Daily Threat Intelligence Report

This report contains following information

  1. Overall statistics
    1. Number of domains detected
    2. Number of domains detected by Google Safe Browsing
    3. IP address behind entry-level domains
    4. date of collection
  2. Top 10 domain statistics
    1. count (number of redirection paths that contain this domain)
    2. tier (1 is entry-level domain, 2 is intermediate hop, 3 is final landing domain)
    3. registar
    4. organization
  3. Top 10 IP statistics
    1. count
    2. location (city, country, region)
    3. hostname
    4. organization
  4. Consolidated redirection path
    1. green: tier one domain
    2. yellow: tier two domain
    3. red: tier three domain
num_domainnum_linksnum_full_urlnum_safebrowsing_maliciousnum_vt_maliciousdateipuser_agent
02192197520722021-04-0164.32.8.70Chrome
tierdomaincountregistrarname_serversorg
0tier_1ciliguai.com1eNom437, IncorporatedNS1.DNSNUTS.COMThe Management Group II
1tier_1indieknow.net1Goldmine Domains LLCNS1.DNSNUTS.COMThe Management Group II
2tier_1gifanimasyon.com1Dropcatch Auction LLCNS1.DNSNUTS.COMThe Management Group II
3tier_1emhdf.com1EastEnd Domains LLCNS1.DNSNUTS.COMThe Management Group II
4tier_124bitvinyl.com1White Alligator Domains, LLCNS1.DNSNUTS.COMNone
5tier_1chastnoevideo.net1eNomEU, Inc.NS1.DNSNUTS.COMNone
6tier_1elektrononline.net1Blue Angel Domains LLCNS1.DNSNUTS.COMNone
7tier_1gundamsite7.com1White Rhino Domains, LLCNS1.DNSNUTS.COMThe Management Group II
8tier_1java-interview-questions.com1NamePal.com #8025 Inc.NS1.DNSNUTS.COMThe Management Group II
9tier_1cash-crypto.com1Top Level Domains LLCNS1.DNSNUTS.COMNone
10tier_2rqhere2.com105NAMECHEAP INCJEROME.NS.CLOUDFLARE.COMPrivacy service provided by Withheld for Privacy ehf
11tier_2click.expmediadirect.com52NAMECHEAP INCNS1.LINODE.COMPrivacy service provided by Withheld for Privacy ehf
12tier_2track.vcdc.com36Key-Systems GmbHGUY.NS.CLOUDFLARE.COMc/o whoisproxy.com
13tier_2clk.rtpdn12.com36NAMECHEAP INCDNS1.REGISTRAR-SERVERS.COMPrivacy service provided by Withheld for Privacy ehf
14tier_2btpnav.com281API GmbHNS1.DNSIMPLE.COMRegistrant of btpnav.com
15tier_21496.wcitianka.com25GoDaddy Online Services Cayman Islands LTDNS-1096.AWSDNS-09.ORGNone
16tier_2americanlisted.com22ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
17tier_2click.appcast.io21101Domain GRS LtdNS-85.AWSDNS-10.COMNone
18tier_2click.junmediadirect.com18NAMECHEAP INCNS1.LINODE.COMPrivacy service provided by Withheld for Privacy ehf
19tier_29nl.es14NoneNoneNone
20tier_3healthsupreme.club79GoDaddy.com, LLCmolly.ns.cloudflare.comNone
21tier_3healandgrow.club26GoDaddy.com, LLCmolly.ns.cloudflare.comNone
22tier_3click.appcast.io_LOOP_15NoneNoneNone
23tier_3whatjobs.com3123-Reg LimitedVIDA.NS.CLOUDFLARE.COMNone
24tier_3signup.myjobscorner.com3GoDaddy.com, LLCALDO.NS.CLOUDFLARE.COMDomains By Proxy, LLC
25tier_3americanlisted.com3ilait ABNS1.TELECOM3.NETIntegration 3 Group AB
26tier_3jobleads.com2united domains AGCRUZ.NS.CLOUDFLARE.COMNone
27tier_3phaisoaz.com2URL SOLUTIONS INC.NS-1346.AWSDNS-40.ORGGLOBAL DOMAIN PRIVACY SERVICES INC
28tier_3bing.com1MarkMonitor, Inc.DNS1.P09.NSONE.NETMicrosoft Corporation
29tier_3loyality-program.com1Amazon Registrar, Inc.NS-108.AWSDNS-13.COMWhois Privacy Service
iphostnamecityregionorgpostalcountry_nametiercountanycast
064.32.8.69customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_126nan
1185.107.56.59nanRotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_119nan
264.32.8.67customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_118nan
3185.107.56.60nanRotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_117nan
464.32.8.68customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_117nan
564.32.8.70customer.sharktech.netLos AngelesCaliforniaAS46844 Sharktech90009United Statestier_116nan
6185.107.56.58nanRotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_115nan
7185.107.56.57nanRotterdamSouth HollandAS43350 NForce Entertainment B.V.3012Netherlandstier_112nan
8167.99.3.175nanNorth BergenNew JerseyAS14061 DigitalOcean, LLC07047United Statestier_2105nan
9198.134.116.30nanNew York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_252nan
10209.15.13.136nanTorontoOntarioAS13768 Aptum TechnologiesM5NCanadatier_242nan
11173.239.53.32nanNew York CityNew YorkAS27257 Webair Internet Development Company Inc.10004United Statestier_240nan
12167.233.8.197static.197.8.233.167.clients.your-server.deNürnbergBavariaAS24940 Hetzner Online GmbH90402Germanytier_236nan
13198.54.112.216nanSan JoseCaliforniaAS22612 Namecheap, Inc.95103United Statestier_226nan
1435.209.61.240240.61.209.35.bc.googleusercontent.comCouncil BluffsIowaAS15169 Google LLC51502United Statestier_33nan
15198.134.116.18nanNew York CityNew YorkAS27257 Webair Internet Development Company Inc.10013United Statestier_218nan
163.234.0.165ec2-3-234-0-165.compute-1.amazonaws.comAshburnVirginiaAS14618 Amazon.com, Inc.20149United Statestier_210nan
17100.37.135.2pool-100-37-135-2.nycmny.fios.verizon.netNew York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_39nan
18104.21.70.182nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_340True
19172.67.138.116nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_339True
20104.21.74.59nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_313True
21172.67.167.252nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_313True
22100.37.135.2pool-100-37-135-2.nycmny.fios.verizon.netNew York CityNew YorkAS701 MCI Communications Services, Inc. d/b/a Verizon Business10004United Statestier_39nan
23104.26.7.145nanSan FranciscoCaliforniaAS13335 Cloudflare, Inc.94107United Statestier_33True
2435.209.61.240240.61.209.35.bc.googleusercontent.comCouncil BluffsIowaAS15169 Google LLC51502United Statestier_33nan
25194.6.195.224www.jobleads.deHamburgHamburgAS39227 Corpex Internet GmbH20038Germanytier_32nan
26139.45.197.163nanAmsterdamNorth HollandAS9002 RETN Limited1012Netherlandstier_32nan
27204.79.197.200a-0001.a-msedge.netRedmondWashingtonAS8068 Microsoft Corporation98052United Statestier_31True

Aggregated redirection graph of domains located on current IP address.

  • The redirection flows from left to right
  • Leftmost domains are initial domains hosted on current IP
  • Rightmost domains are final landing domains we were able to crawl

Screenshot of high-occurrence final landing domains

Have other ideas? / Want to subscribe to get threat intelligence report? / Contact

Zhouhan Chen, NYU Center for Data Science, zc1245@nyu.edu, Personal Website