Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
01751916680902021-03-0564.32.8.70Chrome
tierdomaincountregistrarname_serversorg
0tier_1forumbds.net1Namesource LLCNS1.DNSNUTS.COMNone
1tier_1freemoneysystem.net1Interlakenames.com LLCNS1.DNSNUTS.COMThe Management Group II
2tier_1gaitametore.com1Blisternet, IncorporatedNS1.DNSNUTS.COMNone
3tier_1bangkok-model.com1Namegrab LLCNS1.DNSNUTS.COMThe Management Group II
4tier_1andersoncollectibles.com1Sssasss, IncorporatedNS1.DNSNUTS.COMNone
5tier_1erojii.net1Dropcatch Landing Spot LLCNS1.DNSNUTS.COMNone
6tier_1feby.net1NamePal.com #8024, LLCNS1.DNSNUTS.COMNone
7tier_1dashitz.com1Name Nelly, LLCNS1.DNSNUTS.COMNone
8tier_1causticwow.net1Klaatudomains.com LLCNS1.DNSNUTS.COMNone
9tier_1download-wallpaper.net1SNAPNAMES 66, LLCNS1.DNSNUTS.COMNone
10tier_2dprtb.com421API GmbHNS1.DNSIMPLE.COMREDACTED FOR PRIVACY
11tier_21496.wcitianka.com36NoneNoneNone
12tier_2americanlisted.com34ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
13tier_2alfik-fik.com28Amazon Registrar, Inc.NS-1264.AWSDNS-30.ORGWhois Privacy Service
14tier_2click.appcast.io26101Domain GRS LtdNS-85.AWSDNS-10.COMNone
15tier_2track.vcdc.com14Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
16tier_2click.expmediadirect.com13NAMECHEAP INCNS1.LINODE.COMWhoisGuard, Inc.
17tier_2rd.celojobs.com11GoDaddy.com, LLCNS-141.AWSDNS-17.COMDomains By Proxy, LLC
18tier_2traff0121.com10NAMECHEAP INCHANS.NS.CLOUDFLARE.COMWhoisGuard, Inc.
19tier_2rd.latitejobs.com10GoDaddy.com, LLCNS-1164.AWSDNS-17.ORGDomains By Proxy, LLC
20tier_3irl.com12GoDaddy.com, LLCNS-106.AWSDNS-13.COMDomains By Proxy, LLC
21tier_3bing.com8MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
22tier_3feed.int.jobble.com6GoDaddy.com, LLCNS-1238.AWSDNS-26.ORGDomains By Proxy, LLC
23tier_3careerbliss.com6GoDaddy.com, LLCNS10.DNSMADEEASY.COMDomains By Proxy, LLC
24tier_3petco.com_LOOP_14NoneNoneNone
25tier_3neuvoo.com4MarkMonitor Inc.NS-1302.AWSDNS-34.ORGNone
26tier_3doordash.com4Amazon Registrar, Inc.NS1.DOORDASH.COMWhois Privacy Service
27tier_3open.app.jobrapido.com_LOOP_14NoneNoneNone
28tier_3squirt.org3NAMECHEAP INCNS5.DNSMADEEASY.COMWhoisGuard, Inc.
29tier_3click.appcast.io3101Domain GRS LtdNS-85.AWSDNS-10.COMNone
iphostnamecityregionorgpostalcountry_nametiercountanycast
064.32.8.67customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_114nan
1185.107.56.57nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_114nan
2185.107.56.60nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_111nan
3185.107.56.59nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_111nan
464.32.8.70customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_111nan
564.32.8.69customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_19nan
6185.107.56.58nanAmsterdamNorth HollandAS43350 NForce Entertainment B.V.1012Netherlandstier_19nan
764.32.8.68customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_16nan
8209.15.13.136nanTorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_251nan
9178.62.225.201nanAmsterdamNorth HollandAS14061 DigitalOcean, LLC1012Netherlandstier_242nan
10198.54.112.216nanSan JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_236nan
1135.209.61.240240.61.209.35.bc.googleusercontent.comCouncil BluffsIowaAS15169 Google LLC51502United Statestier_234nan
1288.99.101.106static.106.101.99.88.clients.your-server.deHohen NeuendorfBrandenburgAS24940 Hetzner Online GmbH16540Germanytier_218nan
1354.84.27.165ec2-54-84-27-165.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_216nan
14167.233.8.197static.197.8.233.167.clients.your-server.deNürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_214nan
1534.200.146.95ec2-34-200-146-95.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_213nan
16198.134.116.30nanNew York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_213nan
17192.138.218.207rd.bizrate.comSeattleWashingtonAS14332 Connexity, Inc.98111United Statestier_213nan
18100.37.135.2pool-100-37-135-2.nycmny.fios.verizon.netNew York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_319nan
19204.79.197.200a-0001.a-msedge.netRedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_37True
20207.38.44.116cbsmtp1.careerbliss.comLos AngelesCaliforniaAS5693 Latisys-Irvine, LLC90009United Statestier_36nan
2199.83.172.187acfb6a39f70758314.awsglobalaccelerator.comSeattleWashingtonAS16509 Amazon.com, Inc.98108United Statestier_33True
223.225.159.13ec2-3-225-159-13.compute-1.amazonaws.comVirginia BeachVirginiaAS14618 Amazon.com, Inc.23458United Statestier_33nan
23158.106.84.60nanTorontoOntarioAS23498 COGECODATAM5NCanadatier_33nan
2423.44.217.143a23-44-217-143.deploy.static.akamaitechnologies.comNewarkNew JerseyAS16625 Akamai Technologies, Inc.07175United Statestier_33nan
25104.21.85.191nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_33True
26139.45.197.239nanPoplarEnglandAS9002 RETN LimitedE14United Kingdomtier_33nan
2764.227.12.111nanNorth BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_32nan

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website