Malware Discoverer Github Homepage.

Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
01381394380642021-03-2364.32.8.68Safari
tierdomaincountregistrarname_serversorg
0tier_1curious-information.net1MidWestDomains, LLCNS1.DNSNUTS.COMNone
1tier_1blessedit.com1SNAPNAMES 29, LLCNS1.DNSNUTS.COMNone
2tier_1addcomponent.com1Slow Putt Domains LLCNS1.DNSNUTS.COMNone
3tier_1crfashionwear.net1Active Market Domains LLCNS1.DNSNUTS.COMNone
4tier_1bttorrents.net1Fine Grain Domains, LLCNS1.DNSNUTS.COMNone
5tier_1deresute-japan.com1SNAPNAMES 47, LLCNS1.DNSNUTS.COMNone
6tier_1dl4warez.com1NamePal.com #8013, LLCNS1.DNSNUTS.COMNone
7tier_1advancetools.net1DomainSprouts.com LLCNS1.DNSNUTS.COMNone
8tier_1bxfr.net1Sssasss, LLCNS1.DNSNUTS.COMNone
9tier_1bamanshop.com1Cool River Names, LLCNS1.DNSNUTS.COMNone
10tier_2aglai-tan.com38Amazon Registrar, Inc.NS-1083.AWSDNS-07.ORGWhois Privacy Service
11tier_2track.vcdc.com26Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
12tier_2btpnav.com251API GmbHNS1.DNSIMPLE.COMRegistrant of btpnav.com
13tier_2click.expmediadirect.com23NAMECHEAP INCNS1.LINODE.COMPrivacy service provided by Withheld for Privacy ehf
14tier_2nicanor-the.com21Amazon Registrar, Inc.NS-1242.AWSDNS-27.ORGWhois Privacy Service
15tier_2asufij.xyz15NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
16tier_2managerformula.com8NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
17tier_2btpnative.com61API GmbHNS1.DNSIMPLE.COMRegistrant of btpnative.com
18tier_2infopicked.com6NAMECHEAP INCNS0.DNSMADEEASY.COMWhoisGuard, Inc.
19tier_2api.apptap.com6Amazon Registrar, Inc.NS-1256.AWSDNS-29.ORGWhois Privacy Service
20tier_3irl.com30GoDaddy.com, LLCNS-106.AWSDNS-13.COMDomains By Proxy, LLC
21tier_3xzb.subeamy.pw15NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
22tier_3managerformula.com13NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
23tier_3s3.amazonaws.com8MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
24tier_3bing.com5NoneNoneNone
25tier_3down.poesn.pw4NAMECHEAP INCBUCK.NS.CLOUDFLARE.COMWhoisGuard, Inc.
26tier_3reebok.com3CSC CORPORATE DOMAINS, INC.NS1.NETNAMES.NETReebok International, Ltd.
27tier_3nicanor-the.com2Amazon Registrar, Inc.NS-1242.AWSDNS-27.ORGWhois Privacy Service
28tier_3reebok.com_LOOP_11NoneNoneNone
29tier_3iosrecommendedvpn.com1NoneNoneNone
iphostnamecityregionorgpostalcountry_nametiercountanycast
064.32.8.67customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_115nan
164.32.8.69customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_114nan
264.32.8.70customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_112nan
3185.107.56.59nanRotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_111nan
464.32.8.68customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_110nan
5185.107.56.60nanRotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_110nan
6185.107.56.58nanRotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_18nan
7185.107.56.57nanRotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_17nan
8209.15.13.136nanTorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_237nan
954.84.27.165ec2-54-84-27-165.compute-1.amazonaws.comAshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_232nan
1034.200.146.95ec2-34-200-146-95.compute-1.amazonaws.comAshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_227nan
11167.233.8.197static.197.8.233.167.clients.your-server.deNürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_226nan
12198.134.116.30nanNew York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_223nan
13192.138.218.207rd.bizrate.comSeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_212nan
1444.241.50.49ec2-44-241-50-49.us-west-2.compute.amazonaws.comBoardmanOregonAS16509 Amazon.com, Inc.97818United Statestier_29nan
15173.192.101.2418.65.c0ad.ip4.static.sl-reverse.comDallasTexasAS36351 SoftLayer Technologies Inc.75270United Statestier_26nan
1652.33.20.119ec2-52-33-20-119.us-west-2.compute.amazonaws.comBoardmanOregonAS16509 Amazon.com, Inc.97818United Statestier_25nan
17209.205.202.42static-42-202-205-209.24shells.netNew York CityNew YorkAS55081 24 SHELLS10004United Statestier_25nan
1835.165.21.241ec2-35-165-21-241.us-west-2.compute.amazonaws.comBoardmanOregonAS16509 Amazon.com, Inc.97818United Statestier_310nan
1952.88.215.122ec2-52-88-215-122.us-west-2.compute.amazonaws.comBoardmanOregonAS16509 Amazon.com, Inc.97818United Statestier_35nan
20204.79.197.200nanRedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_35True
2154.205.240.192ec2-54-205-240-192.compute-1.amazonaws.comAshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_34nan
2252.73.87.228ec2-52-73-87-228.compute-1.amazonaws.comAshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_34nan
2367.207.80.24nanNorth BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_34nan
24104.21.9.163nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_34True
25167.172.139.120nanNorth BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_33nan
2664.227.12.111nanNorth BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_33nan
27100.37.135.2pool-100-37-135-2.nycmny.fios.verizon.netNew York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_33nan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website