Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
sora.arm

Overview

General Information

Sample Name:sora.arm
Analysis ID:626479
MD5:7799db04192fa39c4d8d2986fbc472a8
SHA1:15dbc1cc83b869cd3eab35cd02c994507d4d0604
SHA256:600656d40c15432fe35987fec3d346cf9f34ee9b1ae1d23706925d6c8b6e57b8
Infos:

Detection

Mirai
Score:60
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:626479
Start date and time: 14/05/202204:30:532022-05-14 04:30:53 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 7m 23s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:sora.arm
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal60.troj.evad.linARM@0/0@0/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:/tmp/sora.arm
PID:6226
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:

Process Tree

  • system is lnxubuntu20
  • sora.arm (PID: 6226, Parent: 6123, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/sora.arm
    • sora.arm New Fork (PID: 6228, Parent: 6226)
      • sora.arm New Fork (PID: 6326, Parent: 6228)
      • sora.arm New Fork (PID: 6330, Parent: 6228)
        • sora.arm New Fork (PID: 6333, Parent: 6330)
          • sora.arm New Fork (PID: 6344, Parent: 6333)
          • sora.arm New Fork (PID: 6346, Parent: 6333)
        • sora.arm New Fork (PID: 6335, Parent: 6330)
        • sora.arm New Fork (PID: 6336, Parent: 6330)
    • sora.arm New Fork (PID: 6230, Parent: 6226)
    • sora.arm New Fork (PID: 6231, Parent: 6226)
      • sora.arm New Fork (PID: 6234, Parent: 6231)
        • sora.arm New Fork (PID: 6325, Parent: 6234)
        • sora.arm New Fork (PID: 6328, Parent: 6234)
      • sora.arm New Fork (PID: 6235, Parent: 6231)
      • sora.arm New Fork (PID: 6237, Parent: 6231)
  • cleanup

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for submitted file
    Source: sora.armVirustotal: Detection: 42%Perma Link
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:45728 -> 104.131.58.204:1312
    Source: /tmp/sora.arm (PID: 6228)Socket: 0.0.0.0::0Jump to behavior
    Source: /tmp/sora.arm (PID: 6228)Socket: 0.0.0.0::53413Jump to behavior
    Source: /tmp/sora.arm (PID: 6228)Socket: 0.0.0.0::80Jump to behavior
    Source: /tmp/sora.arm (PID: 6228)Socket: 0.0.0.0::37215Jump to behavior
    Source: /tmp/sora.arm (PID: 6234)Socket: 0.0.0.0::0Jump to behavior
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
    Source: unknownTCP traffic detected without corresponding DNS query: 104.131.58.204
    Source: unknownTCP traffic detected without corresponding DNS query: 90.142.129.13
    Source: unknownTCP traffic detected without corresponding DNS query: 112.220.25.155
    Source: unknownTCP traffic detected without corresponding DNS query: 218.116.26.13
    Source: unknownTCP traffic detected without corresponding DNS query: 41.49.140.15
    Source: unknownTCP traffic detected without corresponding DNS query: 211.14.213.103
    Source: unknownTCP traffic detected without corresponding DNS query: 221.214.104.243
    Source: unknownTCP traffic detected without corresponding DNS query: 14.27.145.200
    Source: unknownTCP traffic detected without corresponding DNS query: 89.175.35.111
    Source: unknownTCP traffic detected without corresponding DNS query: 171.15.147.154
    Source: unknownTCP traffic detected without corresponding DNS query: 221.201.182.216
    Source: unknownTCP traffic detected without corresponding DNS query: 190.174.174.34
    Source: unknownTCP traffic detected without corresponding DNS query: 78.239.7.93
    Source: unknownTCP traffic detected without corresponding DNS query: 45.15.75.43
    Source: unknownTCP traffic detected without corresponding DNS query: 194.50.244.199
    Source: unknownTCP traffic detected without corresponding DNS query: 108.77.125.24
    Source: unknownTCP traffic detected without corresponding DNS query: 253.173.219.103
    Source: unknownTCP traffic detected without corresponding DNS query: 181.156.71.179
    Source: unknownTCP traffic detected without corresponding DNS query: 181.119.86.241
    Source: unknownTCP traffic detected without corresponding DNS query: 57.103.122.74
    Source: unknownTCP traffic detected without corresponding DNS query: 86.26.239.206
    Source: unknownTCP traffic detected without corresponding DNS query: 202.102.229.41
    Source: unknownTCP traffic detected without corresponding DNS query: 146.35.195.126
    Source: unknownTCP traffic detected without corresponding DNS query: 197.108.214.179
    Source: unknownTCP traffic detected without corresponding DNS query: 243.16.11.26
    Source: unknownTCP traffic detected without corresponding DNS query: 165.168.142.144
    Source: unknownTCP traffic detected without corresponding DNS query: 162.169.120.3
    Source: unknownTCP traffic detected without corresponding DNS query: 244.165.245.90
    Source: unknownTCP traffic detected without corresponding DNS query: 62.50.50.73
    Source: unknownTCP traffic detected without corresponding DNS query: 24.56.245.123
    Source: unknownTCP traffic detected without corresponding DNS query: 169.120.116.184
    Source: unknownTCP traffic detected without corresponding DNS query: 57.177.179.33
    Source: unknownTCP traffic detected without corresponding DNS query: 219.180.250.187
    Source: unknownTCP traffic detected without corresponding DNS query: 251.71.75.190
    Source: unknownTCP traffic detected without corresponding DNS query: 156.225.109.220
    Source: unknownTCP traffic detected without corresponding DNS query: 91.65.68.150
    Source: unknownTCP traffic detected without corresponding DNS query: 188.144.215.180
    Source: unknownTCP traffic detected without corresponding DNS query: 16.130.211.183
    Source: unknownTCP traffic detected without corresponding DNS query: 14.231.82.209
    Source: unknownTCP traffic detected without corresponding DNS query: 165.114.156.179
    Source: unknownTCP traffic detected without corresponding DNS query: 146.104.86.150
    Source: unknownTCP traffic detected without corresponding DNS query: 156.67.159.142
    Source: unknownTCP traffic detected without corresponding DNS query: 162.58.175.53
    Source: unknownTCP traffic detected without corresponding DNS query: 91.209.199.175
    Source: unknownTCP traffic detected without corresponding DNS query: 128.1.51.63
    Source: unknownTCP traffic detected without corresponding DNS query: 62.128.207.203
    Source: unknownTCP traffic detected without corresponding DNS query: 207.21.144.165
    Source: unknownTCP traffic detected without corresponding DNS query: 13.193.175.91
    Source: sora.armString found in binary or memory: http://upx.sf.net
    Source: LOAD without section mappingsProgram segment: 0x8000
    Source: /tmp/sora.arm (PID: 6228)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/sora.arm (PID: 6234)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: classification engineClassification label: mal60.troj.evad.linARM@0/0@0/0

    Data Obfuscation

    barindex
    Sample is packed with UPX
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/491/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/793/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/772/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/796/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/774/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/797/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/777/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/799/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/658/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/912/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/759/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/936/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/918/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/1/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/761/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/785/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/884/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/720/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/721/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/788/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/789/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/800/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/801/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/847/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6234)File opened: /proc/904/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/491/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/793/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/772/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/796/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/774/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/797/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/777/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/799/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/658/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/912/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/759/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/936/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/918/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/1/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/761/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/785/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/884/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/720/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/721/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/788/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/789/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/800/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/801/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/847/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6228)File opened: /proc/904/fdJump to behavior
    Source: /tmp/sora.arm (PID: 6226)Queries kernel information via 'uname': Jump to behavior
    Source: sora.arm, 6226.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6228.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6326.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6344.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6335.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6230.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6325.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6235.1.00000000a25b81b1.00000000ff87532e.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
    Source: sora.arm, 6226.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6228.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6326.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6344.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6335.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6230.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6325.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6235.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/sora.armSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sora.arm
    Source: sora.arm, 6226.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6228.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6326.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6344.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6335.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6230.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6325.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6235.1.00000000a25b81b1.00000000ff87532e.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
    Source: sora.arm, 6226.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6228.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6326.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6344.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6335.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6230.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6325.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6235.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

    Stealing of Sensitive Information

    barindex
    Yara detected Mirai
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Yara detected Mirai
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
    Obfuscated Files or Information    		1
    OS Credential Dumping    		11
    Security Software Discovery    		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
    Non-Standard Port    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol    		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

    Malware Configuration

    ⊘No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 626479 Sample: sora.arm Startdate: 14/05/2022 Architecture: LINUX Score: 60 42 37.186.50.105 VODAFONEQATARQA Qatar 2->42 44 101.98.223.235 VOCUSGROUPNZVocusGroupNZ New Zealand 2->44 46 98 other IPs or domains 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Mirai 2->50 52 Sample is packed with UPX 2->52 10 sora.arm 2->10         started        signatures3 process4 process5 12 sora.arm 10->12         started        14 sora.arm 10->14         started        16 sora.arm 10->16         started        process6 18 sora.arm 12->18         started        20 sora.arm 12->20         started        22 sora.arm 14->22         started        24 sora.arm 14->24         started        26 sora.arm 14->26         started        process7 28 sora.arm 18->28         started        30 sora.arm 18->30         started        32 sora.arm 18->32         started        34 sora.arm 22->34         started        36 sora.arm 22->36         started        process8 38 sora.arm 28->38         started        40 sora.arm 28->40         started       

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    sora.arm43%VirustotalBrowse

    Dropped Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Contacted Domains

    ⊘No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.netsora.armfalse
      		high

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      192.132.79.178
      		unknownUnited States
      		367DNIC-ASBLK-00306-00371USfalse
      17.88.248.1
      		unknownUnited States
      		714APPLE-ENGINEERINGUSfalse
      108.34.195.20
      		unknownUnited States
      		701UUNETUSfalse
      85.158.231.141
      		unknownAustria
      		8692BRZATfalse
      197.166.142.74
      		unknownEgypt
      		24863LINKdotNET-ASEGfalse
      243.142.109.8
      		unknownReserved
      		unknownunknownfalse
      154.28.148.110
      		unknownUnited States
      		174COGENT-174USfalse
      223.110.109.215
      		unknownChina
      		56046CMNET-JIANGSU-APChinaMobilecommunicationscorporationCNfalse
      242.105.215.220
      		unknownReserved
      		unknownunknownfalse
      89.3.43.196
      		unknownFrance
      		21502ASN-NUMERICABLEFRfalse
      248.65.0.12
      		unknownReserved
      		unknownunknownfalse
      16.46.151.36
      		unknownUnited States
      		unknownunknownfalse
      45.140.216.1
      		unknownSwitzerland
      		62075LANNERTDEfalse
      147.24.192.227
      		unknownUnited States
      		10796TWC-10796-MIDWESTUSfalse
      135.148.11.249
      		unknownUnited States
      		18676AVAYAUSfalse
      253.179.7.5
      		unknownReserved
      		unknownunknownfalse
      187.247.165.44
      		unknownMexico
      		13999MegaCableSAdeCVMXfalse
      37.90.202.181
      		unknownGermany
      		3320DTAGInternetserviceprovideroperationsDEfalse
      161.53.142.82
      		unknownCroatia (LOCAL Name: Hrvatska)
      		2108CARNET-ASJMarohnica510000ZagrebHRfalse
      201.173.227.169
      		unknownMexico
      		11888TelevisionInternacionalSAdeCVMXfalse
      126.89.187.159
      		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
      133.124.154.5
      		unknownJapan2522PPP-EXPJapanNetworkInformationCenterJPfalse
      13.165.162.234
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      218.235.146.189
      		unknownKorea Republic of
      		9318SKB-ASSKBroadbandCoLtdKRfalse
      250.183.216.13
      		unknownReserved
      		unknownunknownfalse
      48.6.146.179
      		unknownUnited States
      		2686ATGS-MMD-ASUSfalse
      105.179.193.81
      		unknownunknown
      		37228Olleh-Rwanda-NetworksRWfalse
      243.114.158.2
      		unknownReserved
      		unknownunknownfalse
      223.184.95.212
      		unknownIndia
      		45609BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSServicefalse
      108.103.78.32
      		unknownUnited States
      		10507SPCSUSfalse
      75.43.169.89
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      99.2.51.118
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      99.188.69.140
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      160.224.24.100
      		unknownAngola
      		11259ANGOLATELECOMAOfalse
      124.54.163.211
      		unknownKorea Republic of
      		17858POWERVIS-AS-KRLGPOWERCOMMKRfalse
      198.217.52.158
      		unknownUnited States
      		3354THENET-AS-3354USfalse
      46.109.74.153
      		unknownLatvia
      		12578APOLLO-ASLatviaLVfalse
      23.254.189.224
      		unknownUnited States
      		54290HOSTWINDSUSfalse
      197.13.57.208
      		unknownTunisia
      		37504MeninxTNfalse
      83.191.157.210
      		unknownSweden
      		39651COMHEM-SWEDENSEfalse
      156.191.147.95
      		unknownEgypt
      		36992ETISALAT-MISREGfalse
      95.120.78.125
      		unknownSpain
      		3352TELEFONICA_DE_ESPANAESfalse
      141.231.140.12
      		unknownUnited Kingdom
      		12701BARCAPLondonGBfalse
      66.74.196.104
      		unknownUnited States
      		20001TWC-20001-PACWESTUSfalse
      242.47.204.113
      		unknownReserved
      		unknownunknownfalse
      88.0.190.253
      		unknownSpain
      		3352TELEFONICA_DE_ESPANAESfalse
      222.4.209.248
      		unknownJapan2516KDDIKDDICORPORATIONJPfalse
      101.98.223.235
      		unknownNew Zealand
      		9790VOCUSGROUPNZVocusGroupNZfalse
      246.182.65.69
      		unknownReserved
      		unknownunknownfalse
      197.32.129.167
      		unknownEgypt
      		8452TE-ASTE-ASEGfalse
      45.48.194.60
      		unknownUnited States
      		20001TWC-20001-PACWESTUSfalse
      43.145.165.142
      		unknownJapan4249LILLY-ASUSfalse
      246.118.168.83