Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
02132177340642021-02-0164.32.8.70Safari
tierdomaincountregistrarname_serversorg
0tier_1bitofcode.net1enom666, Inc.NS1.DNSNUTS.COMThe Management Group II
1tier_1brasilonline.tv1Sterling Domains LLCNS1.DNSNUTS.COMNone
2tier_1assistafilmes.net1Active Market Domains LLCNS1.DNSNUTS.COMNone
3tier_19ref.com1Lionshare Domains, LLCNS1.DNSNUTS.COMThe Management Group II
4tier_19novels.net1! #1 Host Japan, Inc.NS1.DNSNUTS.COMThe Management Group II
5tier_1aharonic.net1Gradeadomainnames.com LLCNS1.DNSNUTS.COMNone
6tier_1alhasanah.net1Deep Dive Domains, LLCNS1.DNSNUTS.COMNone
7tier_1codeyouneed.com1Deep Sea Domains LLCNS1.DNSNUTS.COMNone
8tier_1czech-wings.net1Aquila Domains LLCNS1.DNSNUTS.COMNone
9tier_1cashmy.net1Sssasss, IncorporatedNS1.DNSNUTS.COMNone
10tier_2click.expmediadirect.com66NAMECHEAP INCNS1.LINODE.COMWhoisGuard, Inc.
11tier_2rqhere2.com65NAMECHEAP INCJEROME.NS.CLOUDFLARE.COMWhoisGuard, Inc.
12tier_2track.vcdc.com55Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
13tier_2alfik-fik.com50Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
14tier_2digitalinvest.news33NoneNoneNone
15tier_2bokoen.com27Internet Domain Service BS Corp.NS1.FORNEX.COMWhois Privacy Corp.
16tier_2go.cm-trk4.com27NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
17tier_2dprtb.com141API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
18tier_2bradamante-per.com12Amazon Registrar, Inc.NS-1026.AWSDNS-00.ORGWhois Privacy Service
19tier_2clk.rtpdn12.com12NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
20tier_3lifecaregoal.info65GoDaddy.com, LLCMOLLY.NS.CLOUDFLARE.COMNone
21tier_3securecd-smrt.com27Amazon Registrar, Inc.NS-1447.AWSDNS-52.ORGWhois Privacy Service
22tier_3healthreportsweb.info15GoDaddy.com, LLCMOLLY.NS.CLOUDFLARE.COMNone
23tier_3managerformula.com8NoneNoneNone
24tier_3dating.com_LOOP_16NoneNoneNone
25tier_3kbb.com6CSC CORPORATE DOMAINS, INC.PDNS164.ULTRADNS.BIZAutotrader.com
26tier_3storeswift-theheavilyfile.best3NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMWhoisGuard, Inc.
27tier_3s3.amazonaws.com3MarkMonitor, Inc.R1.AMAZONAWS.COMAmazon.com, Inc.
28tier_3irl.com3GoDaddy.com, LLCNS-106.AWSDNS-13.COMDomains By Proxy, LLC
29tier_3squirt.org2NAMECHEAP INCNS5.DNSMADEEASY.COMWhoisGuard, Inc.
iphostnamecityregionorgpostalcountry_nametiercountanycast
064.32.8.67customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_124nan
164.32.8.69customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_123nan
264.32.8.70customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_120nan
3185.107.56.59nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_118nan
4185.107.56.60nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_117nan
5185.107.56.57nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_117nan
6185.107.56.58nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_115nan
764.32.8.68customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_115nan
8198.134.116.30nanNew York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_267nan
9167.99.3.175nanNorth BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_265nan
10167.233.8.197static.197.8.233.167.clients.your-server.deNürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_255nan
1154.84.27.165ec2-54-84-27-165.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_237nan
1245.61.139.178nanLondonEnglandAS40676 Psychz NetworksEC3United Kingdomtier_233nan
1349.12.46.246static.246.46.12.49.clients.your-server.deMunichBavariaAS24940 Hetzner Online GmbH80331Germanytier_227nan
14173.0.157.217nanDallasTexasAS7979 Servers.com, Inc.75270United Statestier_227nan
1534.200.146.95ec2-34-200-146-95.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_225nan
16209.15.13.136nanTorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_224nan
17173.239.53.32nanNew York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_212nan
18104.21.45.44nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_335True
19172.67.209.176nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_330True
2034.233.91.38ec2-34-233-91-38.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_315nan
21172.67.155.194nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_312True
223.212.6.108ec2-3-212-6-108.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_312nan
23100.37.135.2pool-100-37-135-2.nycmny.fios.verizon.netNew York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_37nan
2423.44.217.143a23-44-217-143.deploy.static.akamaitechnologies.comNewarkNew JerseyAS16625 Akamai Technologies, Inc.07175United Statestier_36nan
253.226.188.121ec2-3-226-188-121.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_34nan
2654.162.183.76ec2-54-162-183-76.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23479United Statestier_33nan
27104.21.40.178nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_33True

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website