Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
01961996680832021-04-0764.32.8.68Chrome
tierdomaincountregistrarname_serversorg
0tier_1avg4.us1UdomainName.com LLCns1.dnsnuts.comNone
1tier_1antoniotrichini.it1Munpe Invest SLnNone
2tier_1albasocial.net1Fushi Tarazu, IncorporatedNS1.DNSNUTS.COMNone
3tier_1bay4bay.us1UdomainName.com LLCns2.dnsnuts.comNone
4tier_1bangkok-model.com1Namegrab LLCNS1.DNSNUTS.COMThe Management Group II
5tier_1codeyouneed.com1Deep Sea Domains LLCNS1.DNSNUTS.COMNone
6tier_1akeremuna2018.com1Domain Secure LLCNS1.DNSNUTS.COMNone
7tier_1coin-inflate.com1Domainhawks.net LLCNS1.DNSNUTS.COMNone
8tier_1buysql.com1Long Drive Domains LLCNS1.DNSNUTS.COMNone
9tier_110dle.com1Free Drop Zone LLCNS1.DNSNUTS.COMNone
10tier_2rqhere2.com71NoneNoneNone
11tier_2btpnav.com401API GmbHNS1.DNSIMPLE.COMRegistrant of btpnav.com
12tier_21496.rawlexi.com38NoneNoneNone
13tier_2americanlisted.com34ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
14tier_2track.vcdc.com34Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
15tier_2clk.rtpdn12.com34NoneNoneNone
16tier_2click.expmediadirect.com31NoneNoneNone
17tier_2rd.stewartdailyalerts.com13GoDaddy.com, LLCNS-1232.AWSDNS-26.ORGDomains By Proxy, LLC
18tier_2click.appcast.io12101Domain GRS LtdNS-85.AWSDNS-10.COMNone
19tier_2click.junmediadirect.com12NAMECHEAP INCNS1.LINODE.COMPrivacy service provided by Withheld for Privacy ehf
20tier_3theslotomania.info49GoDaddy.com, LLCMOLLY.NS.CLOUDFLARE.COMNone
21tier_3healthscale.club22NAMECHEAP INCmolly.ns.cloudflare.comPrivacy service provided by Withheld for Privacy ehf
22tier_3us.tideri.com15united domains AGNS.UDAG.DENone
23tier_3americanlisted.com4ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
24tier_3connectrn.pandoiq.com4GoDaddy.com, LLCNS-1396.AWSDNS-46.ORGDomains By Proxy, LLC
25tier_3click.appcast.io3101Domain GRS LtdNS-85.AWSDNS-10.COMNone
26tier_3aliexpress.com_LOOP_13NoneNoneNone
27tier_3collegerecruiter.com3Amazon Registrar, Inc.NS-105.AWSDNS-13.COMWhois Privacy Service
28tier_3avg.com1MarkMonitor, Inc.A1-182.AKAM.NETAvast Software s.r.o.
29tier_3thredup.com1GoDaddy.com, LLCMATT.NS.CLOUDFLARE.COMThredUp Inc.
iphostnamecityregionorgpostalcountry_nametiercountanycast
064.32.8.69customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_123nan
164.32.8.68customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_119nan
2185.107.56.58nanRotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_118nan
364.32.8.70customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_118nan
464.32.8.67customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_115nan
5185.107.56.57nanRotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_114nan
6185.107.56.60nanRotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_18nan
7185.107.56.59nanRotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_17nan
8167.99.3.175nanNorth BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_271nan
9209.15.13.136nanTorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_249nan
10198.54.112.216nanSan JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_239nan
11173.239.53.32nanNew York CityNew YorkAS27257 Webair Internet Development Company Inc.10004United Statestier_235nan
1235.209.61.240240.61.209.35.bc.googleusercontent.comCouncil BluffsIowaAS15169 Google LLC51502United Statestier_34nan
13167.233.8.197static.197.8.233.167.clients.your-server.deNürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_234nan
14198.134.116.30nanNew York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_231nan
15207.38.44.116cbsmtp1.careerbliss.comLos AngelesCaliforniaAS5693 Latisys-Irvine, LLC90009United Statestier_218nan
16178.62.225.201nanAmsterdamNorth HollandAS14061 DigitalOcean, LLC1012Netherlandstier_215nan
17198.134.116.18nanNew York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_212nan
18104.21.25.12nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_328True
19172.67.221.141nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_321True
2035.246.171.123123.171.246.35.bc.googleusercontent.comFrankfurt am MainHesseAS15169 Google LLC60311Germanytier_315nan
21104.21.15.30nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_313True
22172.67.161.71nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_39True
23100.37.135.2pool-100-37-135-2.nycmny.fios.verizon.netNew York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_35nan
2435.209.61.240240.61.209.35.bc.googleusercontent.comCouncil BluffsIowaAS15169 Google LLC51502United Statestier_34nan
2545.60.151.21nanRedwood CityCaliforniaAS19551 Incapsula Inc94065United Statestier_34True
26184.85.25.211a184-85-25-211.deploy.static.akamaitechnologies.comNewarkNew JerseyAS16625 Akamai Technologies, Inc.07175United Statestier_31nan
273.234.0.165ec2-3-234-0-165.compute-1.amazonaws.comAshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_31nan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website