Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
01391404051662021-02-0964.32.8.68Android
tierdomaincountregistrarname_serversorg
0tier_1bugpoint.net1SNAPNAMES 42, LLCNS1.DNSNUTS.COMNone
1tier_1garden-variety.net1EUNameFlood.com LLCNS1.DNSNUTS.COMNone
2tier_1blessedit.com1SNAPNAMES 29, LLCNS1.DNSNUTS.COMNone
3tier_1gifanimasyon.com1Dropcatch Auction LLCNS1.DNSNUTS.COMNone
4tier_1economictims.com1Domain Landing Zone LLCNS1.DNSNUTS.COMNone
5tier_19ref.com1Lionshare Domains, LLCNS1.DNSNUTS.COMNone
6tier_1crafthd.net1SNAPNAMES 42, LLCNS1.DNSNUTS.COMNone
7tier_1elektrononline.net1Blue Angel Domains LLCNS1.DNSNUTS.COMNone
8tier_1akeremuna2018.com1Domain Secure LLCNS1.DNSNUTS.COMNone
9tier_1beritatrendz.com1Nameselite, LLCNS1.DNSNUTS.COMNone
10tier_2alfik-fik.com48Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
11tier_2track.vcdc.com37Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
12tier_2dprtb.com131API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
13tier_2bradamante-per.com11Amazon Registrar, Inc.NS-1026.AWSDNS-00.ORGWhois Privacy Service
14tier_2get.popplunder.com10NoneNoneNone
15tier_2trustedpush.com9NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
16tier_2dsp2.adtelligent.com6DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
17tier_2aibm1.mysearch.space6NoneNoneNone
18tier_2externals-1953518744.us-east-1.elb.amazonaws.com6MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
19tier_2search.snjsearch.com6GoDaddy.com, LLCNS73.DOMAINCONTROL.COMDomains By Proxy, LLC
20tier_3irl.com35GoDaddy.com, LLCNS-106.AWSDNS-13.COMDomains By Proxy, LLC
21tier_3bing.com6MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
22tier_3b.delightcmain.xyz5Epik LLCMARJORY.NS.CLOUDFLARE.COMAnonymize, Inc.
23tier_3win3.trustedpush.com4NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
24tier_3rd.bizrate.com3MarkMonitor, Inc.NS-1189.AWSDNS-20.ORGMeredith Corporation
25tier_3upplayglobal.xyz3Epik LLCMARJORY.NS.CLOUDFLARE.COMAnonymize, Inc.
26tier_3happymakesite.xyz3Epik LLCMARJORY.NS.CLOUDFLARE.COMAnonymize, Inc.
27tier_3win1.trustedpush.com3NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
28tier_3medicare.healthcare.com2GoDaddy.com, LLCNS-1455.AWSDNS-53.ORGDomains By Proxy, LLC
29tier_3win2.trustedpush.com2NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0185.107.56.57AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_115nannan
164.32.8.67Los AngelesCaliforniaAS46844 Sharktech90009United Statestier_113customer.sharktech.netnan
264.32.8.68Los AngelesCaliforniaAS46844 Sharktech90009United Statestier_111customer.sharktech.netnan
364.32.8.70Los AngelesCaliforniaAS46844 Sharktech90009United Statestier_111customer.sharktech.netnan
464.32.8.69Los AngelesCaliforniaAS46844 Sharktech90009United Statestier_17customer.sharktech.netnan
5185.107.56.58AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_16nannan
6185.107.56.59AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_16nannan
7185.107.56.60AmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_14nannan
8167.233.8.197NürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_237static.197.8.233.167.clients.your-server.denan
934.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_230ec2-34-200-146-95.compute-1.amazonaws.comnan
1054.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_229ec2-54-84-27-165.compute-1.amazonaws.comnan
11209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_220nannan
1234.199.180.187Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_210ec2-34-199-180-187.compute-1.amazonaws.comnan
1313.225.62.107NewarkNew JerseyAS16509 Amazon.com, Inc.07175United Statestier_210server-13-225-62-107.ewr53.r.cloudfront.netnan
1434.233.193.17Virginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_29ec2-34-233-193-17.compute-1.amazonaws.comnan
15192.138.218.207SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_33rd.bizrate.comnan
16185.239.174.10LondonEnglandAS55081 24 SHELLSEC1AUnited Kingdomtier_26nannan
1735.162.164.74PortlandOregonAS16509 Amazon.com, Inc.97207United Statestier_26ec2-35-162-164-74.us-west-2.compute.amazonaws.comnan
18100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_37pool-100-37-135-2.nycmny.fios.verizon.netnan
19162.243.166.170North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_36nannan
20104.248.63.231North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_35nannan
21104.18.80.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_34nanTrue
2213.57.64.34Los AngelesCaliforniaAS16509 Amazon.com, Inc.90084United Statestier_33ec2-13-57-64-34.us-west-1.compute.amazonaws.comnan
2350.18.217.105Los AngelesCaliforniaAS16509 Amazon.com, Inc.90084United Statestier_33ec2-50-18-217-105.us-west-1.compute.amazonaws.comnan
2413.107.21.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_33nanTrue
25192.138.218.207SeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_33rd.bizrate.comnan
2613.56.125.91Los AngelesCaliforniaAS16509 Amazon.com, Inc.90084United Statestier_33ec2-13-56-125-91.us-west-1.compute.amazonaws.comnan
27204.79.197.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_33a-0001.a-msedge.netTrue

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website