Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1530537
MD5: 55b25b35d83491947b7da371e397a85d
SHA1: f98248e3fa53e78e51a7bb3d6d18b19c95b04d3a
SHA256: bd56e19f014f56f69662a5ad20d07b5adc7a61e2d4c6859eb7b97e36381dee0a
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Sample contains only a LOAD segment without any section mappings
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 71%
Source: na.elf Virustotal: Detection: 47% Perma Link
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:42010 -> 45.139.104.161:1312
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 45.139.104.161
Source: unknown TCP traffic detected without corresponding DNS query: 45.139.104.161
Source: unknown TCP traffic detected without corresponding DNS query: 241.74.63.214
Source: unknown TCP traffic detected without corresponding DNS query: 61.115.100.214
Source: unknown TCP traffic detected without corresponding DNS query: 162.174.150.21
Source: unknown TCP traffic detected without corresponding DNS query: 65.93.216.247
Source: unknown TCP traffic detected without corresponding DNS query: 99.225.90.235
Source: unknown TCP traffic detected without corresponding DNS query: 241.50.106.81
Source: unknown TCP traffic detected without corresponding DNS query: 36.159.151.170
Source: unknown TCP traffic detected without corresponding DNS query: 164.89.245.34
Source: unknown TCP traffic detected without corresponding DNS query: 194.117.224.124
Source: unknown TCP traffic detected without corresponding DNS query: 183.144.243.248
Source: unknown TCP traffic detected without corresponding DNS query: 169.51.179.242
Source: unknown TCP traffic detected without corresponding DNS query: 37.11.170.144
Source: unknown TCP traffic detected without corresponding DNS query: 68.172.226.213
Source: unknown TCP traffic detected without corresponding DNS query: 83.142.175.129
Source: unknown TCP traffic detected without corresponding DNS query: 165.172.84.236
Source: unknown TCP traffic detected without corresponding DNS query: 145.218.94.178
Source: unknown TCP traffic detected without corresponding DNS query: 65.148.6.105
Source: unknown TCP traffic detected without corresponding DNS query: 149.157.37.125
Source: unknown TCP traffic detected without corresponding DNS query: 103.209.3.16
Source: unknown TCP traffic detected without corresponding DNS query: 154.72.61.5
Source: unknown TCP traffic detected without corresponding DNS query: 5.91.247.11
Source: unknown TCP traffic detected without corresponding DNS query: 23.65.74.110
Source: unknown TCP traffic detected without corresponding DNS query: 159.3.234.152
Source: unknown TCP traffic detected without corresponding DNS query: 41.38.21.125
Source: unknown TCP traffic detected without corresponding DNS query: 5.158.205.38
Source: unknown TCP traffic detected without corresponding DNS query: 105.150.209.188
Source: unknown TCP traffic detected without corresponding DNS query: 12.242.84.66
Source: unknown TCP traffic detected without corresponding DNS query: 241.151.180.9
Source: unknown TCP traffic detected without corresponding DNS query: 187.187.125.20
Source: unknown TCP traffic detected without corresponding DNS query: 23.127.149.148
Source: unknown TCP traffic detected without corresponding DNS query: 4.128.142.100
Source: unknown TCP traffic detected without corresponding DNS query: 118.244.25.132
Source: unknown TCP traffic detected without corresponding DNS query: 218.211.59.209
Source: unknown TCP traffic detected without corresponding DNS query: 146.201.80.163
Source: unknown TCP traffic detected without corresponding DNS query: 43.204.30.76
Source: unknown TCP traffic detected without corresponding DNS query: 243.57.81.164
Source: unknown TCP traffic detected without corresponding DNS query: 192.48.244.85
Source: unknown TCP traffic detected without corresponding DNS query: 172.166.74.180
Source: unknown TCP traffic detected without corresponding DNS query: 105.240.106.37
Source: unknown TCP traffic detected without corresponding DNS query: 171.152.216.244
Source: unknown TCP traffic detected without corresponding DNS query: 142.205.188.112
Source: unknown TCP traffic detected without corresponding DNS query: 253.12.167.131
Source: unknown TCP traffic detected without corresponding DNS query: 174.2.205.117
Source: unknown TCP traffic detected without corresponding DNS query: 135.242.61.121
Source: unknown TCP traffic detected without corresponding DNS query: 100.26.141.73
Source: unknown TCP traffic detected without corresponding DNS query: 222.139.131.28
Source: unknown TCP traffic detected without corresponding DNS query: 207.151.253.228
Source: unknown TCP traffic detected without corresponding DNS query: 172.97.142.55
Source: na.elf String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5449.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5443.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5441.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5466.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5439.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5456.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5477.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5470.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8000
Yara signature match
Source: 5449.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5443.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5441.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5466.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5439.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5456.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5477.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5470.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: classification engine Classification label: mal76.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
ELF contains segments with high entropy indicating compressed/encrypted content
Source: na.elf Submission file: segment LOAD with 7.9448 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 5439) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 5439.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5441.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5456.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5477.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5466.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5443.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5470.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5449.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp Binary or memory string: bx86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5439.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5441.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5456.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5477.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5466.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5443.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5470.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5449.1.00005630833e4000.00005630835d2000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: na.elf, 5439.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5441.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5456.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5477.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5466.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5443.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5470.1.00005630833e4000.00005630835d2000.rw-.sdmp, na.elf, 5449.1.00005630833e4000.00005630835d2000.rw-.sdmp Binary or memory string: 0V!/etc/qemu-binfmt/arm
Source: na.elf, 5439.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5441.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5456.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5477.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5466.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5443.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5470.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp, na.elf, 5449.1.00007ffe79fda000.00007ffe79ffb000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 5449.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5443.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5441.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5466.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5439.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5456.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5477.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5470.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5439, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5441, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5443, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5456, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5466, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5470, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5477, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 5449.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5443.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5441.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5466.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5439.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5456.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5477.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5470.1.00007fbb08017000.00007fbb08028000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 5439, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5441, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5443, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5456, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5466, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5470, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 5477, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
71.129.27.209
 unknown United States
7018 ATT-INTERNET4US false
133.236.36.252
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
77.199.106.107
 unknown France
15557 LDCOMNETFR false
79.249.255.178
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
148.15.231.7
 unknown United States
394673 9408US false
107.137.175.47
 unknown United States
7018 ATT-INTERNET4US false
73.245.71.240
 unknown United States
7922 COMCAST-7922US false
158.181.70.193
 unknown Germany
20880 TELECOLUMBUSDE false
161.104.78.242
 unknown France
7582 UMAC-AS-APUniversityofMacauMO false
103.141.152.239
 unknown Indonesia
18403 FPT-AS-APTheCorporationforFinancingPromotingTechnolo false
53.35.213.161
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
187.30.103.31
 unknown Brazil
4230 CLAROSABR false
122.93.70.45
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
92.231.75.14
 unknown Germany
6805 TDDE-ASN1DE false
94.182.90.184
 unknown Iran (ISLAMIC Republic Of)
31549 RASANAIR false
62.161.162.140
 unknown France
3215 FranceTelecom-OrangeFR false
75.142.213.254
 unknown United States
20115 CHARTER-20115US false
44.60.215.99
 unknown United States
7377 UCSDUS false
202.160.151.242
 unknown New Zealand
132881 OMNINETLTD-AS-APOmniNetLtdNZ false
160.245.54.158
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
57.9.145.49
 unknown Belgium
2686 ATGS-MMD-ASUS false
208.196.44.19
 unknown United States
701 UUNETUS false
84.143.2.213
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
210.152.115.70
 unknown Japan 4694 IDCFIDCFrontierIncJP false
38.39.145.222
 unknown United States
397311 WTV1951US false
61.74.102.112
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
190.143.63.127
 unknown Colombia
10620 TelmexColombiaSACO false
110.186.106.101
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
66.29.82.33
 unknown United States
8001 NET-ACCESS-CORPUS false
86.63.156.0
 unknown Poland
35274 NPLAY-ASNPLAYPLLublinPolandPL false
118.50.187.252
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
176.191.36.177
 unknown France
5410 BOUYGTEL-ISPFR false
246.9.25.255
 unknown Reserved
unknown unknown false
162.140.66.58
 unknown United States
3705 GPO-NETUS false
114.122.72.249
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
243.57.81.164
 unknown Reserved
unknown unknown false
4.157.186.229
 unknown United States
3356 LEVEL3US false
88.190.10.57
 unknown France
12322 PROXADFR false
190.32.244.42
 unknown Panama
11556 CableWirelessPanamaPA false
32.58.251.76
 unknown United States
7018 ATT-INTERNET4US false
160.172.110.95
 unknown Morocco
6713 IAM-ASMA false
162.180.135.22
 unknown United States
21928 T-MOBILE-AS21928US false
109.216.146.146
 unknown France
3215 FranceTelecom-OrangeFR false
9.120.138.197
 unknown United States
3356 LEVEL3US false
190.243.67.99
 unknown Colombia
26611 COMCELSACO false
163.214.156.102
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
108.225.252.11
 unknown United States
7018 ATT-INTERNET4US false
211.158.10.118
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
191.65.185.134
 unknown Colombia
26611 COMCELSACO false
178.185.162.142
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
40.53.21.94
 unknown United States
4249 LILLY-ASUS false
97.32.200.9
 unknown United States
22394 CELLCOUS false
183.186.246.119
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
24.144.12.77
 unknown United States
12231 CONWAYCORPUS false
148.209.174.30
 unknown Mexico
22122 UniversidadAutonomadeYucatanMX false
210.82.14.95
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
1.107.235.105
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
95.107.11.132
 unknown Russian Federation
41134 CTC-OREL-ASRU false
176.81.232.146
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
76.110.83.53
 unknown United States
7922 COMCAST-7922US false
114.134.127.134
 unknown Japan 4721 JCNJupiterTelecommunicationsCoLtdJP false
104.57.147.11
 unknown United States
7018 ATT-INTERNET4US false
152.166.226.3
 unknown Dominican Republic
28118 ALTICEDOMINICANASADO false
183.59.82.153
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
187.252.127.105
 unknown Mexico
28509 CablemasTelecomunicacionesSAdeCVMX false
42.171.142.173
 unknown China
4249 LILLY-ASUS false
59.190.122.122
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
150.211.205.244
 unknown United States
31822 CITY-UNIVERSITY-OF-NEW-YORKUS false
123.22.248.40
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
9.23.178.127
 unknown United States
3356 LEVEL3US false
206.198.155.36
 unknown United States
46160 SKYTAP-TUKUS false
213.169.178.37
 unknown France
21502 ASN-NUMERICABLEFR false
69.45.210.133
 unknown United States
3356 LEVEL3US false
70.190.69.43
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
182.54.22.195
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
90.129.181.145
 unknown Sweden
1257 TELE2EU false
35.231.72.131
 unknown United States
15169 GOOGLEUS false
58.173.90.138
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
4.199.89.81
 unknown United States
3356 LEVEL3US false
216.177.142.227
 unknown United States
395532 1P-WSSUS false
248.117.118.26
 unknown Reserved
unknown unknown false
179.246.37.158
 unknown Brazil
26599 TELEFONICABRASILSABR false
98.137.77.120
 unknown United States
36647 YAHOO-GQ1US false
217.254.80.224
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
4.211.126.214
 unknown United States
3356 LEVEL3US false
4.150.249.91
 unknown United States
3356 LEVEL3US false
149.113.146.12
 unknown United States
174 COGENT-174US false
75.162.10.153
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
250.210.150.38
 unknown Reserved
unknown unknown false
184.200.221.26
 unknown United States
10507 SPCSUS false
72.5.78.252
 unknown United States
23023 INTUITIVEUS false
111.199.204.231
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
192.149.129.147
 unknown United States
372 AS372US false
40.251.6.151
 unknown United States
4249 LILLY-ASUS false
23.113.241.153
 unknown United States
7018 ATT-INTERNET4US false
175.88.53.243
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
240.202.123.242
 unknown Reserved
unknown unknown false
105.16.27.198
 unknown Mauritius
37100 SEACOM-ASMU false
154.221.154.27
 unknown Seychelles
134548 DXTL-HKDXTLTseungKwanOServiceHK false
191.242.35.177
 unknown Brazil
263469 JPdeSouzaTelecomunicacoesEPPBR false