Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
01561577300102021-03-1464.32.8.68Android
tierdomaincountregistrarname_serversorg
0tier_1civgames.com1Domainsinthebag.com LLCNS1.DNSNUTS.COMNone
1tier_1kamibbs.biz1UdomainName.com LLCns2.dnsnuts.comNone
2tier_1dakmm.com1Private Domains, LLCNS1.DNSNUTS.COMNone
3tier_110dle.com1Free Drop Zone LLCNS1.DNSNUTS.COMNone
4tier_1justsayjenn.net1SNAPNAMES 13, LLCNS1.DNSNUTS.COMNone
5tier_1buzzingley.com1Bonam Fortunam Domains, LLCNS1.DNSNUTS.COMNone
6tier_1ciqhyd.com1Deep Dive Domains, LLCNS1.DNSNUTS.COMNone
7tier_1apro-ent.com1SNAPNAMES 34, LLCNS1.DNSNUTS.COMNone
8tier_1instantvideopresence.com1Domain Rouge, LLCNS1.DNSNUTS.COMNone
9tier_1d-comic.com1SNAPNAMES 9, LLCNS1.DNSNUTS.COMNone
10tier_2alfik-fik.com61Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
11tier_2track.vcdc.com41Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
12tier_2ads35.adtelligent.com31DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
13tier_2dsp35.adtelligent.com31DANESCO TRADING LTDNS.ANYCASTNS1.ORGVertamedia,LLC
14tier_2aibm1.mysearch.space31NoneNoneNone
15tier_2externals-1953518744.us-east-1.elb.amazonaws.com31MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
16tier_2search.snjsearch.com31GoDaddy.com, LLCNS73.DOMAINCONTROL.COMDomains By Proxy, LLC
17tier_2search-checker.com28Name.com, Inc.BETH.NS.CLOUDFLARE.COMDomain Protection Services, Inc.
18tier_2m.onlineweb.mobi28GoDaddy.com, LLCNoneNone
19tier_2btpnav.com241API GmbHNS1.DNSIMPLE.COMRegistrant of btpnav.com
20tier_3bing.com29MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
21tier_3storystudio.sfgate.com12CSC CORPORATE DOMAINS, INC.NS1.HEARSTNP.COMHearst Communications, Inc.
22tier_3win3.trustedpush.com7NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
23tier_3happymakesite.xyz7Epik LLCMARJORY.NS.CLOUDFLARE.COMAnonymize, Inc.
24tier_3tdstraffic.xyz6NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
25tier_3win4.trustedpush.com6NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
26tier_3win5.trustedpush.com5NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
27tier_3m.placesiteb.xyz5Sav.comLLCHUGH.NS.CLOUDFLARE.COMPrivacy Protection
28tier_3win2.trustedpush.com3NAMECHEAP INCNS-1142.AWSDNS-14.ORGWhoisGuard, Inc.
29tier_3m.funsiteb.xyz3Sav.comLLCHUGH.NS.CLOUDFLARE.COMPrivacy Protection
ipcityregionorgpostalcountry_nametiercounthostnameanycast
0185.107.56.58RotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_118nannan
164.32.8.68Los AngelesCaliforniaAS46844 Sharktech90009United Statestier_113customer.sharktech.netnan
2185.107.56.60RotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_112nannan
364.32.8.70Los AngelesCaliforniaAS46844 Sharktech90009United Statestier_112customer.sharktech.netnan
464.32.8.69Los AngelesCaliforniaAS46844 Sharktech90009United Statestier_112customer.sharktech.netnan
564.32.8.67Los AngelesCaliforniaAS46844 Sharktech90009United Statestier_112customer.sharktech.netnan
6185.107.56.57RotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_18nannan
7185.107.56.59RotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_17nannan
854.84.27.165Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_246ec2-54-84-27-165.compute-1.amazonaws.comnan
934.200.146.95Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_243ec2-34-200-146-95.compute-1.amazonaws.comnan
10167.233.8.197NürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_241static.197.8.233.167.clients.your-server.denan
11209.205.202.42New York CityNew YorkAS55081 24 SHELLS10004United Statestier_231static-42-202-205-209.24shells.netnan
12209.205.202.43New York CityNew YorkAS55081 24 SHELLS10004United Statestier_231static-43-202-205-209.24shells.netnan
1335.162.164.74PortlandOregonAS16509 Amazon.com, Inc.97256United Statestier_231ec2-35-162-164-74.us-west-2.compute.amazonaws.comnan
1413.225.230.12New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_34server-13-225-230-12.jfk51.r.cloudfront.netnan
15209.15.13.136TorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_225nannan
16104.21.41.235San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_222nanTrue
1734.199.180.187Virginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_222ec2-34-199-180-187.compute-1.amazonaws.comnan
18204.79.197.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_319nanTrue
19100.37.135.2New York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_316pool-100-37-135-2.nycmny.fios.verizon.netnan
2098.129.228.57DallasTexasAS33070 Rackspace Hosting75270United Statestier_312nannan
2113.107.21.200RedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_310nanTrue
22104.248.224.185North BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_36nannan
23104.18.82.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_36nanTrue
24104.18.79.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_34nanTrue
25104.18.81.149San FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_34nanTrue
2613.225.230.12New York CityNew YorkAS16509 Amazon.com, Inc.10004United Statestier_34server-13-225-230-12.jfk51.r.cloudfront.netnan
2764.91.232.212LansingMichiganAS32244 Liquid Web, L.L.C48901United Statestier_32host.encontext.comnan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website