Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
01451437450382021-02-1664.32.8.68Android
tierdomaincountregistrarname_serversorg
0tier_1forumbds.net1Namesource LLCNS1.DNSNUTS.COMNone
1tier_1frelsitv.com1BurnsideDomains.com LLCNS1.DNSNUTS.COMNone
2tier_19ref.com1Lionshare Domains, LLCNS1.DNSNUTS.COMNone
3tier_1cupidonx.com1SNAPNAMES 23, LLCNS1.DNSNUTS.COMNone
4tier_1aharonic.net1Gradeadomainnames.com LLCNS1.DNSNUTS.COMNone
5tier_1chastnoevideo.net1SNAPNAMES 90, LLCNS1.DNSNUTS.COMNone
6tier_1dxnewradio.com1Aquila Domains LLCNS1.DNSNUTS.COMNone
7tier_1gundamsite7.com1White Rhino Domains, LLCNS1.DNSNUTS.COMNone
8tier_1deresute-japan.com1SNAPNAMES 47, LLCNS1.DNSNUTS.COMNone
9tier_1abadown.com1Domainsinthebag.com LLCNS1.DNSNUTS.COMNone
10tier_2alfik-fik.com50Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
11tier_2track.vcdc.com44Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
12tier_2ads35.adtelligent.com42DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
13tier_2dsp35.adtelligent.com42DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
14tier_2aibm1.mysearch.space42NoneNoneNone
15tier_2externals-1953518744.us-east-1.elb.amazonaws.com42MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
16tier_2search.snjsearch.com42GoDaddy.com, LLCNS73.DOMAINCONTROL.COMDomains By Proxy, LLC
17tier_2search-checker.com40Name.com, Inc.BETH.NS.CLOUDFLARE.COMDomain Protection Services, Inc.
18tier_2m.onlineweb.mobi40GoDaddy.com, LLCNoneNone
19tier_2bradamante-per.com14Amazon Registrar, Inc.NS-1026.AWSDNS-00.ORGWhois Privacy Service
20tier_3bing.com42MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
21tier_3win3.trustedpush.com6NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
22tier_3win2.trustedpush.com5NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
23tier_3rd.bizrate.com5MarkMonitor, Inc.NS-1189.AWSDNS-20.ORGMeredith Corporation
24tier_3win1.trustedpush.com3NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
25tier_3squirt.org3NAMECHEAP INCNS5.DNSMADEEASY.COMWhoisGuard, Inc.
26tier_3m.funsiteb.xyz3Sav.com, LLCHUGH.NS.CLOUDFLARE.COMPrivacy Protection
27tier_3omahasteaks.com2CSC CORPORATE DOMAINS, INC.A1-3.AKAM.NETOmaha Steaks International, Inc.
28tier_3m.placesiteb.xyz2Sav.com, LLCHUGH.NS.CLOUDFLARE.COMPrivacy Protection
29tier_3lulus.com_LOOP_11NoneNoneNone
iphostnamecityregionorgpostalcountry_nametiercountanycast
064.32.8.69customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_116nan
164.32.8.67customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_114nan
2185.107.56.57nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_112nan
364.32.8.70customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_110nan
464.32.8.68customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_19nan
5185.107.56.59nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_19nan
6185.107.56.58nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_18nan
7185.107.56.60nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_14nan
8167.233.8.197static.197.8.233.167.clients.your-server.deNürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_244nan
9209.205.202.42static-42-202-205-209.24shells.netNew York CityNew YorkAS55081 24 SHELLS10004United Statestier_242nan
10209.205.202.43static-43-202-205-209.24shells.netNew York CityNew YorkAS55081 24 SHELLS10004United Statestier_242nan
1135.162.164.74ec2-35-162-164-74.us-west-2.compute.amazonaws.comPortlandOregonAS16509 Amazon.com, Inc.97207United Statestier_242nan
1234.200.146.95ec2-34-200-146-95.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_239nan
13209.15.13.136nanTorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_226nan
1454.84.27.165ec2-54-84-27-165.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_226nan
15192.241.229.243nanSan FranciscoCaliforniaAS14061 DigitalOcean, LLC94124United Statestier_226nan
163.125.109.211ec2-3-125-109-211.eu-central-1.compute.amazonaws.comFrankfurt am MainHesseAS16509 Amazon.com, Inc.60311Germanytier_222nan
1754.210.170.165ec2-54-210-170-165.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23452United Statestier_221nan
18204.79.197.200a-0001.a-msedge.netRedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_333True
19100.37.135.2pool-100-37-135-2.nycmny.fios.verizon.netNew York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_39nan
2013.107.21.200nanRedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_39True
21192.138.218.207rd.bizrate.comSeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_35nan
2213.225.218.47server-13-225-218-47.jfk51.r.cloudfront.netNew York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_34nan
23104.18.79.149nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_34True
24158.106.84.60desktop.squirt.orgTorontoOntarioAS23498 COGECODATAM5NCanadatier_33nan
2513.225.218.113server-13-225-218-113.jfk51.r.cloudfront.netNew York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_33nan
2623.73.227.48a23-73-227-48.deploy.static.akamaitechnologies.comEdisonNew JerseyAS16625 Akamai Technologies, Inc.08817United Statestier_32nan
27104.18.82.149nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_32True

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website