Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
01932047740642021-02-0164.32.8.68Safari
tierdomaincountregistrarname_serversorg
0tier_1cryog.net1Sammamishdomains.com LLCNS1.DNSNUTS.COMNone
1tier_1bilderupload.net1OregonEU.com LLCNS1.DNSNUTS.COMNone
2tier_1addcomponent.com1Slow Putt Domains LLCNS1.DNSNUTS.COMNone
3tier_1donkis.net1Bonzai Domains, LLCNS1.DNSNUTS.COMNone
4tier_1crfashionwear.net1Active Market Domains LLCNS1.DNSNUTS.COMNone
5tier_1akeremuna2018.com1Domain Secure LLCNS1.DNSNUTS.COMNone
6tier_1all-men.net1NamePal.com #8017, LLCNS1.DNSNUTS.COMNone
7tier_1bttorrents.net1Fine Grain Domains, LLCNS1.DNSNUTS.COMNone
8tier_1beritatrendz.com1Nameselite, LLCNS1.DNSNUTS.COMNone
9tier_1aiss.cc1Top Shelf Domains LLCNS1.DNSNUTS.COMNone
10tier_2track.vcdc.com79Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
11tier_2bradamante-per.com49Amazon Registrar, Inc.NS-1026.AWSDNS-00.ORGWhois Privacy Service
12tier_2apinew.fpvideoplayer.com49NAMECHEAP INCNS-1200.AWSDNS-22.ORGWhoisGuard, Inc.
13tier_2r65g7vxgee.execute-api.us-east-1.amazonaws.com49MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
14tier_2r65g7vxgee.execute-api.us-east-1.amazonaws.com_LOOP_149NoneNoneNone
15tier_2alfik-fik.com40Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
16tier_2dprtb.com171API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
17tier_2pjowurlowasbmqvhyojhddhxcuxpjo.s3.amazonaws.com16NoneNoneNone
18tier_2pjowurlowasbmqvhyojhddhxcuxpjo.s3.amazonaws.com_LOOP_116NoneNoneNone
19tier_2hlqgaunjbvgptbvmjvjdbbulfmbxqt.s3.amazonaws.com12MarkMonitor Inc.R1.AMAZONAWS.COMNone
20tier_3irl.com32NoneNoneNone
21tier_3cemsqqrvukswgwvmuqhvdqnqfzlzdl.s3.amazonaws.com16MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
22tier_3ujmeogytnjpsrmyldzxcilazsfbvvz.s3.amazonaws.com12NoneNoneNone
23tier_3afphqkmdeaktauimqdktstbisvfcdz.s3.amazonaws.com11MarkMonitor Inc.R1.AMAZONAWS.COMNone
24tier_3efvkjbpbsuzejybfocwmjvfdwdbmds.s3.amazonaws.com10NoneNoneNone
25tier_3storeheavily-thequickfile.best5NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
26tier_3storeswift-theheavilyfile.best5NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
27tier_3iosrecommendedvpn.com4NoneNoneNone
28tier_3bing.com4MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
29tier_3peachsecureus.com3NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
iphostnamecityregionorgpostalcountry_nametiercount
064.32.8.68customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_120
164.32.8.70customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_117
264.32.8.67customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_116
3185.107.56.58nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_114
4185.107.56.59nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_114
564.32.8.69customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_114
6185.107.56.60nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_112
7185.107.56.57nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_18
8100.37.135.2pool-100-37-135-2.nycmny.fios.verizon.netNew York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_34
9167.233.8.197static.197.8.233.167.clients.your-server.deNürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_279
1034.200.146.95ec2-34-200-146-95.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_251
1154.84.27.165ec2-54-84-27-165.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_238
12209.15.13.136nanTorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_227
13198.134.116.30nanNew York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_211
1418.210.49.168ec2-18-210-49-168.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_210
153.81.181.244ec2-3-81-181-244.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_210
1654.198.211.201ec2-54-198-211-201.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_29
1734.230.247.23ec2-34-230-247-23.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_28
183.226.188.121ec2-3-226-188-121.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_310
19159.65.216.232nanNorth BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_37
2054.162.183.76ec2-54-162-183-76.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_35
21100.37.135.2pool-100-37-135-2.nycmny.fios.verizon.netNew York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_34
22162.243.166.170nanNorth BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_34
2313.57.64.34ec2-13-57-64-34.us-west-1.compute.amazonaws.comLos AngelesCaliforniaAS16509 Amazon.com, Inc.90084United Statestier_33
2454.39.130.163ns568503.ip-54-39-130.netMontréalQuebecAS16276 OVH SASH3ACanadatier_33
2513.56.125.91ec2-13-56-125-91.us-west-1.compute.amazonaws.comLos AngelesCaliforniaAS16509 Amazon.com, Inc.90084United Statestier_33
2650.18.217.105ec2-50-18-217-105.us-west-1.compute.amazonaws.comLos AngelesCaliforniaAS16509 Amazon.com, Inc.90084United Statestier_33
27104.248.63.248nanNorth BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_33

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website