Linux Analysis Report
botnet.sh4.elf

Overview

General Information

Sample name: botnet.sh4.elf
Analysis ID: 1540919
MD5: d1a2c4c95cfcea8d6d7dce7bbb255f0e
SHA1: c80183898ed191216fc6a42e726633ee39af0bdd
SHA256: 2190fd1904c3ce1f10966e84b97bff30e7366d16f4e0566729804967991f577d
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Detected Mirai
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Mirai
Yara detected Moobot
Detected TCP or UDP traffic on non-standard ports
Executes commands using a shell command-line interpreter
Executes the "chmod" command used to modify permissions
Executes the "mkdir" command used to create folders
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to set the executable flag
Sets full permissions to files and/or directories
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Name Description Attribution Blogpost URLs Link
MooBot No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: botnet.sh4.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: botnet.sh4.elf ReversingLabs: Detection: 63%

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.15:51148 -> 178.215.238.6:56744
Source: Network traffic Suricata IDS: 2030489 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response : 178.215.238.6:56744 -> 192.168.2.15:51148
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:51148 -> 178.215.238.6:56744
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 166.249.158.176:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 105.182.51.182:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 219.151.197.180:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 164.61.255.175:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 196.2.170.194:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 146.161.172.114:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 159.52.22.133:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 13.1.121.13:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 91.157.165.126:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 23.25.59.214:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 61.252.28.1:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 199.119.170.73:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 49.209.80.44:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 62.158.210.225:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 145.242.43.175:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 136.106.53.114:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 97.110.163.207:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 70.107.153.80:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 156.152.154.127:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 166.135.171.40:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 40.165.231.94:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 140.142.154.114:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 93.183.59.79:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 114.123.131.107:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 212.161.172.161:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 220.192.234.16:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 97.247.67.16:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 206.89.164.205:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 40.173.251.253:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 159.140.211.247:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 135.15.208.154:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 174.48.100.131:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 44.124.48.81:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 197.214.207.213:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 45.59.42.0:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 197.91.194.143:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 146.195.237.8:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 210.70.204.81:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 65.34.65.185:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 208.207.22.5:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 67.184.71.240:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 76.126.248.137:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 162.86.91.202:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 131.109.47.233:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 82.246.10.204:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 176.142.131.213:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 1.244.227.213:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 45.91.1.218:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 176.30.59.254:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 157.150.172.193:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 219.205.34.138:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 185.122.2.46:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 60.96.42.36:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 94.196.10.185:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 82.94.66.79:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 136.104.149.8:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 189.57.94.164:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 23.32.201.153:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 47.41.171.7:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 104.222.24.17:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 164.77.57.4:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 46.191.225.100:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 200.125.98.119:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 161.113.91.63:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 43.110.104.179:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 186.42.209.51:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 138.236.184.47:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 166.15.37.230:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 174.24.25.36:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 122.3.60.228:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 216.143.219.139:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 19.150.111.139:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 64.250.90.233:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 212.181.122.210:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 106.228.76.37:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 83.96.88.200:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 136.176.204.183:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 100.212.167.114:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 37.133.251.171:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 210.252.78.139:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 180.28.6.188:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 162.37.25.207:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 173.224.120.160:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 141.208.59.243:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 38.68.191.242:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 63.210.38.226:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 80.243.193.143:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 97.187.193.211:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 185.70.56.136:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 180.51.203.77:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 34.58.194.237:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 82.152.246.203:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 19.46.77.220:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 40.200.82.182:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 85.247.32.26:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 213.127.226.182:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 183.255.161.47:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 103.22.80.50:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 1.72.130.181:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 177.152.47.222:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 158.154.113.72:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 114.4.34.195:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 154.248.96.181:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 8.178.222.9:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 43.118.77.16:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 223.170.145.209:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 116.51.175.43:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 121.0.91.198:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 134.176.85.12:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 12.87.197.53:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 122.228.212.239:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 130.128.82.30:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 174.64.189.163:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 46.110.124.123:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 103.24.26.252:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 43.108.198.162:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 20.132.91.204:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 142.65.78.26:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 143.236.155.204:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 137.186.211.158:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 81.194.217.79:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 90.136.178.149:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 173.241.37.81:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 64.141.97.132:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 40.166.247.38:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 27.208.52.29:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 111.28.160.109:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 85.254.84.79:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 121.229.46.61:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 116.19.95.190:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 141.103.82.126:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 114.211.17.157:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 150.95.5.34:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 114.49.188.224:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 80.237.132.175:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 217.126.70.41:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 17.140.99.68:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 1.43.69.68:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 202.196.49.215:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 50.24.101.36:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 165.204.233.210:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 166.228.245.227:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 96.56.113.199:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 145.181.121.236:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 31.189.188.12:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 147.44.38.207:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 100.13.184.66:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 164.219.8.235:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 189.36.6.149:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 153.72.142.52:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 137.0.18.8:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 159.211.31.239:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 113.152.197.185:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 116.223.95.60:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 32.181.46.11:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 173.146.130.79:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 105.244.47.145:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 187.88.169.251:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 147.132.181.56:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 188.195.72.166:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 109.109.75.85:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 156.6.250.107:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 77.186.243.212:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 143.193.132.155:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 23.183.227.42:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 101.223.69.42:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 176.154.56.135:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 48.76.123.200:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 163.89.166.218:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 37.62.142.139:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 128.97.117.69:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 134.30.201.125:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 126.212.37.98:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 221.141.79.203:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 117.16.32.138:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 87.230.218.53:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 116.202.105.159:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 213.132.135.59:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 216.253.34.142:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 182.247.166.24:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 167.51.67.18:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 137.243.235.235:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 46.133.39.162:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 160.195.226.169:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 147.171.72.23:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 223.242.39.175:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 20.91.202.120:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 110.234.109.10:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 9.81.243.12:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 79.198.12.14:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 1.125.80.104:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 102.16.156.167:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 38.48.60.187:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 220.185.89.163:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 5.219.236.66:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 145.165.35.154:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 104.75.196.156:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 106.53.96.194:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 95.235.151.250:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 193.159.162.78:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 88.123.247.219:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 90.242.105.238:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 171.34.12.179:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 167.110.172.170:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 187.44.44.156:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 96.41.109.128:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 79.182.52.41:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 220.104.199.109:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 154.74.90.89:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 69.240.88.231:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 165.162.158.208:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 217.116.161.58:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 19.35.207.196:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 12.75.164.66:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 138.21.65.239:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 23.108.94.80:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 94.131.25.255:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 165.106.101.83:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 203.2.67.166:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 18.238.107.202:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 186.187.236.187:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 60.54.130.95:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 120.251.59.173:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 135.152.177.162:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 209.128.161.226:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 156.91.254.66:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 205.252.41.186:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 112.60.211.194:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 105.200.165.59:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 66.38.141.126:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 109.209.195.198:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 175.67.160.72:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 173.23.5.9:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 14.107.152.185:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 70.246.71.141:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 43.57.106.145:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 206.50.111.122:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 73.75.227.144:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 210.233.95.178:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 39.159.27.127:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 135.54.63.130:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 197.13.33.66:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 135.149.217.30:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 73.239.58.186:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 205.31.113.101:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 59.47.171.131:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 58.19.111.110:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 131.72.234.176:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 176.17.134.171:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 80.71.75.186:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 181.215.37.44:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 82.212.14.143:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 93.29.15.140:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 191.131.188.195:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 75.121.175.240:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 74.72.43.161:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 97.142.17.119:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 69.158.38.228:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 145.241.88.45:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 17.153.218.143:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 179.239.118.69:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 143.236.162.13:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 107.217.212.182:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 99.50.9.172:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 206.74.170.26:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 209.209.185.188:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 120.116.7.213:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 200.112.86.152:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 105.15.216.215:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 27.50.42.1:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 212.28.104.104:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 129.111.161.208:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 101.42.181.93:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 104.171.67.138:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 38.113.45.103:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 156.249.172.105:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 151.3.180.230:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 75.32.219.104:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 106.39.195.171:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 175.196.68.7:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 177.8.76.20:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 160.20.46.131:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 207.190.207.135:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 64.161.176.159:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 35.74.0.21:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 97.170.65.214:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 12.78.6.56:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 81.105.250.95:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 139.222.179.132:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 92.53.231.145:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 5.24.149.103:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 141.163.144.247:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 163.198.198.61:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 159.56.14.4:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 139.63.179.132:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 136.133.217.109:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 208.18.189.24:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 185.76.232.223:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 177.248.14.254:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 183.252.154.212:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 137.162.101.193:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 186.162.213.34:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 129.110.65.181:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 107.23.66.209:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 70.253.37.18:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 199.65.201.161:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 147.50.186.151:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 101.5.47.6:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 5.122.9.91:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 111.66.207.60:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 74.55.241.44:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 111.124.242.225:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 161.143.90.183:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 185.250.53.252:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 76.88.63.19:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 209.149.214.65:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 162.62.248.227:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 136.94.191.159:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 96.71.12.104:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 141.153.51.247:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 134.252.129.159:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 219.69.164.112:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 73.85.111.184:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 207.200.94.76:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 136.166.19.142:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 41.86.95.96:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 82.244.71.49:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 193.144.101.69:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 52.98.139.108:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 75.224.94.42:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 195.105.132.99:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 185.146.0.42:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 47.34.211.79:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 197.215.27.248:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 179.92.236.244:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 18.220.101.225:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 188.50.37.60:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 204.69.175.103:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 23.15.217.40:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 20.91.224.152:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 102.44.209.208:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 146.0.209.34:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 119.218.108.230:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 110.206.27.251:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 186.36.97.17:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 149.113.217.101:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 64.99.211.91:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 132.72.78.175:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 70.110.153.59:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 210.239.220.235:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 34.1.237.69:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 80.34.221.255:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 222.149.97.133:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 167.90.218.254:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 182.57.166.249:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 147.194.110.52:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 171.40.248.81:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 108.48.101.135:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 38.199.49.65:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 63.27.173.58:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 34.28.186.86:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 64.134.226.160:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 54.146.34.25:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 220.232.212.158:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 212.155.26.50:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 147.88.6.162:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 14.84.240.26:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 106.18.187.141:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 158.144.15.186:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 197.62.133.27:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 166.32.27.236:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 205.251.100.31:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 204.124.53.63:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 102.170.235.102:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 12.101.193.161:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 138.94.3.247:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 188.137.198.177:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 39.56.51.197:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 136.225.107.125:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 109.117.103.62:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 143.10.96.251:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 200.42.4.22:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 106.190.79.127:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 223.21.155.215:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 120.241.3.125:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 9.104.208.204:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 205.85.166.35:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 146.123.11.201:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 50.197.160.137:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 201.35.220.142:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 129.125.116.9:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 154.68.35.193:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 176.33.34.230:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 219.195.238.58:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 159.220.197.201:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 35.230.253.48:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 141.12.176.186:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 134.224.160.169:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 163.52.68.2:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 140.176.178.140:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 223.132.120.27:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 31.108.151.15:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 121.162.193.98:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 121.3.48.121:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 13.95.143.113:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 38.111.173.63:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 196.50.246.112:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 180.117.161.134:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 87.17.155.241:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 107.236.149.147:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 208.90.137.162:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 198.7.30.248:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 206.179.48.102:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 44.6.163.48:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 188.52.219.147:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 43.95.234.91:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 194.236.114.38:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 43.127.29.33:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 209.120.166.171:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 168.167.160.28:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 35.143.91.252:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 45.17.169.181:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 171.42.183.1:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 200.115.140.128:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 208.192.226.115:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 213.163.84.64:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 23.87.216.254:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 76.190.88.81:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 86.170.119.3:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 25.61.102.19:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 177.178.129.227:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 216.232.237.159:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 140.11.34.125:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 77.108.7.55:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 125.112.38.235:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 41.68.26.128:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 131.217.137.223:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 20.217.55.4:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 151.243.63.169:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 12.97.36.139:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 204.187.82.60:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 185.179.128.170:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 205.2.237.71:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 113.17.113.55:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 146.109.173.71:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 50.207.239.244:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 132.83.99.11:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 37.171.6.144:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 157.158.199.194:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 83.22.103.125:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 222.89.251.148:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 31.14.4.6:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 31.129.126.241:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 63.12.149.195:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 181.100.63.247:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 212.86.233.220:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 202.131.50.36:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 170.89.191.196:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 104.240.1.157:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 43.107.99.50:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 171.129.43.240:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 78.100.44.161:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 144.160.252.90:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 88.119.120.57:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 89.153.226.222:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 42.3.166.116:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 211.191.195.76:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 36.185.157.18:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 193.25.21.84:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 34.79.178.84:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 35.35.8.21:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 200.127.87.25:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 222.255.234.124:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 221.190.112.127:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 188.233.179.248:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 12.96.235.30:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 105.96.190.206:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 132.204.17.205:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 34.150.26.23:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 155.167.75.34:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 73.51.100.254:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 20.123.33.83:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 41.203.190.167:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 126.174.253.235:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 63.200.219.109:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 54.246.232.93:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 81.49.76.45:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 201.79.96.81:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 35.79.22.101:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 142.127.172.58:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 176.52.114.77:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 205.128.240.53:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 211.182.220.234:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 115.13.129.247:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 13.113.8.220:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 170.156.5.226:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 168.139.136.61:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 141.210.12.140:2323
Source: global traffic TCP traffic: 192.168.2.15:25342 -> 177.252.41.191:2323
Sample listens on a socket
Source: /tmp/botnet.sh4.elf (PID: 5571) Socket: 0.0.0.0:1230 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 178.215.238.6
Source: unknown TCP traffic detected without corresponding DNS query: 166.249.158.176
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.169.183
Source: unknown TCP traffic detected without corresponding DNS query: 117.22.244.229
Source: unknown TCP traffic detected without corresponding DNS query: 207.131.21.176
Source: unknown TCP traffic detected without corresponding DNS query: 58.228.147.83
Source: unknown TCP traffic detected without corresponding DNS query: 184.238.117.58
Source: unknown TCP traffic detected without corresponding DNS query: 105.182.51.182
Source: unknown TCP traffic detected without corresponding DNS query: 177.64.190.59
Source: unknown TCP traffic detected without corresponding DNS query: 129.101.213.4
Source: unknown TCP traffic detected without corresponding DNS query: 73.72.33.114
Source: unknown TCP traffic detected without corresponding DNS query: 43.212.63.40
Source: unknown TCP traffic detected without corresponding DNS query: 147.107.8.51
Source: unknown TCP traffic detected without corresponding DNS query: 76.20.253.104
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.209.68
Source: unknown TCP traffic detected without corresponding DNS query: 80.150.238.203
Source: unknown TCP traffic detected without corresponding DNS query: 165.80.225.113
Source: unknown TCP traffic detected without corresponding DNS query: 103.123.60.36
Source: unknown TCP traffic detected without corresponding DNS query: 173.9.60.243
Source: unknown TCP traffic detected without corresponding DNS query: 117.75.191.207
Source: unknown TCP traffic detected without corresponding DNS query: 105.165.17.100
Source: unknown TCP traffic detected without corresponding DNS query: 219.151.197.180
Source: unknown TCP traffic detected without corresponding DNS query: 142.91.47.88
Source: unknown TCP traffic detected without corresponding DNS query: 123.153.23.59
Source: unknown TCP traffic detected without corresponding DNS query: 136.57.24.31
Source: unknown TCP traffic detected without corresponding DNS query: 103.131.65.88
Source: unknown TCP traffic detected without corresponding DNS query: 193.105.199.177
Source: unknown TCP traffic detected without corresponding DNS query: 78.82.246.232
Source: unknown TCP traffic detected without corresponding DNS query: 143.3.15.145
Source: unknown TCP traffic detected without corresponding DNS query: 82.19.77.189
Source: unknown TCP traffic detected without corresponding DNS query: 101.237.234.219
Source: unknown TCP traffic detected without corresponding DNS query: 164.61.255.175
Source: unknown TCP traffic detected without corresponding DNS query: 85.27.174.50
Source: unknown TCP traffic detected without corresponding DNS query: 42.117.63.161
Source: unknown TCP traffic detected without corresponding DNS query: 174.13.20.215
Source: unknown TCP traffic detected without corresponding DNS query: 183.39.159.197
Source: unknown TCP traffic detected without corresponding DNS query: 123.119.2.253
Source: unknown TCP traffic detected without corresponding DNS query: 128.240.159.250
Source: unknown TCP traffic detected without corresponding DNS query: 71.77.209.15
Source: unknown TCP traffic detected without corresponding DNS query: 196.2.170.194
Source: unknown TCP traffic detected without corresponding DNS query: 191.225.23.48
Source: unknown TCP traffic detected without corresponding DNS query: 93.250.5.21
Source: unknown TCP traffic detected without corresponding DNS query: 41.127.140.102
Source: unknown TCP traffic detected without corresponding DNS query: 72.219.206.243
Source: unknown TCP traffic detected without corresponding DNS query: 183.122.251.212
Source: unknown TCP traffic detected without corresponding DNS query: 58.248.234.83
Source: unknown TCP traffic detected without corresponding DNS query: 108.106.151.7
Source: unknown TCP traffic detected without corresponding DNS query: 166.39.167.14
Source: unknown TCP traffic detected without corresponding DNS query: 182.143.237.14
Source: unknown TCP traffic detected without corresponding DNS query: 146.161.172.114

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: botnet.sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: botnet.sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: botnet.sh4.elf, type: SAMPLE Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: botnet.sh4.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5571.1.00007f6e18400000.00007f6e18412000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5571.1.00007f6e18400000.00007f6e18412000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5571.1.00007f6e18400000.00007f6e18412000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5571.1.00007f6e18400000.00007f6e18412000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: botnet.sh4.elf PID: 5571, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: bin/busybox
Source: Initial sample String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/bin/busybox/bin/watchdog/bin/systemdbin/busyboxbin/watchdogbin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777 3f
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: botnet.sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: botnet.sh4.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: botnet.sh4.elf, type: SAMPLE Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: botnet.sh4.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5571.1.00007f6e18400000.00007f6e18412000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5571.1.00007f6e18400000.00007f6e18412000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5571.1.00007f6e18400000.00007f6e18412000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5571.1.00007f6e18400000.00007f6e18412000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: botnet.sh4.elf PID: 5571, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engine Classification label: mal100.troj.linELF@0/0@0/0
Executes commands using a shell command-line interpreter
Source: /tmp/botnet.sh4.elf (PID: 5573) Shell command executed: sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv /tmp/botnet.sh4.elf bin/watchdog; chmod 777 bin/watchdog" Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 5582) Chmod executable: /usr/bin/chmod -> chmod 777 bin/watchdog Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 5580) Mkdir executable: /usr/bin/mkdir -> mkdir bin Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /bin/sh (PID: 5579) Rm executable: /usr/bin/rm -> rm -rf bin/watchdog Jump to behavior
Sample tries to set the executable flag
Source: /usr/bin/chmod (PID: 5582) File: /tmp/bin/watchdog (bits: - usr: rwx grp: rwx all: rwx) Jump to behavior
Sets full permissions to files and/or directories
Source: /bin/sh (PID: 5582) Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/watchdog Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/botnet.sh4.elf (PID: 5571) Queries kernel information via 'uname': Jump to behavior
Source: botnet.sh4.elf, 5571.1.00007fffc293f000.00007fffc2960000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: botnet.sh4.elf, 5571.1.00007fffc293f000.00007fffc2960000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/botnet.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/botnet.sh4.elf
Source: botnet.sh4.elf, 5571.1.000055af80f64000.000055af80fc7000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: botnet.sh4.elf, 5571.1.000055af80f64000.000055af80fc7000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: botnet.sh4.elf, type: SAMPLE
Source: Yara match File source: 5571.1.00007f6e18400000.00007f6e18412000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: botnet.sh4.elf PID: 5571, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: botnet.sh4.elf, type: SAMPLE
Source: Yara match File source: 5571.1.00007f6e18400000.00007f6e18412000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: botnet.sh4.elf PID: 5571, type: MEMORYSTR

Remote Access Functionality
barindex
Detected Mirai
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
Yara detected Mirai
Source: Yara match File source: botnet.sh4.elf, type: SAMPLE
Source: Yara match File source: 5571.1.00007f6e18400000.00007f6e18412000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: botnet.sh4.elf PID: 5571, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: botnet.sh4.elf, type: SAMPLE
Source: Yara match File source: 5571.1.00007f6e18400000.00007f6e18412000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: botnet.sh4.elf PID: 5571, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
138.63.125.11
 unknown France
1715 FR-REMIP2000REMIP2000AutonomousSystemEU false
119.205.45.79
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
142.87.23.195
 unknown Canada
7950 HC-ASCA false
150.238.200.240
 unknown United States
36351 SOFTLAYERUS false
163.200.173.140
 unknown South Africa
2018 TENET-1ZA false
176.58.114.161
 unknown United Kingdom
63949 LINODE-APLinodeLLCUS false
80.164.68.250
 unknown Denmark
3292 TDCTDCASDK false
122.30.188.169
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
18.213.127.0
 unknown United States
14618 AMAZON-AESUS false
75.227.87.52
 unknown United States
22394 CELLCOUS false
76.75.107.206
 unknown Canada
11666 NEXICOM-CA false
63.41.223.109
 unknown United States
22394 CELLCOUS false
169.67.233.184
 unknown United States
37611 AfrihostZA false
135.131.117.107
 unknown United States
14962 NCR-252US false
94.99.145.12
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
43.237.1.167
 unknown China
17506 UCOMARTERIANetworksCorporationJP false
94.205.84.252
 unknown United Arab Emirates
15802 DU-AS1AE false
25.212.211.73
 unknown United Kingdom
7922 COMCAST-7922US false
151.24.144.99
 unknown Italy
1267 ASN-WINDTREIUNETEU false
114.73.83.200
 unknown Australia
4804 MPX-ASMicroplexPTYLTDAU false
5.95.141.135
 unknown Italy
30722 VODAFONE-IT-ASNIT false
153.105.55.66
 unknown United States
195 SDSC-ASUS false
67.109.70.43
 unknown United States
2828 XO-AS15US false
43.159.230.50
 unknown Japan 4249 LILLY-ASUS false
129.186.49.251
 unknown United States
2698 IASTATE-ASUS false
95.153.100.167
 unknown Moldova Republic of
1547 IDK-NETWORKMD false
200.17.105.133
 unknown Brazil
10881 FUNPAR-FundacaodaUFPRparaoDCTCBR false
160.54.128.194
 unknown Germany
12291 DPAG-ASDeutschePostAGDE false
108.216.17.223
 unknown United States
7018 ATT-INTERNET4US false
189.195.108.191
 unknown Mexico
13999 MegaCableSAdeCVMX false
193.113.141.60
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
85.112.35.24
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
100.50.152.236
 unknown United States
701 UUNETUS false
91.163.182.24
 unknown France
12322 PROXADFR false
110.15.90.163
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
185.132.88.111
 unknown Spain
203503 TICAEES false
165.195.13.52
 unknown United States
17575 CAUNET-AS-KRChung-AngUniversityKR false
213.81.108.104
 unknown United Kingdom
5089 NTLGB false
161.52.160.11
 unknown Sweden
43922 MALMOSE false
221.196.253.124
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
31.136.25.50
 unknown Netherlands
15480 VFNL-ASVodafoneNLAutonomousSystemNL false
139.126.233.194
 unknown United States
32190 ADS-17-32190US false
74.106.250.30
 unknown United States
701 UUNETUS false
159.238.149.208
 unknown United States
14977 STATE-OF-WYOMING-ASNUS false
12.224.217.200
 unknown United States
7018 ATT-INTERNET4US false
18.36.184.138
 unknown United States
3 MIT-GATEWAYSUS false
42.45.38.1
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
8.214.119.92
 unknown Singapore
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false
69.115.11.130
 unknown United States
6128 CABLE-NET-1US false
217.101.122.87
 unknown Netherlands
33915 TNF-ASNL false
86.124.0.13
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO false
51.14.57.174
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
19.172.30.38
 unknown United States
3 MIT-GATEWAYSUS false
113.78.206.70
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
90.176.122.88
 unknown Czech Republic
5610 O2-CZECH-REPUBLICCZ false
4.204.173.40
 unknown United States
3356 LEVEL3US false
87.176.167.172
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
142.29.42.175
 unknown Canada
3633 PROVINCE-OF-BRITISH-COLUMBIACA false
80.137.246.136
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
18.185.59.10
 unknown United States
16509 AMAZON-02US false
63.93.193.113
 unknown United States
14135 NAVISITE-EAST-2US false
137.86.74.231
 unknown United States
14977 STATE-OF-WYOMING-ASNUS false
67.128.225.80
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
115.151.251.164
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
71.139.63.99
 unknown United States
7018 ATT-INTERNET4US false
218.248.52.211
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
119.123.85.43
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
97.48.244.139
 unknown United States
22394 CELLCOUS false
88.223.59.31
 unknown Lithuania
39354 INIT-MGNT-LT false
2.62.215.176
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
194.70.178.158
 unknown United Kingdom
2529 DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide false
62.18.206.129
 unknown Italy
16232 ASN-TIMServiceProviderIT false
140.216.161.162
 unknown United States
22284 AS22284-DOI-OPSUS false
86.179.119.21
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
138.193.9.10
 unknown United States
21727 HAMLINE-EDUUS false
13.119.99.73
 unknown United States
16509 AMAZON-02US false
50.8.141.84
 unknown United States
2686 ATGS-MMD-ASUS false
77.207.34.248
 unknown France
15557 LDCOMNETFR false
184.19.32.177
 unknown United States
5650 FRONTIER-FRTRUS false
36.199.186.124
 unknown China
24138 CTTNETChinaTieTongTelecommunicationsCorporationCN false
182.56.36.7
 unknown India
17813 MTNL-APMahanagarTelephoneNigamLimitedIN false
137.196.218.118
 unknown Malawi
37440 Airtel-MW false
73.58.99.140
 unknown United States
7922 COMCAST-7922US false
81.30.69.154
 unknown Netherlands
57112 ASN-F2XNL false
145.74.230.177
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
83.8.145.162
 unknown Poland
5617 TPNETPL false
32.218.26.170
 unknown United States
46690 SNET-FCCUS false
95.86.79.96
 unknown Israel
42925 RIMON1IL false
201.111.54.93
 unknown Mexico
8151 UninetSAdeCVMX false
47.148.178.12
 unknown United States
5650 FRONTIER-FRTRUS false
130.52.116.206
 unknown United States
15601 BaringInvestmentServicesGB false
12.111.67.45
 unknown United States
7018 ATT-INTERNET4US false
108.20.244.91
 unknown United States
701 UUNETUS false
52.7.231.169
 unknown United States
14618 AMAZON-AESUS false
220.47.115.208
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
101.124.183.187
 unknown China
131486 JDCOMBeijingJingdong360DegreeE-commerceCoLtdCN false
202.134.23.87
 unknown Viet Nam
45903 CMCTELECOM-AS-VNCMCTelecomInfrastructureCompanyVN false
60.185.65.156
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
35.47.220.99
 unknown United States
36375 UMICH-AS-5US false
174.29.230.196
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false