Linux Analysis Report
na.elf

Overview

General Information

Sample name: na.elf
Analysis ID: 1530538
MD5: d26f3cfd3a16240d632a7f90f2760bc8
SHA1: 1bad23d10416eada53842eae391d569884c2b1d5
SHA256: 459427e7bd4590969d19e1e9d6919d717bd5be8e9926e2db538e243546c0e097
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: na.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: na.elf ReversingLabs: Detection: 55%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:59962 -> 45.139.104.161:1312
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 45.139.104.161
Source: unknown TCP traffic detected without corresponding DNS query: 45.139.104.161
Source: unknown TCP traffic detected without corresponding DNS query: 45.139.104.161
Source: unknown TCP traffic detected without corresponding DNS query: 40.235.254.222
Source: unknown TCP traffic detected without corresponding DNS query: 38.72.180.171
Source: unknown TCP traffic detected without corresponding DNS query: 84.133.21.133
Source: unknown TCP traffic detected without corresponding DNS query: 58.163.30.27
Source: unknown TCP traffic detected without corresponding DNS query: 60.2.95.123
Source: unknown TCP traffic detected without corresponding DNS query: 104.177.42.255
Source: unknown TCP traffic detected without corresponding DNS query: 76.211.165.222
Source: unknown TCP traffic detected without corresponding DNS query: 111.226.199.143
Source: unknown TCP traffic detected without corresponding DNS query: 170.65.148.3
Source: unknown TCP traffic detected without corresponding DNS query: 101.184.221.237
Source: unknown TCP traffic detected without corresponding DNS query: 168.136.215.143
Source: unknown TCP traffic detected without corresponding DNS query: 123.59.97.30
Source: unknown TCP traffic detected without corresponding DNS query: 220.84.9.114
Source: unknown TCP traffic detected without corresponding DNS query: 66.145.111.75
Source: unknown TCP traffic detected without corresponding DNS query: 126.58.115.234
Source: unknown TCP traffic detected without corresponding DNS query: 192.30.0.163
Source: unknown TCP traffic detected without corresponding DNS query: 192.120.64.222
Source: unknown TCP traffic detected without corresponding DNS query: 98.115.23.94
Source: unknown TCP traffic detected without corresponding DNS query: 94.36.76.246
Source: unknown TCP traffic detected without corresponding DNS query: 87.118.199.244
Source: unknown TCP traffic detected without corresponding DNS query: 93.182.111.94
Source: unknown TCP traffic detected without corresponding DNS query: 124.94.244.152
Source: unknown TCP traffic detected without corresponding DNS query: 201.228.46.60
Source: unknown TCP traffic detected without corresponding DNS query: 94.144.174.250
Source: unknown TCP traffic detected without corresponding DNS query: 142.21.76.106
Source: unknown TCP traffic detected without corresponding DNS query: 85.155.60.15
Source: unknown TCP traffic detected without corresponding DNS query: 254.13.209.55
Source: unknown TCP traffic detected without corresponding DNS query: 71.194.163.97
Source: unknown TCP traffic detected without corresponding DNS query: 221.196.5.63
Source: unknown TCP traffic detected without corresponding DNS query: 254.171.172.186
Source: unknown TCP traffic detected without corresponding DNS query: 53.109.128.15
Source: unknown TCP traffic detected without corresponding DNS query: 177.250.219.2
Source: unknown TCP traffic detected without corresponding DNS query: 4.140.9.131
Source: unknown TCP traffic detected without corresponding DNS query: 95.197.137.211
Source: unknown TCP traffic detected without corresponding DNS query: 90.188.64.89
Source: unknown TCP traffic detected without corresponding DNS query: 193.84.25.150
Source: unknown TCP traffic detected without corresponding DNS query: 191.7.159.60
Source: unknown TCP traffic detected without corresponding DNS query: 70.100.60.195
Source: unknown TCP traffic detected without corresponding DNS query: 122.51.163.65
Source: unknown TCP traffic detected without corresponding DNS query: 191.159.128.2
Source: unknown TCP traffic detected without corresponding DNS query: 109.32.154.32
Source: unknown TCP traffic detected without corresponding DNS query: 161.253.172.116
Source: unknown TCP traffic detected without corresponding DNS query: 75.239.252.166
Source: unknown TCP traffic detected without corresponding DNS query: 252.67.215.180
Source: unknown TCP traffic detected without corresponding DNS query: 45.185.71.67
Source: unknown TCP traffic detected without corresponding DNS query: 31.85.150.138
Source: unknown TCP traffic detected without corresponding DNS query: 58.78.164.242
Source: na.elf String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x100000
Source: classification engine Classification label: mal68.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/na.elf (PID: 6220) File opened: /proc/6196/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/6231/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2275/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/3088/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/6195/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2302/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/3236/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2146/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/910/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/6227/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/6226/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/912/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/517/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/759/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2307/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/918/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/4460/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/4461/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2285/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2281/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/761/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/884/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2156/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/800/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/801/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1629/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/4458/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/4459/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1627/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/3021/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/491/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2294/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2050/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/772/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1633/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1632/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/774/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1477/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/654/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/896/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1476/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1872/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2048/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/655/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1475/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2289/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/656/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/777/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/657/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/658/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/419/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/936/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1639/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1638/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2208/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2180/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/4482/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1809/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/4487/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1494/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1890/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2063/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2062/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1888/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1886/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/420/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1489/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/785/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1642/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/788/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/667/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/789/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/1648/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/4492/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/4494/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2078/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2077/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2074/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2195/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/670/exe Jump to behavior
Source: /tmp/na.elf (PID: 6220) File opened: /proc/2746/exe Jump to behavior
ELF contains segments with high entropy indicating compressed/encrypted content
Source: na.elf Submission file: segment LOAD with 7.934 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/na.elf (PID: 6218) Queries kernel information via 'uname': Jump to behavior
Source: na.elf, 6218.1.0000558e2eb61000.0000558e2ec11000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: na.elf, 6218.1.00007ffeb1a9e000.00007ffeb1abf000.rw-.sdmp, na.elf, 6221.1.00007ffeb1a9e000.00007ffeb1abf000.rw-.sdmp, na.elf, 6229.1.00007ffeb1a9e000.00007ffeb1abf000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 6221.1.0000558e2eb61000.0000558e2ec11000.rw-.sdmp, na.elf, 6229.1.0000558e2eb61000.0000558e2ec11000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: na.elf, 6218.1.0000558e2eb61000.0000558e2ec11000.rw-.sdmp, na.elf, 6221.1.0000558e2eb61000.0000558e2ec11000.rw-.sdmp, na.elf, 6229.1.0000558e2eb61000.0000558e2ec11000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: na.elf, 6218.1.00007ffeb1a9e000.00007ffeb1abf000.rw-.sdmp, na.elf, 6221.1.00007ffeb1a9e000.00007ffeb1abf000.rw-.sdmp, na.elf, 6229.1.00007ffeb1a9e000.00007ffeb1abf000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 6229.1.00007f770c00a000.00007f770c010000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6218.1.00007f770c00a000.00007f770c010000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6221.1.00007f770c00a000.00007f770c010000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 6218, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 6221, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 6229, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 6229.1.00007f770c00a000.00007f770c010000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6218.1.00007f770c00a000.00007f770c010000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6221.1.00007f770c00a000.00007f770c010000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: na.elf PID: 6218, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 6221, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: na.elf PID: 6229, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
1.189.204.14
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
78.226.10.19
 unknown France
12322 PROXADFR false
116.116.199.28
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
200.2.160.145
 unknown Suriname
27775 TelecommunicationcompanySuriname-TeleSurSR false
89.190.160.87
 unknown Italy
20811 BRENNERCOM-ASIT false
27.167.214.255
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
165.138.77.160
 unknown United States
11686 ENAUS false
75.67.106.131
 unknown United States
7922 COMCAST-7922US false
141.225.81.46
 unknown United States
14048 MEMPHIS-EDUUS false
185.68.174.115
 unknown Netherlands
59865 IVMNL false
91.244.32.85
 unknown Ukraine
25133 MCLAUT-ASUA false
88.214.61.214
 unknown Bosnia and Herzegowina
47959 TELINEABA false
248.118.41.2
 unknown Reserved
unknown unknown false
103.216.103.1
 unknown Hong Kong
135391 AOFEI-HKAOFEIDATAINTERNATIONALCOMPANYLIMITEDHK false
54.138.65.72
 unknown United States
14618 AMAZON-AESUS false
150.103.247.7
 unknown United States
2907 SINET-ASResearchOrganizationofInformationandSystemsN false
166.71.26.167
 unknown United States
6315 XMISSIONUS false
88.198.80.142
 unknown Germany
24940 HETZNER-ASDE false
103.153.150.160
 unknown unknown
134687 TWIDC-AS-APTWIDCLimitedHK false
38.230.129.59
 unknown United States
174 COGENT-174US false
186.223.58.122
 unknown Brazil
28573 CLAROSABR false
154.145.187.144
 unknown Morocco
6713 IAM-ASMA false
34.211.52.183
 unknown United States
16509 AMAZON-02US false
60.101.203.33
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
154.255.14.98
 unknown Algeria
36947 ALGTEL-ASDZ false
78.101.119.16
 unknown Qatar
42298 GCC-MPLS-PEERINGGCCMPLSpeeringQA false
247.62.6.182
 unknown Reserved
unknown unknown false
254.33.22.183
 unknown Reserved
unknown unknown false
118.106.26.225
 unknown Japan 18126 CTCXChubuTelecommunicationsCompanyIncJP false
167.174.106.205
 unknown United States
14061 DIGITALOCEAN-ASNUS false
208.26.94.78
 unknown United States
16705 LOGIC-CAYMAN-TELECAYMANKY false
97.167.18.117
 unknown United States
6167 CELLCO-PARTUS false
73.118.219.16
 unknown United States
7922 COMCAST-7922US false
165.221.231.20
 unknown United States
4152 USDA-1US false
120.76.236.10
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
154.172.105.149
 unknown Ghana
30986 SCANCOMGH false
200.164.68.138
 unknown Brazil
7738 TelemarNorteLesteSABR false
223.10.93.249
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
39.234.172.192
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
12.238.136.28
 unknown United States
7018 ATT-INTERNET4US false
179.11.198.199
 unknown Brazil
26615 TIMSABR false
48.21.95.70
 unknown United States
2686 ATGS-MMD-ASUS false
92.26.100.219
 unknown United Kingdom
13285 OPALTELECOM-ASTalkTalkCommunicationsLimitedGB false
100.149.110.145
 unknown United States
21928 T-MOBILE-AS21928US false
84.253.222.100
 unknown Finland
16086 DNAFI false
17.196.153.83
 unknown United States
714 APPLE-ENGINEERINGUS false
167.22.238.126
 unknown United States
11273 FDCSGNETUS false
114.109.253.243
 unknown Thailand
17552 TRUE-AS-APTrueInternetCoLtdTH false
205.177.141.69
 unknown United States
3491 BTN-ASNUS false
64.34.150.55
 unknown Canada
13768 COGECO-PEER1CA false
119.138.116.29
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
196.200.10.205
 unknown South Africa
7020 QDATA-ASZA false
216.251.0.207
 unknown United States
11067 PTSINETUS false
74.27.72.18
 unknown United States
7922 COMCAST-7922US false
211.166.104.109
 unknown China
9389 UNSPECIFIEDBEIJINGSHENZHOUGREATWALLCOMMUNICATIONCN false
38.112.42.98
 unknown United States
174 COGENT-174US false
189.204.169.105
 unknown Mexico
18734 OperbesSAdeCVMX false
104.62.108.192
 unknown United States
7018 ATT-INTERNET4US false
105.97.32.212
 unknown Algeria
36947 ALGTEL-ASDZ false
69.199.226.218
 unknown United States
17184 ATL-CBEYONDUS false
157.175.218.43
 unknown United States
16509 AMAZON-02US false
58.122.29.64
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
193.48.187.113
 unknown France
2200 FR-RENATERReseauNationaldetelecommunicationspourlaTec false
146.109.131.104
 unknown Switzerland
15733 ZUMTOBEL-ASCorporateDatacenterAustriaAT false
184.112.231.64
 unknown United States
7922 COMCAST-7922US false
249.220.69.104
 unknown Reserved
unknown unknown false
8.97.199.231
 unknown United States
3356 LEVEL3US false
169.164.90.15
 unknown United States
37611 AfrihostZA false
198.30.218.162
 unknown United States
600 OARNET-ASUS false
74.72.90.60
 unknown United States
12271 TWC-12271-NYCUS false
193.245.155.24
 unknown Belgium
3549 LVLT-3549US false
60.208.250.206
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
121.149.246.197
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
69.136.23.161
 unknown United States
7922 COMCAST-7922US false
188.199.42.71
 unknown Slovenia
5603 SIOL-NETTelekomSlovenijeddSI false
107.244.66.105
 unknown United States
7018 ATT-INTERNET4US false
212.111.95.211
 unknown Russian Federation
9110 AGTELECOM-ASRU false
197.190.198.137
 unknown Ghana
37140 zain-asGH false
86.52.153.76
 unknown Denmark
197288 STOFANETDK false
222.159.151.195
 unknown Japan 2510 INFOWEBFUJITSULIMITEDJP false
250.167.171.232
 unknown Reserved
unknown unknown false
149.95.226.175
 unknown United States
174 COGENT-174US false
18.211.129.165
 unknown United States
14618 AMAZON-AESUS false
42.254.157.107
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
42.103.27.196
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
221.145.46.113
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
184.160.89.178
 unknown Canada
5769 VIDEOTRONCA false
16.116.45.85
 unknown United States
unknown unknown false
245.158.223.25
 unknown Reserved
unknown unknown false
190.74.68.168
 unknown Venezuela
8048 CANTVServiciosVenezuelaVE false
75.123.76.96
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
249.81.125.51
 unknown Reserved
unknown unknown false
133.184.225.171
 unknown Japan 385 AFCONC-BLOCK1-ASUS false
8.114.45.17
 unknown United States
3356 LEVEL3US false
159.193.137.173
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
97.141.195.123
 unknown United States
6167 CELLCO-PARTUS false
103.155.241.212
 unknown unknown
134687 TWIDC-AS-APTWIDCLimitedHK false
201.160.50.85
 unknown Mexico
28509 CablemasTelecomunicacionesSAdeCVMX false
122.20.176.213
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
42.203.201.206
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false