Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
01591597800472021-03-0364.32.8.68Android
tierdomaincountregistrarname_serversorg
0tier_151sobt.com1Pink Elephant Domains, LLCNS1.DNSNUTS.COMThe Management Group II
1tier_13dmaxku.com1eNom465, IncorporatedNS1.DNSNUTS.COMNone
2tier_120pelos.com1eNom399, IncorporatedNS1.DNSNUTS.COMNone
3tier_15a1v.com1EZ Times Domains, LLCNS1.DNSNUTS.COMNone
4tier_1adelineandgraceproofs.com1Backstop Names LLCNS1.DNSNUTS.COMThe Management Group II
5tier_1ahatintime.com1Domain Original, LLCNS1.DNSNUTS.COMThe Management Group II
6tier_142pin.com1enom666, Inc.NS1.DNSNUTS.COMNone
7tier_1alchemicalpsychology.com1enom1033, Inc.NS1.DNSNUTS.COMNone
8tier_1abnertorresperez.com1Lucky Elephant Domains, LLCNS1.DNSNUTS.COMNone
9tier_1apadrineunfreelance.com1eNom417, IncorporatedNS1.DNSNUTS.COMNone
10tier_2alfik-fik.com69Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
11tier_2track.vcdc.com45Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
12tier_2ads35.adtelligent.com45DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
13tier_2dsp35.adtelligent.com45DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
14tier_2aibm1.mysearch.space45NoneNoneNone
15tier_2externals-1953518744.us-east-1.elb.amazonaws.com45MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
16tier_2search.snjsearch.com45GoDaddy.com, LLCNS73.DOMAINCONTROL.COMDomains By Proxy, LLC
17tier_2search-checker.com42Name.com, Inc.BETH.NS.CLOUDFLARE.COMDomain Protection Services, Inc.
18tier_2m.onlineweb.mobi42GoDaddy.com, LLCNoneNone
19tier_2dprtb.com331API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
20tier_3bing.com45MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
21tier_3storystudio.sfgate.com14CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Communications, Inc.
22tier_3win2.trustedpush.com6NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
23tier_3win3.trustedpush.com6NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
24tier_3win1.trustedpush.com4NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
25tier_3happymakesite.xyz4Epik LLCMARJORY.NS.CLOUDFLARE.COMAnonymize, Inc.
26tier_3abt.com2Register.com, Inc.DION.NS.CLOUDFLARE.COMNone
27tier_3m.fastspotb.xyz2Sav.comLLCHUGH.NS.CLOUDFLARE.COMPrivacy Protection
28tier_3squirt.org2NoneNoneNone
29tier_3b.meeryslotspin.xyz2Epik LLCMARJORY.NS.CLOUDFLARE.COMAnonymize, Inc.
iphostnamecityregionorgpostalcountry_nametiercountanycast
064.32.8.67customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_120nan
1185.107.56.59nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_117nan
264.32.8.70customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_115nan
364.32.8.68customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_113nan
4185.107.56.57nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_111nan
564.32.8.69customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_18nan
6185.107.56.60nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_17nan
7185.107.56.58nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_15nan
8167.233.8.197static.197.8.233.167.clients.your-server.deNürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_245nan
9209.205.202.42static-42-202-205-209.24shells.netNew York CityNew YorkAS55081 24 SHELLS10004United Statestier_245nan
10209.205.202.43static-43-202-205-209.24shells.netNew York CityNew YorkAS55081 24 SHELLS10004United Statestier_245nan
1135.162.164.74ec2-35-162-164-74.us-west-2.compute.amazonaws.comPortlandOregonAS16509 Amazon.com, Inc.97256United Statestier_245nan
1234.200.146.95ec2-34-200-146-95.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_243nan
1354.84.27.165ec2-54-84-27-165.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_242nan
14209.15.13.136nanTorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_234nan
1550.16.173.246ec2-50-16-173-246.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_226nan
16192.241.228.85nanSan FranciscoCaliforniaAS14061 DigitalOcean, LLC94124United Statestier_226nan
1752.29.135.45ec2-52-29-135-45.eu-central-1.compute.amazonaws.comFrankfurt am MainHesseAS16509 Amazon.com, Inc.60311Germanytier_225nan
18204.79.197.200a-0001.a-msedge.netRedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_340True
1998.129.228.57nanDallasTexasAS33070 Rackspace Hosting75270United Statestier_314nan
20100.37.135.2pool-100-37-135-2.nycmny.fios.verizon.netNew York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_311nan
2113.107.21.200nanRedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_35True
2213.225.229.113server-13-225-229-113.jfk51.r.cloudfront.netNew York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_35nan
23104.18.78.149nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_35True
24104.18.81.149nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_33True
25158.106.84.60squirt.orgTorontoOntarioAS23498 COGECODATAM5NCanadatier_32nan
26104.18.82.149nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_32True
2713.225.229.61server-13-225-229-61.jfk51.r.cloudfront.netNew York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_31nan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website