Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1530533
MD5: 35b764af369429062bb1037070f9a543
SHA1: 0287d9dff48a2ded00f050ec10bba655b38449de
SHA256: aa4c5af6443992f3451478172deae3bfebbf87137d5fb2838ed424134290bffb
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 80
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: na.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 71%
Source: na.elf Virustotal: Detection: 64% Perma Link
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:59968 -> 45.139.104.161:1312
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 45.139.104.161
Source: unknown TCP traffic detected without corresponding DNS query: 45.139.104.161
Source: unknown TCP traffic detected without corresponding DNS query: 45.139.104.161
Source: unknown TCP traffic detected without corresponding DNS query: 141.193.66.91
Source: unknown TCP traffic detected without corresponding DNS query: 173.200.4.54
Source: unknown TCP traffic detected without corresponding DNS query: 204.90.122.92
Source: unknown TCP traffic detected without corresponding DNS query: 9.220.16.81
Source: unknown TCP traffic detected without corresponding DNS query: 188.228.197.79
Source: unknown TCP traffic detected without corresponding DNS query: 32.236.201.75
Source: unknown TCP traffic detected without corresponding DNS query: 189.249.200.234
Source: unknown TCP traffic detected without corresponding DNS query: 96.109.161.235
Source: unknown TCP traffic detected without corresponding DNS query: 67.230.172.134
Source: unknown TCP traffic detected without corresponding DNS query: 245.209.160.107
Source: unknown TCP traffic detected without corresponding DNS query: 100.50.128.51
Source: unknown TCP traffic detected without corresponding DNS query: 179.39.127.141
Source: unknown TCP traffic detected without corresponding DNS query: 255.191.117.241
Source: unknown TCP traffic detected without corresponding DNS query: 2.175.130.28
Source: unknown TCP traffic detected without corresponding DNS query: 203.190.98.161
Source: unknown TCP traffic detected without corresponding DNS query: 161.49.23.98
Source: unknown TCP traffic detected without corresponding DNS query: 92.71.130.20
Source: unknown TCP traffic detected without corresponding DNS query: 209.187.164.135
Source: unknown TCP traffic detected without corresponding DNS query: 101.18.2.48
Source: unknown TCP traffic detected without corresponding DNS query: 104.149.213.230
Source: unknown TCP traffic detected without corresponding DNS query: 145.14.231.112
Source: unknown TCP traffic detected without corresponding DNS query: 251.129.84.16
Source: unknown TCP traffic detected without corresponding DNS query: 84.99.145.221
Source: unknown TCP traffic detected without corresponding DNS query: 113.87.114.254
Source: unknown TCP traffic detected without corresponding DNS query: 203.176.45.50
Source: unknown TCP traffic detected without corresponding DNS query: 135.21.235.110
Source: unknown TCP traffic detected without corresponding DNS query: 77.115.102.210
Source: unknown TCP traffic detected without corresponding DNS query: 98.243.71.47
Source: unknown TCP traffic detected without corresponding DNS query: 27.248.173.107
Source: unknown TCP traffic detected without corresponding DNS query: 63.213.231.220
Source: unknown TCP traffic detected without corresponding DNS query: 2.213.165.75
Source: unknown TCP traffic detected without corresponding DNS query: 77.36.85.17
Source: unknown TCP traffic detected without corresponding DNS query: 95.42.84.95
Source: unknown TCP traffic detected without corresponding DNS query: 13.77.1.225
Source: unknown TCP traffic detected without corresponding DNS query: 146.145.55.164
Source: unknown TCP traffic detected without corresponding DNS query: 80.64.202.4
Source: unknown TCP traffic detected without corresponding DNS query: 74.253.57.224
Source: unknown TCP traffic detected without corresponding DNS query: 145.253.82.40
Source: unknown TCP traffic detected without corresponding DNS query: 75.253.149.63
Source: unknown TCP traffic detected without corresponding DNS query: 103.189.221.181
Source: unknown TCP traffic detected without corresponding DNS query: 154.250.239.200
Source: unknown TCP traffic detected without corresponding DNS query: 125.100.208.38
Source: unknown TCP traffic detected without corresponding DNS query: 74.122.117.83
Source: unknown TCP traffic detected without corresponding DNS query: 74.86.31.132
Source: unknown TCP traffic detected without corresponding DNS query: 16.39.113.53
Source: unknown TCP traffic detected without corresponding DNS query: 116.221.86.146
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: na.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6243.1.00007f0f84400000.00007f0f84410000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6247.1.00007f0f84400000.00007f0f84410000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6257.1.00007f0f84400000.00007f0f84410000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: na.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6243.1.00007f0f84400000.00007f0f84410000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6247.1.00007f0f84400000.00007f0f84410000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6257.1.00007f0f84400000.00007f0f84410000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: classification engine Classification label: mal80.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2275/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/3088/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2302/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/3236/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2146/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/910/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/4444/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/6227/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/4445/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/912/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/4446/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/517/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/759/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/6228/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2307/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/918/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/6245/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/6366/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2285/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2281/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/761/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/884/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1860/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2156/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/800/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/801/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1629/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1627/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/6258/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/3021/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/491/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2294/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2050/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/772/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1633/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/4509/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1632/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/774/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1477/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/654/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/896/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1476/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1872/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2048/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/655/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1475/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2289/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/656/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/777/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/657/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/658/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/419/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/936/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1639/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/4503/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1638/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/4505/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2208/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2180/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1809/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1494/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1890/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2063/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2062/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/6261/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1888/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1886/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/420/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1489/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/785/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1642/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/788/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/667/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/789/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/6138/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/6259/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/1648/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2078/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2077/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2074/exe Jump to behavior
Source: /tmp/na.elf (PID: 6251) File opened: /proc/2195/exe Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 6243) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 6243.1.00007ffce4e6c000.00007ffce4e8d000.rw-.sdmp, na.elf, 6247.1.00007ffce4e6c000.00007ffce4e8d000.rw-.sdmp, na.elf, 6257.1.00007ffce4e6c000.00007ffce4e8d000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: na.elf, 6243.1.00007ffce4e6c000.00007ffce4e8d000.rw-.sdmp, na.elf, 6247.1.00007ffce4e6c000.00007ffce4e8d000.rw-.sdmp, na.elf, 6257.1.00007ffce4e6c000.00007ffce4e8d000.rw-.sdmp Binary or memory string: dx86_64/usr/bin/qemu-sh4/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 6243.1.000056350a993000.000056350a9f6000.rw-.sdmp, na.elf, 6247.1.000056350a993000.000056350a9f6000.rw-.sdmp, na.elf, 6257.1.000056350a993000.000056350a9f6000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: na.elf, 6243.1.000056350a993000.000056350a9f6000.rw-.sdmp, na.elf, 6247.1.000056350a993000.000056350a9f6000.rw-.sdmp, na.elf, 6257.1.000056350a993000.000056350a9f6000.rw-.sdmp Binary or memory string: 5V5!/etc/qemu-binfmt/sh4

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 6243.1.00007f0f84400000.00007f0f84410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6247.1.00007f0f84400000.00007f0f84410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6257.1.00007f0f84400000.00007f0f84410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 6243, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 6247, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 6257, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: na.elf, type: SAMPLE
Source: Yara match File source: 6243.1.00007f0f84400000.00007f0f84410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6247.1.00007f0f84400000.00007f0f84410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6257.1.00007f0f84400000.00007f0f84410000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 6243, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 6247, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 6257, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
113.184.12.192
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
35.196.88.99
 unknown United States
15169 GOOGLEUS false
189.20.106.233
 unknown Brazil
10429 TELEFONICABRASILSABR false
243.175.145.209
 unknown Reserved
unknown unknown false
173.199.56.227
 unknown United States
16509 AMAZON-02US false
202.216.32.73
 unknown Japan 4704 SANNETRakutenMobileIncJP false
69.135.178.144
 unknown United States
10796 TWC-10796-MIDWESTUS false
156.111.160.219
 unknown United States
395139 NYP-INTERNETUS false
153.116.172.137
 unknown United States
5501 FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe false
136.131.18.100
 unknown United States
60311 ONEFMCH false
135.42.166.5
 unknown United States
8030 WORLDNET5-10US false
41.198.207.230
 unknown South Africa
327693 ECHO-SPZA false
24.85.239.137
 unknown Canada
6327 SHAWCA false
43.166.243.11
 unknown Japan 4249 LILLY-ASUS false
53.95.249.23
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
148.49.209.35
 unknown United States
721 DNIC-ASBLK-00721-00726US false
83.184.207.80
 unknown Sweden
1257 TELE2EU false
46.139.20.11
 unknown Hungary
5483 MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU false
84.128.101.78
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
175.156.160.56
 unknown Singapore
4773 MOBILEONELTD-AS-APMobileOneLtdMobileInternetServicePr false
247.106.195.147
 unknown Reserved
unknown unknown false
24.248.177.15
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
41.197.85.118
 unknown Rwanda
36934 Broadband-Systems-CorporationRW false
13.9.20.80
 unknown United States
26662 XEROX-WVUS false
194.72.93.236
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
219.189.6.3
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
105.118.80.53
 unknown Nigeria
36873 VNL1-ASNG false
181.136.142.227
 unknown Colombia
13489 EPMTelecomunicacionesSAESPCO false
13.251.56.40
 unknown United States
16509 AMAZON-02US false
42.120.45.81
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
209.193.118.31
 unknown Reserved
36026 AS-CHI-CORPUS false
149.198.13.172
 unknown United States
8386 KOCNETTR false
18.217.104.207
 unknown United States
16509 AMAZON-02US false
119.93.173.71
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
181.67.45.194
 unknown Peru
6147 TelefonicadelPeruSAAPE false
110.229.133.153
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
170.201.46.47
 unknown United States
10995 PNCBANKUS false
94.11.75.148
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
77.102.6.238
 unknown United Kingdom
5089 NTLGB false
213.26.134.139
 unknown Italy
3269 ASN-IBSNAZIT false
86.225.56.189
 unknown France
3215 FranceTelecom-OrangeFR false
173.70.19.40
 unknown United States
701 UUNETUS false
98.220.218.57
 unknown United States
7922 COMCAST-7922US false
61.117.229.60
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
144.88.238.29
 unknown United States
62989 IUPUS false
182.67.111.221
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
142.198.98.88
 unknown Canada
33363 BHN-33363US false
48.209.104.86
 unknown United States
2686 ATGS-MMD-ASUS false
71.210.65.82
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
195.180.96.255
 unknown Germany
4589 EASYNETEasynetGlobalServicesEU false
110.203.7.14
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
191.142.154.252
 unknown Brazil
26615 TIMSABR false
221.112.146.5
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
97.219.217.53
 unknown United States
6167 CELLCO-PARTUS false
196.224.36.125
 unknown Tunisia
37492 ORANGE-TN false
119.46.248.164
 unknown Thailand
7470 TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH false
151.181.148.223
 unknown United States
3576 AS-HODGSON-RUSS-NETUS false
75.195.23.226
 unknown United States
22394 CELLCOUS false
104.63.170.183
 unknown United States
7018 ATT-INTERNET4US false
107.135.148.135
 unknown United States
7018 ATT-INTERNET4US false
85.181.32.98
 unknown Germany
6805 TDDE-ASN1DE false
201.205.22.91
 unknown Costa Rica
11830 InstitutoCostarricensedeElectricidadyTelecomCR false
32.64.20.192
 unknown United States
2686 ATGS-MMD-ASUS false
113.97.130.185
 unknown China
58466 CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN false
240.11.249.170
 unknown Reserved
unknown unknown false
14.108.129.182
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
207.68.221.21
 unknown United States
12241 NCTCNET-AS1US false
117.78.79.93
 unknown China
55990 HWCSNETHuaweiCloudServicedatacenterCN false
68.236.140.4
 unknown United States
701 UUNETUS false
244.20.42.56
 unknown Reserved
unknown unknown false
60.19.228.246
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
77.140.119.216
 unknown France
15557 LDCOMNETFR false
176.221.7.96
 unknown Russian Federation
31724 SVYAZIST-ASRU false
63.168.236.17
 unknown United States
1239 SPRINTLINKUS false
199.77.160.242
 unknown United States
3549 LVLT-3549US false
84.56.216.156
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
2.175.20.139
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
88.188.222.188
 unknown France
12322 PROXADFR false
16.232.122.151
 unknown United States
unknown unknown false
201.20.214.52
 unknown Brazil
19182 TELEFONICABRASILSABR false
85.159.50.219
 unknown Hungary
44651 COMUNIQUEHU false
125.235.80.150
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
105.91.75.144
 unknown Egypt
36992 ETISALAT-MISREG false
145.173.25.164
 unknown Netherlands
59524 KPN-IAASNL false
117.148.125.114
 unknown China
56041 CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC false
182.195.204.54
 unknown Korea Republic of
6619 SAMSUNGSDS-AS-KRSamsungSDSIncKR false
24.178.88.154
 unknown United States
20115 CHARTER-20115US false
45.20.156.208
 unknown United States
7018 ATT-INTERNET4US false
53.66.109.155
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
83.247.170.88
 unknown Spain
39551 GENCAT-ASES false
185.142.235.50
 unknown Iran (ISLAMIC Republic Of)
206065 FDIIR false
104.8.154.31
 unknown United States
7018 ATT-INTERNET4US false
251.11.27.75
 unknown Reserved
unknown unknown false
140.246.191.71
 unknown China
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
144.76.188.198
 unknown Germany
24940 HETZNER-ASDE false
185.114.209.219
 unknown Switzerland
199366 TTNETDCTR false
216.56.176.75
 unknown United States
2381 WISCNET1-ASUS false
5.65.105.23
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
217.195.149.228
 unknown Germany
9558 PRIMECROWN-AS-INPrimeCrownTechnologiesPrivateLimitedIN false
190.213.225.178
 unknown Trinidad and Tobago
27665 ColumbusCommunicationsTrinidadLimitedTT false