Linux Analysis Report
tU468ylYjx

Overview

General Information

Sample Name: tU468ylYjx
Analysis ID: 626477
MD5: 1f435b2e68e159ee636a17bf3552d7de
SHA1: 8c76b05125e6bf6c32f72934181d52fd07ba9ad9
SHA256: 2a918615507819ee0c0c1c1ced7afd8ab35e44488b78340273c39e5fd60c77a3
Tags: 32elfmiraipowerpc
Infos:

Detection

Mirai
Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: tU468ylYjx Virustotal: Detection: 39% Perma Link

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45984
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46012
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46028
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46040
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46056
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46068
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46080
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46086
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46092
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46114
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:60988 -> 107.172.197.117:1312
Sample listens on a socket
Source: /tmp/tU468ylYjx (PID: 6226) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) Socket: 0.0.0.0::0 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 107.172.197.117
Source: unknown TCP traffic detected without corresponding DNS query: 12.163.181.164
Source: unknown TCP traffic detected without corresponding DNS query: 124.201.35.249
Source: unknown TCP traffic detected without corresponding DNS query: 171.213.184.249
Source: unknown TCP traffic detected without corresponding DNS query: 13.176.229.145
Source: unknown TCP traffic detected without corresponding DNS query: 40.189.128.38
Source: unknown TCP traffic detected without corresponding DNS query: 81.1.19.123
Source: unknown TCP traffic detected without corresponding DNS query: 44.239.254.250
Source: unknown TCP traffic detected without corresponding DNS query: 195.248.207.10
Source: unknown TCP traffic detected without corresponding DNS query: 125.160.224.12
Source: unknown TCP traffic detected without corresponding DNS query: 176.219.82.86
Source: unknown TCP traffic detected without corresponding DNS query: 181.167.224.33
Source: unknown TCP traffic detected without corresponding DNS query: 192.158.30.22
Source: unknown TCP traffic detected without corresponding DNS query: 164.121.109.58
Source: unknown TCP traffic detected without corresponding DNS query: 255.50.154.97
Source: unknown TCP traffic detected without corresponding DNS query: 195.182.138.20
Source: unknown TCP traffic detected without corresponding DNS query: 34.87.70.255
Source: unknown TCP traffic detected without corresponding DNS query: 84.179.75.208
Source: unknown TCP traffic detected without corresponding DNS query: 153.32.229.82
Source: unknown TCP traffic detected without corresponding DNS query: 167.144.133.226
Source: unknown TCP traffic detected without corresponding DNS query: 165.129.120.248
Source: unknown TCP traffic detected without corresponding DNS query: 23.135.109.15
Source: unknown TCP traffic detected without corresponding DNS query: 130.209.114.86
Source: unknown TCP traffic detected without corresponding DNS query: 201.237.134.237
Source: unknown TCP traffic detected without corresponding DNS query: 90.177.55.159
Source: unknown TCP traffic detected without corresponding DNS query: 142.111.164.126
Source: unknown TCP traffic detected without corresponding DNS query: 194.175.222.234
Source: unknown TCP traffic detected without corresponding DNS query: 102.170.32.54
Source: unknown TCP traffic detected without corresponding DNS query: 65.33.147.242
Source: unknown TCP traffic detected without corresponding DNS query: 162.35.238.129
Source: unknown TCP traffic detected without corresponding DNS query: 68.39.20.181
Source: unknown TCP traffic detected without corresponding DNS query: 82.242.120.172
Source: unknown TCP traffic detected without corresponding DNS query: 160.75.41.82
Source: unknown TCP traffic detected without corresponding DNS query: 54.61.51.66
Source: unknown TCP traffic detected without corresponding DNS query: 8.111.142.254
Source: unknown TCP traffic detected without corresponding DNS query: 202.134.62.135
Source: unknown TCP traffic detected without corresponding DNS query: 130.227.86.83
Source: unknown TCP traffic detected without corresponding DNS query: 182.166.35.149
Source: unknown TCP traffic detected without corresponding DNS query: 146.188.246.197
Source: unknown TCP traffic detected without corresponding DNS query: 252.177.70.187
Source: unknown TCP traffic detected without corresponding DNS query: 103.112.133.170
Source: unknown TCP traffic detected without corresponding DNS query: 27.173.221.44
Source: unknown TCP traffic detected without corresponding DNS query: 59.64.215.233
Source: unknown TCP traffic detected without corresponding DNS query: 167.152.64.82
Source: unknown TCP traffic detected without corresponding DNS query: 95.212.120.53
Source: unknown TCP traffic detected without corresponding DNS query: 197.18.69.91
Source: unknown TCP traffic detected without corresponding DNS query: 36.235.194.65
Source: unknown TCP traffic detected without corresponding DNS query: 162.206.45.56
Source: unknown TCP traffic detected without corresponding DNS query: 77.5.227.75
Source: tU468ylYjx String found in binary or memory: http://upx.sf.net
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x100000
Sample tries to kill a process (SIGKILL)
Source: /tmp/tU468ylYjx (PID: 6226) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: classification engine Classification label: mal64.troj.evad.lin@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/491/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/793/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/772/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/796/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/774/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/797/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/777/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/799/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/658/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/912/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/759/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/936/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/918/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/1/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/761/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/785/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/884/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/720/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/721/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/788/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/789/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/800/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/801/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/847/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6232) File opened: /proc/904/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/491/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/793/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/772/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/796/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/774/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/797/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/777/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/799/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/658/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/912/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/759/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/936/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/918/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/1/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/761/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/785/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/884/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/720/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/721/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/788/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/789/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/800/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/801/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/847/fd Jump to behavior
Source: /tmp/tU468ylYjx (PID: 6226) File opened: /proc/904/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 45984
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46012
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46028
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46040
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46056
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46068
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46080
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46086
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46092
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 46114
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/tU468ylYjx (PID: 6224) Queries kernel information via 'uname': Jump to behavior
Source: tU468ylYjx, 6224.1.0000000051be361b.00000000322ed218.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: tU468ylYjx, 6226.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6323.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6340.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6328.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6227.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6333.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6233.1.0000000051be361b.00000000322ed218.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: tU468ylYjx, 6224.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6226.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6323.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6340.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6328.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6227.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6333.1.0000000051be361b.00000000322ed218.rw-.sdmp, tU468ylYjx, 6233.1.0000000051be361b.00000000322ed218.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: tU468ylYjx, 6224.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6226.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6323.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6340.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6328.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6227.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6333.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6233.1.00000000631a968b.0000000029cdfeac.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: tU468ylYjx, 6224.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6226.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6323.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6340.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6328.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6227.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6333.1.00000000631a968b.0000000029cdfeac.rw-.sdmp, tU468ylYjx, 6233.1.00000000631a968b.0000000029cdfeac.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/tU468ylYjxSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/tU468ylYjx

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
124.75.165.150
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
216.92.92.101
 unknown United States
7859 PAIR-NETWORKSUS false
150.217.3.109
 unknown Italy
137 ASGARRConsortiumGARREU false
244.158.124.82
 unknown Reserved
unknown unknown false
170.248.7.61
 unknown United States
21433 ACCENTUREFSSCLondonDCGB false
71.99.94.185
 unknown United States
5650 FRONTIER-FRTRUS false
208.165.164.65
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
220.210.235.162
 unknown Japan 18144 AS-ENECOMEnergiaCommunicationsIncJP false
125.76.82.63
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
83.207.100.101
 unknown France
3215 FranceTelecom-OrangeFR false
174.140.145.193
 unknown United States
29748 QTS-ASHUS false
248.171.46.242
 unknown Reserved
unknown unknown false
35.255.218.17
 unknown United States
3549 LVLT-3549US false
78.110.158.83
 unknown Russian Federation
43530 IRTELCOM-ASRU false
13.133.28.227
 unknown United States
7018 ATT-INTERNET4US false
178.198.88.170
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
148.128.197.77
 unknown United States
2386 INS-ASUS false
75.136.133.5
 unknown United States
20115 CHARTER-20115US false
146.213.125.26
 unknown Norway
5619 EVRY-NO false
66.239.22.93
 unknown United States
2828 XO-AS15US false
197.90.74.64
 unknown South Africa
10474 OPTINETZA false
123.91.75.157
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
87.125.105.248
 unknown Spain
12430 VODAFONE_ESES false
166.121.243.157
 unknown Singapore
9911 CONNECTPLUS-APSingaporeTelecomSG false
101.87.127.209
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
12.155.33.184
 unknown United States
7018 ATT-INTERNET4US false
184.103.198.217
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
88.145.164.184
 unknown United Kingdom
12708 ONETEL-ASTalkTalkCommunicationsLimitedGB false
141.112.190.217
 unknown United States
6 BULL-HNUS false
60.124.156.62
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
198.93.34.243
 unknown United States
6352 ETRADE-ASUS false
241.4.244.146
 unknown Reserved
unknown unknown false
73.112.121.58
 unknown United States
7922 COMCAST-7922US false
86.120.245.134
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO false
93.151.65.201
 unknown Italy
44957 OPITELIT false
114.170.121.58
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
178.209.254.131
 unknown Russian Federation
12714 TI-ASMoscowRussiaRU false
66.206.239.222
 unknown Canada
23184 PERSONACA false
190.146.201.91
 unknown Colombia
10620 TelmexColombiaSACO false
93.127.41.180
 unknown Ukraine
6703 ALKAR-ASUA false
206.162.114.249
 unknown United States
1239 SPRINTLINKUS false
151.83.84.10
 unknown Italy
1267 ASN-WINDTREIUNETEU false
48.192.124.95
 unknown United States
2686 ATGS-MMD-ASUS false
9.99.10.27
 unknown United States
3356 LEVEL3US false
255.64.112.201
 unknown Reserved
unknown unknown false
36.175.243.139
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
185.210.112.87
 unknown Italy
207029 WIME-ASIT false
178.245.236.25
 unknown Turkey
16135 TURKCELL-ASTurkcellASTR false
16.84.55.94
 unknown United States
unknown unknown false
140.228.246.149
 unknown United States
600 OARNET-ASUS false
242.5.233.28
 unknown Reserved
unknown unknown false
186.105.116.215
 unknown Chile
7418 TELEFONICACHILESACL false
73.172.210.228
 unknown United States
7922 COMCAST-7922US false
188.163.100.152
 unknown Ukraine
15895 KSNET-ASUA false
241.120.255.24
 unknown Reserved
unknown unknown false
133.38.251.68
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
197.211.114.67
 unknown Malawi
37187 SKYBANDMW false
208.137.162.169
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
92.207.185.241
 unknown United Kingdom
31655 ASN-GAMMATELECOMGB false
135.133.91.192
 unknown United States
14962 NCR-252US false
109.191.69.227
 unknown Russian Federation
8369 INTERSVYAZ-AS38-BKomsomolskyprospektRU false
194.158.255.197
 unknown Switzerland
6730 SUNRISECH false
99.70.226.9
 unknown United States
7018 ATT-INTERNET4US false
112.216.243.179
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
78.208.95.165
 unknown France
12322 PROXADFR false
95.98.201.16
 unknown Netherlands
31615 TMO-NL-ASNL false
204.99.97.160
 unknown United States
18862 NCS-HEALTHCAREUS false
251.181.98.112
 unknown Reserved
unknown unknown false
18.104.56.4
 unknown United States
3 MIT-GATEWAYSUS false
209.174.40.205
 unknown United States
6325 ILLINOIS-CENTURYUS false
249.121.54.201
 unknown Reserved
unknown unknown false
204.127.184.185
 unknown United States
4466 EASYLINK2US false
243.74.170.105
 unknown Reserved
unknown unknown false
42.84.186.120
 unknown China
9929 CUIICHINAUNICOMIndustrialInternetBackboneCN false
159.56.40.145
 unknown United States
11351 TWC-11351-NORTHEASTUS false
122.226.30.57
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
101.190.18.150
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
191.131.223.31
 unknown Brazil
26615 TIMSABR false
202.233.148.100
 unknown Japan 4675 U-NETSURFUNIADEXLTDJP false
190.134.2.247
 unknown Uruguay
6057 AdministracionNacionaldeTelecomunicacionesUY false
251.37.69.2
 unknown Reserved
unknown unknown false
249.120.39.186
 unknown Reserved
unknown unknown false
8.156.208.151
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
107.60.65.39
 unknown United States
16567 NETRIX-16567US false
177.92.168.108
 unknown Brazil
263107 QwertyComunicacoeseTecnologiaEducacionalLtdaBR false
210.42.148.53
 unknown China
24358 CNGI-WH-IX-AS-APCERNET2IXatHuazhongUniversityofScienc false
172.185.37.93
 unknown United States
7018 ATT-INTERNET4US false
32.68.194.104
 unknown United States
2686 ATGS-MMD-ASUS false
247.57.2.218
 unknown Reserved
unknown unknown false
92.203.241.85
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
169.172.184.107
 unknown United States
37611 AfrihostZA false
124.7.224.3
 unknown India
9583 SIFY-AS-INSifyLimitedIN false
213.81.126.107
 unknown United Kingdom
5089 NTLGB false
161.93.54.189
 unknown Japan 14298 EPA-NETUS false
114.183.221.41
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
218.0.41.111
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
12.216.23.176
 unknown United States
7018 ATT-INTERNET4US false
86.129.125.230
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
40.48.200.190
 unknown United States
4249 LILLY-ASUS false
93.180.151.102
 unknown Bosnia and Herzegowina
198252 ELTAKABEL-ASDobojskihbrigadaBBBA false