Linux Analysis Report
SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf

Overview

General Information

Sample name: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf
Analysis ID: 1522415
MD5: 6222e8815a9b0c24f23eadd0f27a4164
SHA1: f439eb74b1de0c3ba19566e61dcd95e5c3e8ae12
SHA256: c7c8d5b84fc31df0c3b99562e72385a543a92e45a3e5dbbff8dddc6a2fddb134
Tags: elf
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf ReversingLabs: Detection: 42%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:33994 -> 91.92.242.153:3778
Sample listens on a socket
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf (PID: 6235) Socket: 127.0.0.1:36249 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.242.153
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.242.153
Source: unknown TCP traffic detected without corresponding DNS query: 126.238.141.208
Source: unknown TCP traffic detected without corresponding DNS query: 89.173.45.209
Source: unknown TCP traffic detected without corresponding DNS query: 204.254.59.22
Source: unknown TCP traffic detected without corresponding DNS query: 176.196.118.97
Source: unknown TCP traffic detected without corresponding DNS query: 34.156.58.116
Source: unknown TCP traffic detected without corresponding DNS query: 83.11.231.159
Source: unknown TCP traffic detected without corresponding DNS query: 203.42.160.250
Source: unknown TCP traffic detected without corresponding DNS query: 254.141.36.13
Source: unknown TCP traffic detected without corresponding DNS query: 194.245.194.119
Source: unknown TCP traffic detected without corresponding DNS query: 75.196.135.174
Source: unknown TCP traffic detected without corresponding DNS query: 188.59.114.1
Source: unknown TCP traffic detected without corresponding DNS query: 39.205.249.193
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.104.162
Source: unknown TCP traffic detected without corresponding DNS query: 39.140.19.93
Source: unknown TCP traffic detected without corresponding DNS query: 139.207.180.140
Source: unknown TCP traffic detected without corresponding DNS query: 124.40.253.152
Source: unknown TCP traffic detected without corresponding DNS query: 167.202.242.211
Source: unknown TCP traffic detected without corresponding DNS query: 27.131.48.170
Source: unknown TCP traffic detected without corresponding DNS query: 107.46.123.174
Source: unknown TCP traffic detected without corresponding DNS query: 186.118.241.95
Source: unknown TCP traffic detected without corresponding DNS query: 169.185.180.156
Source: unknown TCP traffic detected without corresponding DNS query: 200.91.234.174
Source: unknown TCP traffic detected without corresponding DNS query: 24.188.3.46
Source: unknown TCP traffic detected without corresponding DNS query: 96.214.118.203
Source: unknown TCP traffic detected without corresponding DNS query: 157.56.156.140
Source: unknown TCP traffic detected without corresponding DNS query: 107.195.171.19
Source: unknown TCP traffic detected without corresponding DNS query: 106.237.230.40
Source: unknown TCP traffic detected without corresponding DNS query: 27.121.119.164
Source: unknown TCP traffic detected without corresponding DNS query: 179.40.69.49
Source: unknown TCP traffic detected without corresponding DNS query: 216.60.24.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.2.51.13
Source: unknown TCP traffic detected without corresponding DNS query: 69.130.197.159
Source: unknown TCP traffic detected without corresponding DNS query: 83.100.176.66
Source: unknown TCP traffic detected without corresponding DNS query: 222.209.198.119
Source: unknown TCP traffic detected without corresponding DNS query: 121.36.8.67
Source: unknown TCP traffic detected without corresponding DNS query: 116.160.168.199
Source: unknown TCP traffic detected without corresponding DNS query: 197.61.59.202
Source: unknown TCP traffic detected without corresponding DNS query: 116.206.146.100
Source: unknown TCP traffic detected without corresponding DNS query: 252.249.66.33
Source: unknown TCP traffic detected without corresponding DNS query: 40.54.61.219
Source: unknown TCP traffic detected without corresponding DNS query: 136.83.59.155
Source: unknown TCP traffic detected without corresponding DNS query: 73.214.130.145
Source: unknown TCP traffic detected without corresponding DNS query: 121.249.53.175
Source: unknown TCP traffic detected without corresponding DNS query: 169.240.146.149
Source: unknown TCP traffic detected without corresponding DNS query: 107.40.138.15
Source: unknown TCP traffic detected without corresponding DNS query: 205.243.74.225
Source: unknown TCP traffic detected without corresponding DNS query: 37.11.46.218
Source: unknown TCP traffic detected without corresponding DNS query: 163.22.68.36
Source: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6233.1.00007f5784017000.00007f578402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6233.1.00007f5784017000.00007f578402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6237.1.00007f5784017000.00007f578402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6237.1.00007f5784017000.00007f578402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf PID: 6233, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf PID: 6233, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf PID: 6237, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf PID: 6237, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8000
Yara signature match
Source: 6233.1.00007f5784017000.00007f578402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6233.1.00007f5784017000.00007f578402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6237.1.00007f5784017000.00007f578402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6237.1.00007f5784017000.00007f578402b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf PID: 6233, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf PID: 6233, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf PID: 6237, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf PID: 6237, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
ELF contains segments with high entropy indicating compressed/encrypted content
Source: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf Submission file: segment LOAD with 7.959 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf (PID: 6233) Queries kernel information via 'uname': Jump to behavior
Source: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf, 6233.1.00005636df5f7000.00005636df787000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf, 6237.1.00005636df5f7000.00005636df765000.rw-.sdmp Binary or memory string: 6V!/etc/qemu-binfmt/arm
Source: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf, 6233.1.00007fff0f816000.00007fff0f837000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf, 6237.1.00007fff0f816000.00007fff0f837000.rw-.sdmp Binary or memory string: fx86_64/usr/bin/qemu-arm/tmp/SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf
Source: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf, 6233.1.00005636df5f7000.00005636df787000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf, 6237.1.00005636df5f7000.00005636df765000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf, 6233.1.00007fff0f816000.00007fff0f837000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf, 6237.1.00007fff0f816000.00007fff0f837000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 6233.1.00007f5784017000.00007f578402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6237.1.00007f5784017000.00007f578402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf PID: 6233, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf PID: 6237, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 6233.1.00007f5784017000.00007f578402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6237.1.00007f5784017000.00007f578402b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf PID: 6233, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf PID: 6237, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.210.180.53
 unknown Slovakia (SLOVAK Republic)
48304 DIGMIA-AS1JBDI-RIPESK false
148.63.42.189
 unknown Portugal
12353 VODAFONE-PTVodafonePortugalPT false
192.218.202.106
 unknown Japan 18260 E-CATVEHIMECATVCOLTDJP false
147.197.151.44
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
161.171.219.124
 unknown United States
10695 WAL-MARTUS false
113.100.179.78
 unknown China
58466 CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN false
16.206.39.191
 unknown United States
unknown unknown false
155.120.253.229
 unknown United States
11003 PANDGUS false
211.88.30.36
 unknown China
9306 CIECC-AS-APChinaInternationalElectronicCommerceCenter false
74.241.94.20
 unknown United States
19108 SUDDENLINK-COMMUNICATIONSUS false
96.138.130.74
 unknown United States
7922 COMCAST-7922US false
4.203.11.59
 unknown United States
3356 LEVEL3US false
111.191.97.245
 unknown Japan 37903 EMOBILEYmobileCorporationJP false
2.193.111.196
 unknown Italy
16232 ASN-TIMServiceProviderIT false
216.21.133.253
 unknown Canada
15247 RADIANT-VANCOUVERCA false
195.39.226.196
 unknown Germany
28961 CANDA-ASCAServicesGmbHCoOHGDE false
75.98.214.170
 unknown United States
11352 IOMAR-11352US false
105.61.105.228
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
177.147.230.221
 unknown Brazil
26599 TELEFONICABRASILSABR false
82.230.148.33
 unknown France
12322 PROXADFR false
27.236.18.133
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
193.205.75.42
 unknown Italy
137 ASGARRConsortiumGARREU false
245.92.170.108
 unknown Reserved
unknown unknown false
73.191.243.79
 unknown United States
7922 COMCAST-7922US false
112.49.210.162
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
163.105.165.181
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
253.84.155.87
 unknown Reserved
unknown unknown false
72.12.177.92
 unknown Canada
812 ROGERS-COMMUNICATIONSCA false
70.176.232.243
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
203.44.167.11
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
85.146.69.242
 unknown Netherlands
50266 TMOBILE-THUISNL false
241.95.137.75
 unknown Reserved
unknown unknown false
221.133.146.93
 unknown Korea Republic of
38096 QRIXNETNW-AS-KRQrixnowoncableIncKR false
65.166.119.182
 unknown United States
12241 NCTCNET-AS1US false
185.156.132.191
 unknown Italy
20924 ICTEAMIT false
40.232.218.66
 unknown United States
4249 LILLY-ASUS false
67.138.162.223
 unknown United States
7385 ALLSTREAMUS false
255.249.26.1
 unknown Reserved
unknown unknown false
72.125.33.166
 unknown United States
22394 CELLCOUS false
194.106.23.177
 unknown Spain
6739 ONO-ASCableuropa-ONOES false
251.193.227.127
 unknown Reserved
unknown unknown false
92.170.233.75
 unknown France
3215 FranceTelecom-OrangeFR false
100.131.24.157
 unknown United States
21928 T-MOBILE-AS21928US false
97.144.141.119
 unknown United States
6167 CELLCO-PARTUS false
249.124.124.207
 unknown Reserved
unknown unknown false
120.183.53.83
 unknown Indonesia
4761 INDOSAT-INP-APINDOSATInternetNetworkProviderID false
223.58.231.31
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
255.113.32.48
 unknown Reserved
unknown unknown false
4.72.148.203
 unknown United States
3356 LEVEL3US false
32.63.252.0
 unknown United States
2687 ATGS-MMD-ASUS false
23.202.150.4
 unknown United States
20940 AKAMAI-ASN1EU false
84.79.174.79
 unknown Spain
12479 UNI2-ASES false
2.202.212.220
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
45.127.118.176
 unknown China
40138 MDNETUS false
241.44.124.55
 unknown Reserved
unknown unknown false
163.218.2.56
 unknown Japan 7502 IP-KYOTOAdvancedSoftwareTechnologyManagementResearch false
5.177.206.3
 unknown Turkey
20978 TT_MOBILIstanbulTR false
178.217.103.68
 unknown Russian Federation
196936 ASARTTELECOMRU false
27.151.50.170
 unknown China
133774 CHINATELECOM-FUJIAN-FUZHOU-IDC1FuzhouCN false
133.232.137.18
 unknown Japan 2514 INFOSPHERENTTPCCommunicationsIncJP false
184.77.13.166
 unknown United States
16509 AMAZON-02US false
213.148.251.97
 unknown Netherlands
12871 NL-CONCEPTSNL false
167.161.113.113
 unknown United States
59447 SAYFANETTR false
121.21.248.50
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
170.42.130.137
 unknown United States
264957 CoopercitrusCooperativadeProdutoresRuraisBR false
209.153.194.78
 unknown Canada
15290 ALLST-15290CA false
191.175.223.26
 unknown Brazil
26615 TIMSABR false
161.74.29.118
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
217.239.206.221
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
106.210.145.55
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
155.32.178.161
 unknown New Zealand
24324 KORDIA-TRANSIT-AS-APKordiaLimitedNZ false
206.143.42.223
 unknown United States
7991 CENTURYLINK-LEGACY-SAVVIS-ASIA-TRANSITUS false
222.183.82.230
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
112.163.240.238
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
192.105.140.229
 unknown United States
29765 DATACHAMBERSUS false
217.98.225.67
 unknown Poland
5617 TPNETPL false
164.3.41.98
 unknown Austria
8387 T-SYSTEMS-ATRennweg97-99AT false
8.243.4.111
 unknown United States
3356 LEVEL3US false
99.56.191.33
 unknown United States
7018 ATT-INTERNET4US false
255.90.183.162
 unknown Reserved
unknown unknown false
75.64.5.32
 unknown United States
7922 COMCAST-7922US false
123.16.167.191
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
196.71.99.131
 unknown Morocco
6713 IAM-ASMA false
41.203.64.85
 unknown Nigeria
37148 globacom-asNG false
175.101.70.159
 unknown India
17754 EXCELL-ASExcellmediaIN false
89.154.247.83
 unknown Portugal
2860 NOS_COMUNICACOESPT false
198.210.56.78
 unknown United States
395111 KVCNET-2009US false
108.54.212.127
 unknown United States
701 UUNETUS false
1.216.60.60
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
198.75.164.30
 unknown United States
35350 AS_SCHWARZ_PHARMA_AGAlfred-Nobel-Str10DE false
183.72.4.223
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
68.184.75.133
 unknown United States
20115 CHARTER-20115US false
45.252.168.106
 unknown China
132116 ANINETWORK-INAniNetworkPvtLtdIN false
79.79.97.155
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
83.176.24.153
 unknown Sweden
1257 TELE2EU false
93.10.235.225
 unknown France
15557 LDCOMNETFR false
173.150.128.233
 unknown United States
10507 SPCSUS false
249.118.248.253
 unknown Reserved
unknown unknown false
89.9.70.62
 unknown Norway
12929 NETCOM-ASOsloNorwayNO false
80.61.25.78
 unknown Netherlands
1136 KPNKPNNationalEU false