_229ec2-23-21-166-230.compute-1.amazonaws.comnan
1554.197.247.190AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_226ec2-54-197-247-190.compute-1.amazonaws.comnan
1623.21.53.13AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_225ec2-23-21-53-13.compute-1.amazonaws.comnan
1734.207.32.33AshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_222ec2-34-207-32-33.compute-1.amazonaws.comnan
185.79.68.236AmsterdamNorth HollandAS60781 LeaseWeb Netherlands B.V.1012Netherlandstier_218nannan
1913.225.230.122New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_216server-13-225-230-122.jfk51.r.cloudfront.netnan
20104.21.71.177San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_335nanTrue
21142.93.4.215North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_330nannan
22172.67.147.244San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_320nanTrue
23172.217.10.100CliftonNew JerseyAS15169 Google LLC07015United Statestier_317lga34s15-in-f4.1e100.netnan
24172.217.11.36New York CityNew YorkAS15169 Google LLC10004United Statestier_314lga25s61-in-f4.1e100.netnan
25104.21.91.236San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_311nanTrue
26172.67.181.234San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_311nanTrue
27172.217.165.132Los AngelesCaliforniaAS15169 Google LLC90009United Statestier_310lax30s03-in-f4.1e100.netnan
28165.22.6.204North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_39nannan
29149.28.253.164DallasTexasAS20473 The Constant Company, LLC75270United Statestier_38149.28.253.164.vultr.comnan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website