Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

27 June 2008
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

00:14:00 WinXP 87.68.77.136 (012.NET.IL):
GOLDENLINES-CABLE,
IL. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2734 hits: 12-31 to 06-26] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

00:37:00 WinXP 92.80.142.51 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none 5a387593a6
NEW none[none] none:none
none|none none none

T:00:37:00 WinXP 92.80.142.51 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball none 5a387593a6
NEW none[none] none:none
none|none none none

00:45:00 Win2K-f 222.239.30.93 (-):
INCHON CABLE TV NAMDONG BROADCAST,
INCHON, KYONGGI-DO, KR. n/a US:microsoft.com
US:download.microsoft.com
US:12.190.48.97:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 33
33 of 33 4c3df24b32
[Firefox:23 hits: 06-17 to 06-26]
53bfe15e91
[Firefox:228 hits: 06-17 to 06-26] 4c3df24b32 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

T:01:04:00 Win2K-f 220.138.38.170 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a 445 pcap raw alerts
ruleset shell
ftp
23 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

01:14:00 WinXP 118.168.2.62 (-):
. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2734 hits: 12-31 to 06-26] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

01:15:00 WinXP 86.155.14.87 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
SWANSEA, WALES, UK. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:660 hits: 07-11 to 06-26] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

T:01:45:00 Win2K-f 122.146.121.164 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TW. n/a CA:xx.ka3ek.com
CA:nadsam0.info
US:130.107.249.41:13412 135 pcap raw alerts
ruleset irc
http
458 lines Yeah : 1.3
profile none summary
tarball 31 of 33
13 of 33
none
none
none 9d0f01f733
NEW
a136e2219a
NEW
a2cf5b71d9
NEW
c5622bb285
[Firefox: 3 hits: 06-23 to 06-23]
ee20b91263
NEW none[none]
none [none]
none [none]
none [4]
none [none] none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none none
none
none
trace
none

02:00:00 Win2K-f 118.231.100.207 (-):
. n/a :proxim.ircgalaxy.pl
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 31 of 33 4a5caa8503
NEW none[none] none:none
none|none none none

02:04:00 WinXP 66.153.173.250 (SCCOAST.NET):
HTC - CABLE MODEM POOL,
CONWAY, SOUTH CAROLINA, US. (DSL) n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 32 321052074e
[Firefox:17 hits: 09-29 to 04-28] 1a587de3ca [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:02:05:00 WinXP 66.153.173.250 (SCCOAST.NET):
HTC - CABLE MODEM POOL,
CONWAY, SOUTH CAROLINA, US. (DSL) n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 32 321052074e
[Firefox:17 hits: 09-29 to 04-28] 1a587de3ca [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:02:10:00 Win2K-f 71.7.196.121 (EASTLINK.CA):
EASTLINK,
HALIFAX, NOVA SCOTIA, CA. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.125:80
US:205.128.79.124:80
US:4.23.60.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
a08f3b74a4
[Firefox:81 hits: 06-18 to 06-26] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

02:15:00 WinXP 144.138.160.178 (TMNS.NET.AU):
TELSTRAINTERNET31,
CANBERRA, AUSTRALIAN CAPITAL TERRITORY, AU. n/a 135 pcap raw alerts
ruleset other
4 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

02:22:00 WinXP 222.148.207.140 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2734 hits: 12-31 to 06-26] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

02:38:00 WinXP 78.35.7.82 (NETCOLOGNE.DE):
NETCOLOGNE,
DE. n/a US:hail.dns2go.com
SA:scorti1.dns2go.com
US:208.101.48.210:7000
CN:61.185.73.17:7000 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 21 of 32 5f78ff609d
[Firefox:1534 hits: 04-27 to 06-26] d4a06bdc3a [0] ASM:Graph
none|none lines=4 trace

02:43:00 Win2K-f 75.79.5.106 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:204.2.133.57:80
US:204.2.133.73:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
a08f3b74a4
[Firefox:81 hits: 06-18 to 06-26] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

03:45:00 Win2K-f 59.190.53.77 (EONET.NE.JP):
K-OPTICOM CORPORATION,
OSAKA, OSAKA, JP. n/a US:hail.dns2go.com
SA:scorti1.dns2go.com
US:208.101.48.210:7000
CN:61.185.73.17:7000 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 12 of 30 76b4ab852e
[Firefox:59 hits: 04-29 to 06-25] none[4] none:none
none|none none trace

03:47:00 WinXP 58.107.120.11 (OPTUSNET.COM.AU):
OPTUS INTERNET - RETAIL,
SYDNEY, NEW SOUTH WALES, AU. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 3ae357d17b
[Firefox:722 hits: 05-01 to 06-25] 462a7be171 [0] ASM:Graph
PolyEnE| lines=73 trace

T:03:47:00 WinXP 58.107.120.11 (OPTUSNET.COM.AU):
OPTUS INTERNET - RETAIL,
SYDNEY, NEW SOUTH WALES, AU. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 29 of 29 3ae357d17b
[Firefox:722 hits: 05-01 to 06-25] 462a7be171 [0] ASM:Graph
PolyEnE| lines=73 trace

T:03:48:00 WinXP 4.245.113.19 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SPARKS, NEVADA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:198.78.220.124:80
US:205.128.79.125:80
US:206.33.45.125:80 135 pcap raw alerts
ruleset other
78 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
73f1082158
[Firefox:91 hits: 06-18 to 06-26] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:04:04:00 Win2K-f 61.231.161.203 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAOYUAN, T'AI-WAN, TW. 217.170.244.2:443
CZ:217.170.244.2:443 445 pcap raw alerts
ruleset shell
ftp
irc
27 lines Yeah : 1.8
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2734 hits: 12-31 to 06-26] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

04:09:00 WinXP 71.105.247.58 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
LONG BEACH, CALIFORNIA, US. (DSL) n/a PL:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:199.93.41.124:80
US:204.160.126.124:80
US:205.128.79.125:80 135 pcap raw alerts
ruleset other
115 lines Yeah : 1.3
profile none summary
tarball 32 of 33
29 of 33 541303608f
NEW
9f48e4d05f
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

04:12:00 Win2K-f 58.121.126.60 (HANANET.NET):
HANARO TELECOM INC,
KR. n/a US:microsoft.com
PL:proxima.ircgalaxy.pl
US:download.microsoft.com
US:199.93.41.124:80 135 pcap raw alerts
ruleset other
86 lines Yeah : 1.3
profile none summary
tarball 0 of 33
none 4c3df24b32
[Firefox:23 hits: 06-17 to 06-26]
6a4845ca11
NEW 4c3df24b32 [1]
none [none] ASM:Graph
none:none
Armadillo|
none|none lines=81
none trace
none

04:30:00 WinXP 172.191.242.80 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:12.190.48.65:80
US:12.190.48.97:80 135 pcap raw alerts
ruleset other
106 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
a08f3b74a4
[Firefox:81 hits: 06-18 to 06-26] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

04:44:00 WinXP 89.51.226.72 (PPPOOL.DE):
FREENET CITYLINE GMBH,
LUEDENSCHEID, NORDRHEIN-WESTFALEN, DE. (DIAL) n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3102 hits: 12-31 to 06-26] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

04:48:00 Win2K-f 88.173.2.70 (PROXAD.NET):
PROXAD / FREE SAS,
FR. n/a US:hail.dns2go.com
SA:scorti1.dns2go.com
US:208.101.48.210:7000
CN:61.185.73.19:7000 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 24 of 30 ba9d2786e9
NEW none[none] none:none
none|none none none

T:04:53:00 WinXP 24.85.21.199 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
WINNIPEG, MANITOBA, CA. n/a PL:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
114 lines Yeah : 1.3
profile none summary
tarball none
32 of 33
0 of 33 0dc39cd3c1
NEW
a120847406
NEW
e07c29c4ae
[Firefox:36 hits: 06-19 to 06-26] none[none]
none [none]
e07c29c4ae[1] none:none
none:none
ASM:Graph
none|none
none|none
FSG| none
none
lines=92 none
none
trace

T:05:14:00 WinXP 24.67.135.214 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
COURTENAY, BRITISH COLUMBIA, CA. (DSL) n/a PL:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80
US:207.123.37.125:80 135 pcap raw alerts
ruleset http
96 lines Yeah : 1.3
profile none summary
tarball 31 of 33
1 of 33
0 of 33 48f8b1a711
NEW
aecf2a5fc9
NEW
e07c29c4ae
[Firefox:36 hits: 06-19 to 06-26] none[4]
aecf2a5fc9[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
PolyEnE|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

05:14:00 WinXP 218.211.147.153 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TW. n/a 135 pcap raw alerts
ruleset other
82 lines Yeah : 1.3
profile none summary
tarball 0 of 32 73f1082158
[Firefox:91 hits: 06-18 to 06-26] 73f1082158 [1] ASM:Graph
Armadillo| lines=81 trace

05:17:00 WinXP 4.152.219.135 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
NEWPORT NEWS, VIRGINIA, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
21 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

05:33:00 Win2K-f 70.61.225.43 (RR.COM):
ROAD RUNNER HOLDCO LLC,
MYRTLE BEACH, SOUTH CAROLINA, US. n/a US:microsoft.com
PL:proxim.ircgalaxy.pl
US:download.microsoft.com
US:199.93.44.126:80 135 pcap raw alerts
ruleset other
190 lines Yeah : 1.3
profile none summary
tarball 29 of 32
none 2110c8100f
[Firefox: 2 hits: 06-19 to 06-23]
e818015a89
NEW none[4]
e818015a89[1] none:none
ASM:Graph
PolyEnE|
Armadillo| none
lines=81 trace
trace

T:05:37:00 WinXP 80.104.30.147 (BUSINESS.TELECOMITALIA.IT):
TELECOM ITALIA S.P.A,
MILANO, LOMBARDIA, IT. n/a 445 pcap raw alerts
ruleset shell
3 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:05:42:00 WinXP 189.48.50.164 (BRASILTELECOM.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. n/a PL:proxim.ircgalaxy.pl
US:hail.dns2go.com 445 pcap raw alerts
ruleset ftp
irc
23 lines Yeah : 0.8
profile none summary
tarball none 37e2bfa8a6
NEW none[none] none:none
none|none none none

05:47:00 Win2K-f 99.250.205.145 (STERLINGSTUDENTS.NET):
ROGERS CABLE COMMUNICATIONS INC,
CA. n/a PL:proxim.ircgalaxy.pl
US:microsoft.com 135 pcap raw alerts
ruleset other
5 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:05:48:00 Win2K-f 194.166.196.218 (AS1901.NET):
EUNET-LAC-DYN-POOL,
VIENNA, WIEN, AT. (DSL) n/a US:hail.dns2go.com
SA:scorti1.dns2go.com
US:208.101.48.210:7000 445 pcap raw alerts
ruleset ftp
irc
23 lines Yeah : 0.8
profile none summary
tarball 21 of 32 5f78ff609d
[Firefox:1534 hits: 04-27 to 06-26] d4a06bdc3a [0] ASM:Graph
none|none lines=4 trace

06:23:00 WinXP 76.189.124.141 (RR.COM):
ROAD RUNNER HOLDCO LLC,
EUCLID, OHIO, US. n/a 445 pcap raw alerts
ruleset shell
ftp
16 lines Yeah : 1.3
profile none summary
tarball 29 of 29 a73c16ccd0
NEW none[none] none:none
none|none none none

06:27:00 WinXP 116.123.122.100 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
US:download.microsoft.com
US:204.2.133.57:80
US:204.2.133.73:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 33
33 of 33 4c3df24b32
[Firefox:23 hits: 06-17 to 06-26]
53bfe15e91
[Firefox:228 hits: 06-17 to 06-26] 4c3df24b32 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

06:29:00 WinXP 66.72.68.121 (AMERITECH.NET):
AT&T INTERNET SERVICES,
BLOOMINGTON, INDIANA, US. (DIAL) n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:1358 hits: 12-31 to 06-26] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:06:31:00 WinXP 66.72.68.121 (AMERITECH.NET):
AT&T INTERNET SERVICES,
BLOOMINGTON, INDIANA, US. (DIAL) n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:1358 hits: 12-31 to 06-26] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:06:38:00 Win2K-f 24.83.110.206 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
COQUITLAM, BRITISH COLUMBIA, CA. (DSL) 72.10.172.218:7382 PL:proxim.ircgalaxy.pl
CA:italian.swiifatecihno.com 135 pcap raw alerts
ruleset irc
http
653 lines Yeah : 1.8
profile none summary
tarball 29 of 32
32 of 33 8acd7e1937
[Firefox: 2 hits: 06-22 to 06-24]
e3c59b50f3
NEW 8acd7e1937 [1]
none [none] ASM:Graph
none:none
none|none
none|none lines=0
none trace
none

T:06:45:00 WinXP 208.126.40.31 (-):
WESTERN IOWA NETWORKS,
BREDA, IOWA, US. n/a 135 pcap raw alerts
ruleset other
7 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:07:05:00 WinXP 122.42.16.26 (-):
POWERCOMM,
KR. 67.43.236.99:10324 PL:proxim.ircgalaxy.pl
US:mx1.hotmail.com
US:mailin-01.mx.aol.com
US:ftp.newaol.com
US:yutunrz.1dumb.com
US:mailin-03.mx.aol.com
US:mcduii.3-a.net
CA:xx.nadnadzz.info
CA:nadsam0.info
US:130.107.156.29:24347
US:143.215.15.145:80 135 pcap raw alerts
ruleset http
irc
794 lines Yeah : 1.8
profile none summary
tarball 1 of 33
none
13 of 33
none
none
none 64fb4bd3a2
NEW
745ae23613
NEW
a136e2219a
NEW
a2cf5b71d9
NEW
c5622bb285
[Firefox: 3 hits: 06-23 to 06-23]
ee20b91263
NEW none[none]
none [4]
none [none]
none [none]
none [4]
none [none] none:none
none:none
none:none
none:none
none:none
none:none
none|none
PeCompact|
none|none
none|none
none|none
none|none none
none
none
none
none
none none
trace
none
none
trace
none

07:07:00 WinXP 58.188.172.160 (EONET.NE.JP):
K-OPTICOM CORPORATION,
OSAKA, OSAKA, JP. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:77 hits: 09-28 to 06-26] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:07:13:00 Win2K-f 92.47.82.64 (IKBCC.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 10 of 32 639a247ece
[Firefox:36 hits: 04-28 to 06-25] 29d53eec72 [0] ASM:Graph
StarForce| lines=132 trace

T:07:14:00 Win2K-f 122.109.90.57 (-):
. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
303 lines Yeah : 1.3
profile none summary
tarball 31 of 33
0 of 32
29 of 33 73797b1b58
NEW
b5919931fe
[Firefox:34 hits: 06-20 to 06-26]
c32626f3bd
NEW none[none]
b5919931fe[1]
none [none] none:none
ASM:Graph
none:none
none|none
ASProtect|
none|none none
lines=90
none none
trace
none

07:27:00 WinXP 118.5.19.195 (-):
. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2734 hits: 12-31 to 06-26] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

07:30:00 WinXP 92.40.172.82 (IKBCC.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:07:49:00 Win2K-f 64.183.209.202 (RR.COM):
ROAD RUNNER HOLDCO LLC,
DALLAS, TEXAS, US. n/a US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
59 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
b7082104e4
[Firefox:14 hits: 06-18 to 06-26] none[4]
none [4] none:none
none:none
tElock|
tElock| none
none trace
trace

07:55:00 WinXP 61.231.231.58 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a 445 pcap raw alerts
ruleset shell
ftp
20 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:08:02:00 Win2K-f 98.105.209.82 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
20 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

08:03:00 WinXP 217.202.155.114 (-):
TELECOM ITALIA MOBILE,
IT. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3102 hits: 12-31 to 06-26] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:08:30:00 Win2K-f 89.214.58.1 (-):
GPRS COSTUMERS,
PT. 217.170.244.2:443
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
irc
27 lines Yeah : 1.8
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2734 hits: 12-31 to 06-26] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

08:51:00 WinXP 67.242.112.29 (-):
. n/a EU:siliconfireware.ru
GB:new.egg.com
:wpad
RU:www.bbin.ru
DE:212.227.111.29:80
DE:217.11.54.126:80
GB:217.145.225.22:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:1070 hits: 05-01 to 06-26] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

T:08:55:00 Win2K-f 118.165.141.120 (-):
. 217.170.244.2:443
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
irc
26 lines Yeah : 1.8
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2734 hits: 12-31 to 06-26] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

09:04:00 WinXP 216.9.145.78 (-):
NEW CONCEPTS COMMUNICATIONS INC,
LINTON, INDIANA, US. n/a PL:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
114 lines Yeah : 1.3
profile none summary
tarball 31 of 32
28 of 32 7d1b06e856
NEW
df312ddc90
NEW none[4]
df312ddc90[1] none:none
ASM:Graph
PolyEnE|
Armadillo| none
lines=81 trace
trace

T:09:15:00 Win2K-f 193.33.64.151 (D-NET.COM.UA):
DNETUA-NET,
UA. n/a US:hail.dns2go.com 445 pcap raw alerts
ruleset ftp
irc
22 lines Yeah : 0.8
profile none summary
tarball 21 of 32 5f78ff609d
[Firefox:1534 hits: 04-27 to 06-26] d4a06bdc3a [0] ASM:Graph
none|none lines=4 trace

09:22:00 WinXP 77.125.8.80 (INTER.NET.IL):
EURONET DIGITAL COMMUNICATIONS,
IL. n/a 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

09:26:00 WinXP 200.66.70.112 (MCMTELECOM.COM.MX):
MEGACABLE COMUNICACIONES DE MEXICO S.A. DE C.V,
HERMOSILLO, SONORA, MX. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:1358 hits: 12-31 to 06-26] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

09:50:00 WinXP 213.100.53.3 (SWIPNET.SE):
SWIPNET,
STOCKHOLM, STOCKHOLM, SE. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3102 hits: 12-31 to 06-26] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:10:01:00 WinXP 78.156.220.251 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3102 hits: 12-31 to 06-26] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:10:33:00 Win2K-f 218.210.225.206 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
73f1082158
[Firefox:91 hits: 06-18 to 06-26] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:10:35:00 Win2K-f 76.77.233.127 (MADISONTELCO.COM):
MADISON TELEPHONE COMPANY,
HAMEL, ILLINOIS, US. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

10:38:00 WinXP 85.181.30.15 (ALICEDSL.DE):
HANSENET-ADSL,
DE. (DSL) n/a 445 pcap raw alerts
ruleset shell
5 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

11:01:00 Win2K-f 82.241.177.217 (PROXAD.NET):
PROXAD / FREE SAS,
NICE, PROVENCE-ALPES-COTE D'AZUR, FR. n/a US:hail.dns2go.com
SA:scorti1.dns2go.com
US:208.101.48.210:7000
CN:61.185.73.19:7000 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 21 of 32 5f78ff609d
[Firefox:1534 hits: 04-27 to 06-26] d4a06bdc3a [0] ASM:Graph
none|none lines=4 trace

T:11:03:00 Win2K-f 12.75.134.96 (ATT.NET):
AT&T WORLDNET SERVICES,
MINNEAPOLIS, MINNESOTA, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 27 of 32 6c36e19037
NEW none[4] none:none
none|none none trace

T:11:27:00 Win2K-f 41.207.197.157 (ADSL-41-207-192-10.AVISO.CI):
AFRINIC,
CI. (DSL) n/a US:hail.dns2go.com 445 pcap raw alerts
ruleset ftp
irc
28 lines Yeah : 0.8
profile none summary
tarball 21 of 32 5f78ff609d
[Firefox:1534 hits: 04-27 to 06-26] d4a06bdc3a [0] ASM:Graph
none|none lines=4 trace

T:11:29:00 WinXP 92.83.123.165 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball none 5a387593a6
NEW none[none] none:none
none|none none none

T:11:30:00 Win2K-f 70.63.150.21 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a US:microsoft.com
PL:proxim.ircgalaxy.pl
US:download.microsoft.com 135 pcap raw alerts
ruleset http
191 lines Yeah : 1.3
profile none summary
tarball 29 of 32
0 of 32
none 2110c8100f
[Firefox: 2 hits: 06-19 to 06-23]
b5919931fe
[Firefox:34 hits: 06-20 to 06-26]
e818015a89
NEW none[4]
b5919931fe[1]
e818015a89[1] none:none
ASM:Graph
ASM:Graph
PolyEnE|
ASProtect|
Armadillo| none
lines=90
lines=81 trace
trace
trace

11:32:00 WinXP 86.130.219.27 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
LONDON, ENGLAND, UK. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:1358 hits: 12-31 to 06-26] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

11:33:00 Win2K-f 4.184.95.169 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SPARTA, NEW JERSEY, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:216.246.93.73:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
a08f3b74a4
[Firefox:81 hits: 06-18 to 06-26] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

12:00:00 WinXP 89.51.159.134 (PPPOOL.DE):
FREENET CITYLINE GMBH,
'S-HERTOGENBOSCH, NOORD-BRABANT, NL. (DIAL) n/a DE:siliconfireware.ru
:www.proxy-socks.net
:wpad
DE:212.227.111.29:80
DE:217.11.54.126:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:1070 hits: 05-01 to 06-26] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

T:12:13:00 WinXP 79.138.232.187 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3102 hits: 12-31 to 06-26] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

12:14:00 WinXP 79.138.232.187 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3102 hits: 12-31 to 06-26] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:12:36:00 WinXP 121.92.86.234 (INFOWEB.NE.JP):
INFOWEB(FUJITSU LTD.),
TOKYO, TOKYO, JP. (DIAL) 217.170.244.2:443 445 pcap raw alerts
ruleset shell
ftp
irc
29 lines Yeah : 1.8
profile none summary
tarball 29 of 32 0e728bb284
NEW none[none] none:none
none|none none none

T:12:42:00 WinXP 85.181.45.107 (ALICEDSL.DE):
HANSENET-ADSL,
MUNICH, BAYERN, DE. (DSL) n/a 445 pcap raw alerts
ruleset shell
4 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:12:55:00 WinXP 170.51.237.213 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a RU:moscow-advokat.ru
:brussels.be.eu.undernet.org
SE:ozbytes.dal.net
:los-angeles.ca.us.undernet.org
SE:coins.dal.net
:flanders.be.eu.undernet.org
SE:qis.md.us.dal.net
:washington.dc.us.undernet.org
NL:diemen.nl.eu.undernet.org
SE:vancouver.dal.net 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:1358 hits: 12-31 to 06-26] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

12:57:00 WinXP 62.46.13.11 (TELEKOM.AT):
HIGHWAY CUSTOMERS,
VIENNA, WIEN, AT. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 d42c1cc7c0
[Firefox:307 hits: 05-01 to 06-26] af9ca5bed1 [0] ASM:Graph
PolyEnE| lines=54 trace

13:09:00 Win2K-f 202.75.250.33 (-):
CHINA UNICOM (MACAU) COMPANY LIMITED,
MACAU, MACAU, MO. n/a US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
57ce4acac2
[Firefox:24 hits: 06-17 to 06-26] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:13:10:00 Win2K-f 172.191.242.80 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
85 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
a08f3b74a4
[Firefox:81 hits: 06-18 to 06-26] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

13:24:00 WinXP 12.72.52.21 (ATT.NET):
AT&T WORLDNET SERVICES,
CORONA, CALIFORNIA, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

13:48:00 Win2K-f 76.253.141.254 (PACBELL.NET):
AT&T INTERNET SERVICES,
US. n/a US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
a08f3b74a4
[Firefox:81 hits: 06-18 to 06-26] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:14:24:00 Win2K-f 124.241.141.55 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, AICHI, JP. n/a US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
79 lines Yeah : 1.3
profile none summary
tarball 32 of 33
9 of 33 2851817490
NEW
624c441842
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:14:28:00 WinXP 41.214.139.75 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3102 hits: 12-31 to 06-26] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

14:29:00 WinXP 92.40.178.173 (IKBCC.COM):
EU-ZZ,
UK. n/a PL:proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 30 of 32 7a393628ea
[Firefox: 3 hits: 05-12 to 05-22] none[4] none:none
ASProtect| none trace

14:34:00 WinXP 71.121.66.196 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
ERIE, PENNSYLVANIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
a08f3b74a4
[Firefox:81 hits: 06-18 to 06-26] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:14:51:00 Win2K-f 4.169.124.254 (TECHNIP.US):
LEVEL 3 COMMUNICATIONS INC,
LOS ANGELES, CALIFORNIA, US. (DIAL) n/a US:microsoft.com
PL:proxim.ircgalaxy.pl
US:download.microsoft.com
US:8.12.202.125:80 135 pcap raw alerts
ruleset other
232 lines Yeah : 1.3
profile none summary
tarball 29 of 33
30 of 33 5126de19b5
NEW
85cf2bf2c3
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

15:09:00 Win2K-f 196.28.241.81 (-):
AFRINIC,
BF. n/a US:hail.dns2go.com
SA:scorti1.dns2go.com
US:208.101.48.210:7000
CN:61.185.73.19:7000 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 21 of 32 5f78ff609d
[Firefox:1534 hits: 04-27 to 06-26] d4a06bdc3a [0] ASM:Graph
none|none lines=4 trace

15:09:00 WinXP 70.71.105.49 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a PL:proxim.ircgalaxy.pl
UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 30 of 32 3f5ec58a6b
[Firefox:30 hits: 04-24 to 06-25] 4a77430a59 [0] ASM:Graph
PolyEnE| lines=70 trace

T:15:26:00 WinXP 161.184.23.182 (TELUS.NET):
EDMONTON TELEPHONES CORPORATION,
RED DEER, ALBERTA, CA. (DIAL) n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
GB:new.egg.com
:wpad
DE:212.227.111.29:80
DE:217.11.54.126:80
GB:217.145.225.22:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
http
8 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:1070 hits: 05-01 to 06-26] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

15:37:00 WinXP 71.65.24.176 (RR.COM):
ROAD RUNNER HOLDCO LLC,
ANN ARBOR, MICHIGAN, US. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:77 hits: 09-28 to 06-26] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

15:39:00 WinXP 118.243.129.205 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 30 of 32 8ae058b2d0
[Firefox: 4 hits: 05-01 to 06-21] e6a9383b75 [0] ASM:Graph
none|none lines=59 trace

15:53:00 Win2K-f 4.252.244.82 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:15:56:00 Win2K-f 122.106.111.232 (OPTUSNET.COM.AU):
OPTUS INTERNET - RETAIL,
SYDNEY, NEW SOUTH WALES, AU. n/a 135 pcap raw alerts
ruleset other
164 lines Yeah : 1.3
profile none summary
tarball 29 of 33 a5308d87d0
[Firefox: 3 hits: 06-21 to 06-25] a5308d87d0 [1] ASM:Graph
Armadillo| lines=81 trace

T:16:00:00 Win2K-f 24.84.52.42 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
BURNABY, BRITISH COLUMBIA, CA. (DSL) n/a PL:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
114 lines Yeah : 1.3
profile none summary
tarball 32 of 33
29 of 33 1a3a423319
NEW
d4c7af762e
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

16:07:00 Win2K-f 70.183.165.162 (COX.NET):
COX COMMUNICATIONS,
PROVIDENCE, RHODE ISLAND, US. n/a US:microsoft.com
US:download.microsoft.com
US:198.78.220.126:80
US:207.123.46.125:80
US:4.23.60.125:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
a08f3b74a4
[Firefox:81 hits: 06-18 to 06-26] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:16:08:00 Win2K-f 216.10.186.24 (WISPNET.NET):
WISPNET LLC,
JACKSONVILLE, NORTH CAROLINA, US. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

16:11:00 Win2K-f 85.174.8.177 (RUNEXT.COM):
PROVIDER LOCAL REGISTRY,
RU. n/a US:hail.dns2go.com
SA:scorti1.dns2go.com
US:208.101.48.210:7000
CN:61.185.73.19:7000 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 21 of 32 5f78ff609d
[Firefox:1534 hits: 04-27 to 06-26] d4a06bdc3a [0] ASM:Graph
none|none lines=4 trace

16:15:00 WinXP 202.39.210.91 (HINET.NET):
DATA COMMUNICATION BUSINESS GROUP,
TW. n/a US:microsoft.com
US:download.microsoft.com
US:12.190.48.65:80
US:12.190.48.97:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
73f1082158
[Firefox:91 hits: 06-18 to 06-26] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:16:16:00 Win2K-f 24.80.161.105 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
96 lines Yeah : 1.3
profile none summary
tarball 31 of 32
2 of 32 607b60ad51
[Firefox: 2 hits: 06-20 to 06-24]
e5c7bce70e
[Firefox: 2 hits: 06-20 to 06-24] none[4]
e5c7bce70e[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:16:33:00 Win2K-f 116.126.249.171 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

16:37:00 WinXP 98.133.140.67 (-):
ALLTEL SIP CUSTOMERS - CLEVELAND,
CLEVELAND, OHIO, US. n/a PL:proxim.ircgalaxy.pl
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
21 lines Yeah : 1.3
profile none summary
tarball 31 of 33 71731fa97c
NEW none[none] none:none
none|none none none

16:43:00 Win2K-f 81.181.17.239 (-):
GENIUS NETWORK SYSTEM SRL,
GALATI, GALATI, RO. (DSL) n/a 445 pcap raw alerts
ruleset ftp
22 lines Yeah : 1.3
profile none summary
tarball 15 of 33 9dc58da41a
NEW none[none] none:none
none|none none none

T:16:46:00 Win2K-f 86.35.109.70 (PLATINUMGROUP.RO):
ARTELECOM,
RO. n/a US:hail.dns2go.com
SA:scorti1.dns2go.com
US:208.101.48.210:7000
CN:61.185.73.19:7000 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 27 of 32 fb28fc1d41
[Firefox: 2 hits: 05-11 to 05-21] none[4] none:none
none|none none trace

16:53:00 WinXP 189.51.242.169 (BRASILTELECOM.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. n/a PL:proxim.ircgalaxy.pl
US:hail.dns2go.com
SA:scorti1.dns2go.com
US:208.101.48.210:7000 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 30 of 33 f24d05091f
NEW none[none] none:none
none|none none none

16:57:00 Win2K-f 24.137.104.70 (EASTLINK.CA):
EASTLINK,
HALIFAX, NOVA SCOTIA, CA. n/a US:microsoft.com
US:download.microsoft.com
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
a08f3b74a4
[Firefox:81 hits: 06-18 to 06-26] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:17:06:00 Win2K-f 60.238.80.107 (MESH.AD.JP):
NEC CORPORATION,
JP. n/a 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 30 of 33 7ccaa77905
NEW none[none] none:none
none|none none none

17:07:00 WinXP 125.215.127.185 (PIKARA.NE.JP):
PIKARA(STNET INCORPORATED),
JP. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 26 of 33 ca15c09536
NEW none[none] none:none
none|none none none

17:10:00 Win2K-f 221.189.48.232 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 20 of 33 17739a55ad
NEW none[none] none:none
none|none none none

17:11:00 WinXP 87.196.20.126 (NET.NOVIS.PT):
NOVIS TELECOM S.A,
LISBON, LISBOA, PT. (DSL) n/a US:hail.dns2go.com
SA:scorti1.dns2go.com
US:208.101.48.210:7000
CN:61.185.73.19:7000 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 30 of 33 78206cf024
NEW none[none] none:none
none|none none none

17:11:00 Win2K-f 121.87.85.146 (EONET.NE.JP):
K-OPTICOM CORPORATION,
JP. n/a 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 20 of 33 17739a55ad
NEW none[none] none:none
none|none none none

T:17:12:00 Win2K-f 4.252.233.229 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:17:14:00 Win2K-f 118.236.12.204 (-):
. n/a PL:proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 29 of 33 0d0fa96607
NEW none[none] none:none
none|none none none

17:27:00 Win2K-f 91.66.60.239 (SUPERKABEL.DE):
KABEL DEUTSCHLAND BREITBAND SERVICE GMBH,
DE. n/a 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 31 of 33 a2f07912bb
NEW none[none] none:none
none|none none none

T:17:29:00 Win2K-f 82.234.37.37 (PROXAD.NET):
PROXAD / FREE SAS,
NICE, PROVENCE-ALPES-COTE D'AZUR, FR. n/a 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 31 of 33 829052414a
NEW none[none] none:none
none|none none none

T:17:31:00 WinXP 122.27.22.31 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a PL:proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball none 142697d16f
NEW none[none] none:none
none|none none none

17:32:00 WinXP 81.151.147.119 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
LONDON, ENGLAND, UK. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
19 lines Yeah : 1.3
profile none summary
tarball 30 of 33 2523b367f6
NEW none[none] none:none
none|none none none

17:32:00 WinXP 222.146.76.218 (KOMAKI-ONSEN.CO.JP):
OPEN COMPUTER NETWORK,
JP. n/a PL:proxim.ircgalaxy.pl
US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 23 of 33 7a321d0141
NEW none[none] none:none
none|none none none

T:17:33:00 Win2K-f 119.11.82.42 (-):
. n/a 445 pcap raw alerts
ruleset ftp
22 lines Yeah : 1.3
profile none summary
tarball 31 of 33 342aa7ee8a
NEW none[none] none:none
none|none none none

T:17:42:00 Win2K-f 118.237.45.105 (-):
. n/a 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 20 of 33 17739a55ad
NEW none[none] none:none
none|none none none

17:42:00 Win2K-f 76.161.225.191 (-):
. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

17:50:00 WinXP 125.2.32.141 (INFOWEB.NE.JP):
INFOWEB(FUJITSU LTD.),
TOKYO, TOKYO, JP. (DIAL) n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 20 of 33 17739a55ad
NEW none[none] none:none
none|none none none

17:51:00 WinXP 118.1.101.125 (-):
. n/a PL:proxima.ircgalaxy.pl
US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
26 lines Yeah : 1.3
profile none summary
tarball 31 of 33 aa346f4557
NEW none[none] none:none
none|none none none

T:17:52:00 Win2K-f 122.132.56.44 (MESH.AD.JP):
NEC BIGLOBE LTD,
TOKYO, TOKYO, JP. n/a 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball none 8b71f756d4
NEW none[none] none:none
none|none none none

17:54:00 WinXP 221.127.143.78 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 26 of 33 ca15c09536
NEW none[none] none:none
none|none none none

T:17:55:00 Win2K-f 124.102.67.156 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset ftp
25 lines Yeah : 1.3
profile none summary
tarball 20 of 33 17739a55ad
NEW none[none] none:none
none|none none none

T:17:56:00 WinXP 66.38.51.108 (DUO-COUNTY.COM):
DUO COUNTY TELEPHONE COOPERATIVE,
CAVE CITY, KENTUCKY, US. (DSL) 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 29 of 29 a0139d7ad8
[Firefox:443 hits: 05-02 to 06-26] d9e9662db1 [0] ASM:Graph
PolyEnE| lines=68 trace

T:17:58:00 WinXP 203.70.120.228 (SEED.NET.TW):
DIGITAL UNITED INC,
KAOHSIUNG, KAO-HSIUNG, TW. n/a RU:moscow-advokat.ru
EU:gaz-prom.ru
:los-angeles.ca.us.undernet.org
AT:graz.at.eu.undernet.org
NO:london.uk.eu.undernet.org
:gaspode.zanet.org.za
:brussels.be.eu.undernet.org
:caen.fr.eu.undernet.org
RU:irc.tsk.ru
:irc.kar.net
:washington.dc.us.undernet.org 445 pcap raw alerts
ruleset other
0 lines Yeah : 1.3
profile none summary
tarball 33 of 33 9edaa61558
[Firefox: 2 hits: 06-24 to 06-24] none[4] none:none
PolyEnE| none trace

T:18:00:00 WinXP 202.70.243.206 (ONINET.NE.JP):
OKAYAMA NETWORK INC,
TOKYO, TOKYO, JP. n/a 445 pcap raw alerts
ruleset other
13 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

18:01:00 Win2K-f 4.139.120.96 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
PITTSBURGH, PENNSYLVANIA, US. (DIAL) n/a PL:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:4.23.60.125:80 135 pcap raw alerts
ruleset other
157 lines Yeah : 1.3
profile none summary
tarball none
32 of 33 470e7533c6
NEW
9b5f91cb49
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

18:03:00 Win2K-f 63.245.179.88 (KITUSA.COM):
KANSAS INDEPENDENT TELECOMMUNICATIONS,
MCPHERSON, KANSAS, US. n/a 135 pcap raw alerts
ruleset other
53 lines Yeah : 1.3
profile none summary
tarball 0 of 32 73f1082158
[Firefox:91 hits: 06-18 to 06-26] 73f1082158 [1] ASM:Graph
Armadillo| lines=81 trace

T:18:11:00 Win2K-f 118.236.121.203 (-):
. n/a 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 31 of 33 13c759bee3
NEW none[none] none:none
none|none none none

T:18:12:00 Win2K-f 123.222.116.174 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 20 of 33 17739a55ad
NEW none[none] none:none
none|none none none

18:20:00 WinXP 125.197.21.196 (MESH.AD.JP):
NEC CORPORATION,
JP. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 25 of 33 80205569e9
NEW none[none] none:none
none|none none none

T:18:21:00 WinXP 118.6.141.78 (-):
. 69.247.147.113:13001 US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
104 lines Yeah : 1.8
profile none summary
tarball 26 of 33 ca15c09536
NEW none[none] none:none
none|none none none

18:24:00 Win2K-f 121.87.76.113 (EONET.NE.JP):
K-OPTICOM CORPORATION,
JP. n/a 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 27 of 32 6c36e19037
NEW none[4] none:none
none|none none trace

18:27:00 WinXP 125.193.43.72 (MESH.AD.JP):
NEC CORPORATION,
JP. n/a 445 pcap raw alerts
ruleset ftp
26 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

18:31:00 WinXP 125.174.7.208 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 20 of 33 17739a55ad
NEW none[none] none:none
none|none none none

T:18:32:00 Win2K-f 124.102.97.148 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. 69.247.147.113:13001 PL:proxim.ircgalaxy.pl
US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
45 lines Yeah : 1.8
profile none summary
tarball 17 of 33 0e78be6c38
NEW none[none] none:none
none|none none none

T:18:42:00 Win2K-f 59.190.172.147 (EONET.NE.JP):
K-OPTICOM CORPORATION,
NISHINOMIYA, HYOGO, JP. n/a PL:proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 31 of 33 c56184f13b
NEW none[none] none:none
none|none none none

T:18:42:00 WinXP 219.250.173.252 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a PL:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
115 lines Yeah : 1.3
profile none summary
tarball 29 of 32
28 of 32
0 of 33 8a75955033
[Firefox: 3 hits: 06-20 to 06-25]
9276c8b36b
[Firefox: 3 hits: 06-20 to 06-25]
e07c29c4ae
[Firefox:36 hits: 06-19 to 06-26] none[4]
9276c8b36b[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:18:49:00 Win2K-f 219.255.83.93 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
PL:proxima.ircgalaxy.pl
US:download.microsoft.com 135 pcap raw alerts
ruleset http
87 lines Yeah : 1.3
profile none summary
tarball 31 of 33
0 of 33
0 of 32 1509c8d024
[Firefox: 3 hits: 06-17 to 06-24]
a08f3b74a4
[Firefox:81 hits: 06-18 to 06-26]
b5919931fe
[Firefox:34 hits: 06-20 to 06-26] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

18:50:00 Win2K-f 218.228.25.67 (CTT.NE.JP):
CABLE TELEVISION TOYAMA INCORPORETED,
TOKYO, TOKYO, JP. 67.43.236.66:8080 72.10.172.211:8080 CA:xx.nadnadzz.info
CA:xx.ka3ek.com
CA:xx.enterhere.biz
CA:67.43.226.242:8080
CA:67.43.236.66:8080
CA:67.43.236.98:10324
CA:67.43.236.98:1863
CA:67.43.236.99:10324
CA:67.43.236.99:1863
CA:72.10.172.211:8080 135 pcap raw alerts
ruleset other
268 lines Yeah : 1.8
profile none summary
tarball 31 of 33 954a98c971
[Firefox: 2 hits: 06-09 to 06-23] none[4] none:none
FSG| none trace

18:56:00 WinXP 124.82.0.71 (TM.NET.MY):
TM ADSL SERVICE PROVIDER MALAYSIA,
SHAH ALAM, SELANGOR, MY. (DSL) n/a US:hail.dns2go.com
SA:scorti1.dns2go.com
US:208.101.48.210:7000
SA:88.85.242.244:7000 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 21 of 32 5f78ff609d
[Firefox:1534 hits: 04-27 to 06-26] d4a06bdc3a [0] ASM:Graph
none|none lines=4 trace

19:00:00 WinXP 218.227.174.60 (MESH.AD.JP):
BIGLOBE-CIDR-BLK,
JP. n/a PL:proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 31 of 32 e09933a21a
[Firefox: 2 hits: 06-20 to 06-20] none[4] none:none
PolyEnE| none trace

T:19:01:00 WinXP 96.15.113.143 (-):
. 217.170.244.2:443 445 pcap raw alerts
ruleset shell
ftp
irc
34 lines Yeah : 1.8
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2734 hits: 12-31 to 06-26] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

T:19:02:00 Win2K-f 123.217.119.199 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset ftp
26 lines Yeah : 1.3
profile none summary
tarball 20 of 33 17739a55ad
NEW none[none] none:none
none|none none none

19:05:00 WinXP 218.43.46.59 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
TOKYO, TOKYO, JP. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
26 lines Yeah : 1.3
profile none summary
tarball 26 of 33 ca15c09536
NEW none[none] none:none
none|none none none

T:19:07:00 WinXP 58.91.53.145 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. 69.247.147.113:13001 US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
58 lines Yeah : 1.8
profile none summary
tarball 28 of 33 86346e9208
NEW none[none] none:none
none|none none none

T:19:09:00 Win2K-f 123.216.111.124 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. 69.247.147.113:13001 PL:proxima.ircgalaxy.pl
US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
67 lines Yeah : 1.8
profile none summary
tarball 13 of 33 1719ca9d88
NEW none[none] none:none
none|none none none

19:12:00 Win2K-f 58.88.178.167 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2734 hits: 12-31 to 06-26] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

T:19:16:00 WinXP 119.72.33.91 (-):
. n/a 445 pcap raw alerts
ruleset ftp
25 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

19:18:00 WinXP 60.179.207.30 (163DATA.COM.CN):
CHINANET-ZJ NINGBO NODE NETWORK,
NINGBO, ZHEJIANG, CN. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:77 hits: 09-28 to 06-26] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:19:19:00 Win2K-f 123.254.12.93 (PIKARA.NE.JP):
STNET INCORPORATED,
TAKAMATSU, KAGAWA, JP. n/a US:mx1.hotmail.com
PL:proxim.ircgalaxy.pl
US:mailin-03.mx.aol.com
US:ftp.newaol.com
US:yutunrz.1dumb.com
US:mailin-01.mx.aol.com
:sdihsihdsfsofhsohs.net
:nagoo.nagitiriheiwu.net 445 pcap raw alerts
ruleset ftp
http
http
108 lines Yeah : 1.3
profile none summary
tarball 31 of 33
none 089f40cb47
NEW
fc43bb8145
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:19:25:00 WinXP 118.1.177.137 (-):
. n/a PL:proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 30 of 33 23ea63c243
NEW none[none] none:none
none|none none none

19:31:00 Win2K-f 75.33.114.78 (-):
DHCP STLSMO RBACK,
ST. LOUIS, MISSOURI, US. n/a PL:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:199.93.41.124:80
US:207.123.44.126:80
US:207.123.46.125:80 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 29 of 33
32 of 33 c925f34dbe
NEW
f3f14bc33d
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:19:34:00 WinXP 118.236.87.117 (-):
. 69.247.147.113:13001 US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
85 lines Yeah : 1.8
profile none summary
tarball 31 of 33 2803bba055
NEW none[none] none:none
none|none none none

19:39:00 Win2K-f 122.132.23.29 (MESH.AD.JP):
NEC BIGLOBE LTD,
TOKYO, TOKYO, JP. n/a 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 20 of 33 17739a55ad
NEW none[none] none:none
none|none none none

T:19:46:00 WinXP 221.127.35.99 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. 69.247.147.113:13001 US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
90 lines Yeah : 1.8
profile none summary
tarball 29 of 33 ec3d13cabe
NEW none[none] none:none
none|none none none

T:19:48:00 Win2K-f 122.221.250.60 (UCOM.NE.JP):
UCOM CORP,
JP. 69.247.147.113:13001 US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
53 lines Yeah : 1.8
profile none summary
tarball 21 of 33 0726dd069b
NEW none[none] none:none
none|none none none

T:19:56:00 WinXP 118.165.105.219 (-):
. 69.247.147.113:13001 PL:proxim.ircgalaxy.pl
US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
102 lines Yeah : 1.8
profile none summary
tarball none bdbea0832c
NEW none[none] none:none
none|none none none

20:04:00 WinXP 97.93.95.13 (-):
. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
35 lines Yeah : 1.3
profile none summary
tarball 20 of 33 17739a55ad
NEW none[none] none:none
none|none none none

20:13:00 WinXP 61.45.55.13 (WAKWAK.NE.JP):
XEPHION(NTT-ME CORPORATION),
JP. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2734 hits: 12-31 to 06-26] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

20:15:00 Win2K-f 61.231.155.70 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAOYUAN, T'AI-WAN, TW. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2734 hits: 12-31 to 06-26] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

T:20:16:00 WinXP 125.215.112.106 (PIKARA.NE.JP):
PIKARA(STNET INCORPORATED),
JP. 69.247.147.113:13001 US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
57 lines Yeah : 1.8
profile none summary
tarball 30 of 33 12407483a7
NEW none[none] none:none
none|none none none

T:20:19:00 Win2K-f 123.225.123.177 (OCN.NE.JP):
NTT COMMUNICATIONS CORPORATION,
TOKYO, TOKYO, JP. 69.247.147.113:13001 US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
51 lines Yeah : 1.8
profile none summary
tarball 10 of 33 d2c26e07fd
NEW none[none] none:none
none|none none none

T:20:20:00 WinXP 119.72.21.31 (-):
. 69.247.147.113:13001 PL:proxim.ircgalaxy.pl
US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
48 lines Yeah : 1.8
profile none summary
tarball 22 of 33 869081411d
NEW none[none] none:none
none|none none none

T:20:21:00 Win2K-f 122.26.46.117 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 20 of 33 17739a55ad
NEW none[none] none:none
none|none none none

T:20:27:00 Win2K-f 60.254.245.147 (EMOBILE.AD.JP):
EMOBILE LTD,
TOKYO, TOKYO, JP. 69.247.147.113:13001 PL:proxim.ircgalaxy.pl
US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
60 lines Yeah : 1.8
profile none summary
tarball 23 of 33 904d7f95d6
NEW none[none] none:none
none|none none none

20:35:00 Win2K-f 221.189.81.70 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
26 lines Yeah : 1.3
profile none summary
tarball 16 of 33 3027d57000
NEW none[none] none:none
none|none none none

20:38:00 Win2K-f 4.244.198.27 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
PLEASANT HILL, MISSOURI, US. (DIAL) 4.244.198.27:21 :irc.drxclusives.info
US:b.mx.mail.yahoo.com
US:c.mx.mail.yahoo.com
CA:activestate.com
US:d.mx.mail.yahoo.com
US:cpan.mx.develooper.com
US:e.mx.mail.yahoo.com
:mail.activestate.com
:smtp.activestate.com
:mx1.activestate.com
:mxs.activestate.com
:mail1.activestate.com
:relay.activestate.com
:ns.activestate.com
:gate.activestate.com
FR:spool.mail.gandi.net
US:cpan.org
US:f.mx.mail.yahoo.com
FR:fb.mail.gandi.net
:mx.cpan.org
DE:convex.com
:alcatel.at
:msg.com.mx
US:wamnet.com
GB:opengroup.org
US:jpmorgan.com
:scalpel.netlabs.com
NZ:132.181.2.61:25
NZ:132.181.2.71:25
CA:204.244.102.3:25
CA:204.244.102.6:25
US:216.39.53.1:25
US:216.52.237.216:25
FR:217.70.184.6:25
US:66.196.82.7:25
US:66.196.97.250:25
US:66.39.76.93:25 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.8
profile none summary
tarball 33 of 33 94d9f89ef5
NEW none[none] none:none
none|none none none

T:20:39:00 Win2K-f 64.139.104.242 (RCABLETV.COM):
NCI DATA.COM INC,
REPUBLIC, WASHINGTON, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
78 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
73f1082158
[Firefox:91 hits: 06-18 to 06-26]
b5919931fe
[Firefox:34 hits: 06-20 to 06-26] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

20:40:00 WinXP 119.72.62.230 (-):
. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
26 lines Yeah : 1.3
profile none summary
tarball 31 of 33 423f9090c5
NEW none[none] none:none
none|none none none

T:20:43:00 Win2K-f 124.85.187.110 (OCN.NE.JP):
NTT COMMUNICATIONS CORPORATION,
TOKYO, TOKYO, JP. n/a 445 pcap raw alerts
ruleset ftp
25 lines Yeah : 1.3
profile none summary
tarball 26 of 33 ca15c09536
NEW none[none] none:none
none|none none none

20:44:00 WinXP 207.144.164.230 (INFOAVE.NET):
INFO AVENUE INTERNET SERVICES LLC,
MYRTLE BEACH, SOUTH CAROLINA, US. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 26 of 33 ca15c09536
NEW none[none] none:none
none|none none none

20:45:00 WinXP 4.235.90.14 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

20:50:00 Win2K-f 125.173.248.67 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a PL:proxima.ircgalaxy.pl 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 31 of 33 b6075d6a91
NEW none[none] none:none
none|none none none

T:20:52:00 WinXP 75.138.120.9 (CHARTER.COM):
CHARTER COMMUNICATIONS,
HICKORY, NORTH CAROLINA, US. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:192.221.99.126:80
US:4.23.60.126:80 135 pcap raw alerts
ruleset other
180 lines Yeah : 1.3
profile none summary
tarball 29 of 33
29 of 32 ae4bed1aa9
NEW
bc51bd8226
NEW ae4bed1aa9 [1]
none [4] ASM:Graph
none:none
Armadillo|
PolyEnE| lines=81
none trace
trace

T:20:54:00 WinXP 98.134.209.88 (-):
. 217.170.244.2:443
CZ:217.170.244.2:443 445 pcap raw alerts
ruleset shell
ftp
irc
27 lines Yeah : 1.8
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2734 hits: 12-31 to 06-26] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

21:02:00 WinXP 60.37.202.99 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 10 of 33 d2c26e07fd
NEW none[none] none:none
none|none none none

21:04:00 Win2K-f 218.43.172.156 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
SASEBO, NAGASAKI, JP. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 10 of 33 d2c26e07fd
NEW none[none] none:none
none|none none none

T:21:10:00 WinXP 202.70.249.50 (ONINET.NE.JP):
OKAYAMA NETWORK INC,
TOKYO, TOKYO, JP. 69.247.147.113:13001 US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
52 lines Yeah : 1.8
profile none summary
tarball 20 of 33 17739a55ad
NEW none[none] none:none
none|none none none

T:21:12:00 Win2K-f 221.189.81.70 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. 69.247.147.113:13001 US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
41 lines Yeah : 1.8
profile none summary
tarball 16 of 33 3027d57000
NEW none[none] none:none
none|none none none

21:14:00 Win2K-f 71.110.44.89 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
TEMECULA, CALIFORNIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
96.6.127.18:80
96.6.127.74:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
a08f3b74a4
[Firefox:81 hits: 06-18 to 06-26] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:21:14:00 WinXP 81.181.17.239 (-):
GENIUS NETWORK SYSTEM SRL,
GALATI, GALATI, RO. (DSL) 69.247.147.113:13001 US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
irc
43 lines Yeah : 1.8
profile none summary
tarball 12 of 33 649045f4d1
NEW none[none] none:none
none|none none none

T:21:37:00 Win2K-f 62.47.24.249 (TELEKOM.AT):
HIGHWAY CUSTOMERS,
VIENNA, WIEN, AT. n/a 445 pcap raw alerts
ruleset ftp
24 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

21:37:00 WinXP 71.107.182.232 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
HUNTINGTON BEACH, CALIFORNIA, US. (DSL) n/a PL:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:72.247.30.144:80
US:72.247.30.211:80 135 pcap raw alerts
ruleset other
119 lines Yeah : 1.3
profile none summary
tarball 32 of 33
28 of 33 674a8410bc
NEW
de22e96421
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:21:42:00 Win2K-f 89.245.249.121 (VERSANETONLINE.DE):
VERSATEL NORD-DEUTSCHLAND GMBH,
DE. n/a 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 30 of 33 b03ef6106a
NEW none[none] none:none
none|none none none

T:21:43:00 WinXP 118.109.148.194 (-):
. 69.247.147.113:13001 US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
35 lines Yeah : 1.8
profile none summary
tarball 30 of 33 da7aac0dc4
NEW none[none] none:none
none|none none none

21:48:00 WinXP 218.236.127.187 (PANELPOWER.NET):
HANARO TELECOM CO,
KR. n/a PL:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
124 lines Yeah : 1.3
profile none summary
tarball 29 of 33
31 of 33 98dc372fec
NEW
e10a7cbe18
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:21:48:00 WinXP 66.38.51.108 (DUO-COUNTY.COM):
DUO COUNTY TELEPHONE COOPERATIVE,
CAVE CITY, KENTUCKY, US. (DSL) n/a UA:citi-bank.ru
EU:kidos-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 29 of 29 a0139d7ad8
[Firefox:443 hits: 05-02 to 06-26] d9e9662db1 [0] ASM:Graph
PolyEnE| lines=68 trace

21:58:00 WinXP 118.165.120.224 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 27 of 32 6c36e19037
NEW none[4] none:none
none|none none trace

21:58:00 Win2K-f 59.190.172.147 (EONET.NE.JP):
K-OPTICOM CORPORATION,
NISHINOMIYA, HYOGO, JP. n/a PL:proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 31 of 33 c56184f13b
NEW none[none] none:none
none|none none none

T:22:01:00 WinXP 119.72.7.122 (-):
. 69.247.147.113:13001 PL:proxim.ircgalaxy.pl
US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
67 lines Yeah : 1.8
profile none summary
tarball 18 of 33 f6f494b764
NEW none[none] none:none
none|none none none

T:22:02:00 WinXP 75.79.5.106 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
a08f3b74a4
[Firefox:81 hits: 06-18 to 06-26] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

22:04:00 Win2K-f 88.134.231.215 (SUPERKABEL.DE):
KABEL-DEUTSCHLAND-CUSTOMER-SERVICES,
DE. n/a 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 32 of 33 d160f9372c
NEW none[none] none:none
none|none none none

22:07:00 WinXP 124.84.37.171 (OCN.NE.JP):
NTT COMMUNICATIONS CORPORATION,
TOKYO, TOKYO, JP. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:660 hits: 07-11 to 06-26] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

T:22:09:00 WinXP 118.8.227.73 (-):
. 69.247.147.113:13001 US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
46 lines Yeah : 1.8
profile none summary
tarball 30 of 33 1f7c55af5a
NEW none[none] none:none
none|none none none

T:22:12:00 Win2K-f 118.1.203.144 (-):
. n/a PL:proxima.ircgalaxy.pl 445 pcap raw alerts
ruleset ftp
26 lines Yeah : 1.3
profile none summary
tarball 31 of 33 a4fbe49195
NEW none[none] none:none
none|none none none

22:19:00 Win2K-f 61.203.196.192 (FCV.NE.JP):
THE FOUNDATION OF FUKUOKA CABLE VISION,
FUKUOKA, FUKUOKA, JP. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 10 of 33 d2c26e07fd
NEW none[none] none:none
none|none none none

22:19:00 WinXP 118.240.193.171 (-):
. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
26 lines Yeah : 1.3
profile none summary
tarball 26 of 33 ca15c09536
NEW none[none] none:none
none|none none none

T:22:24:00 Win2K-f 118.236.170.218 (-):
. n/a 445 pcap raw alerts
ruleset ftp
26 lines Yeah : 1.3
profile none summary
tarball 30 of 33 cb91536709
NEW none[none] none:none
none|none none none

22:25:00 Win2K-f 118.236.170.218 (-):
. n/a 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 30 of 33 cb91536709
NEW none[none] none:none
none|none none none

T:22:33:00 WinXP 125.58.99.151 (-):
. n/a PL:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:199.93.46.124:80 135 pcap raw alerts
ruleset http
113 lines Yeah : 1.3
profile none summary
tarball 30 of 33
31 of 33 6bcbfcd0e8
NEW
84d3354186
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

22:35:00 Win2K-f 122.133.208.151 (MESH.AD.JP):
NEC BIGLOBE LTD,
TOKYO, TOKYO, JP. n/a 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 30 of 33 da7aac0dc4
NEW none[none] none:none
none|none none none

T:22:40:00 Win2K-f 60.34.72.13 (PLALA.OR.JP):
PLALA NETWORKS INC,
JP. n/a PL:proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 31 of 33 9750d49a0f
NEW none[none] none:none
none|none none none

T:22:46:00 Win2K-f 219.97.18.51 (INFOWEB.NE.JP):
INFOWEB(FUJITSU LTD.),
TOKYO, TOKYO, JP. (DIAL) 69.247.147.113:13001 US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
33 lines Yeah : 1.8
profile none summary
tarball 13 of 33 7e8babc6f9
NEW none[none] none:none
none|none none none

22:52:00 WinXP 119.11.85.23 (-):
. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
26 lines Yeah : 1.3
profile none summary
tarball 30 of 33 63c7d38553
NEW none[none] none:none
none|none none none

T:22:54:00 Win2K-f 60.38.119.105 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 32 of 33 2068982cbf
NEW none[none] none:none
none|none none none

T:22:55:00 WinXP 202.247.38.54 (MESH.AD.JP):
C&C INTERNET SERVICE MESH (NEC CORPORATION),
TOKYO, TOKYO, JP. 69.247.147.113:12351 US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
irc
40 lines Yeah : 1.8
profile none summary
tarball 26 of 33 ca15c09536
NEW none[none] none:none
none|none none none

22:56:00 Win2K-f 122.133.252.236 (MESH.AD.JP):
NEC BIGLOBE LTD,
TOKYO, TOKYO, JP. n/a 445 pcap raw alerts
ruleset other
13 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

23:01:00 Win2K-f 221.126.241.87 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. n/a 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 17 of 33 1ca3d2c6a9
NEW none[none] none:none
none|none none none

23:02:00 Win2K-f 118.240.29.140 (-):
. n/a 445 pcap raw alerts
ruleset ftp
28 lines Yeah : 1.3
profile none summary
tarball 26 of 33 ca15c09536
NEW none[none] none:none
none|none none none

T:23:06:00 Win2K-f 210.147.164.180 (MESH.AD.JP):
C&C INTERNET SERVICE MESH(NEC CORPORATION),
TOKYO, TOKYO, JP. 72.10.172.218:7763 CA:mypal.urpal43sourpalhuh.com
:sdihsihdsfsofhsohs.net
:nagoo.nagitiriheiwu.net
CA:haiys.eiheihre3.com
CA:72.10.172.218:3838
CA:72.10.172.218:7763 445 pcap raw alerts
ruleset ftp
26 lines Yeah : 1.8
profile none summary
tarball 24 of 29 97ac56e1eb
[Firefox:26 hits: 07-10 to 12-18] none[none] none:none
none|none none none

T:23:07:00 Win2K-f 72.67.206.76 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
LOS ANGELES, CALIFORNIA, US. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:228 hits: 06-17 to 06-26]
73f1082158
[Firefox:91 hits: 06-18 to 06-26] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

23:10:00 WinXP 119.11.37.246 (-):
. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
26 lines Yeah : 1.3
profile none summary
tarball 13 of 33 72b8e2532c
NEW none[none] none:none
none|none none none

T:23:10:00 WinXP 221.126.241.87 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. n/a 445 pcap raw alerts
ruleset other
13 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

23:12:00 WinXP 123.218.41.227 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 32 of 33 f3cffba6d7
NEW none[none] none:none
none|none none none

T:23:12:00 WinXP 81.70.61.84 (WANADOO.NL):
WANADOO NEDERLAND BV,
ROTTERDAM, ZUID-HOLLAND, NL. (DSL) 69.247.147.113:13001 US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
irc
39 lines Yeah : 1.8
profile none summary
tarball 26 of 33 35a2c37d0f
NEW none[none] none:none
none|none none none

23:12:00 WinXP 83.93.164.30 (ADSL-DHCP.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
SVENDBORG, FYN, DK. (DSL) n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 f5a40500f2
[Firefox:22 hits: 05-08 to 11-08] none[none] none:none
none|none none none

T:23:13:00 WinXP 83.93.164.30 (ADSL-DHCP.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
SVENDBORG, FYN, DK. (DSL) n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 f5a40500f2
[Firefox:22 hits: 05-08 to 11-08] none[none] none:none
none|none none none

23:14:00 WinXP 122.26.199.158 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset ftp
29 lines Yeah : 1.3
profile none summary
tarball none 07c4fd1b82
NEW none[none] none:none
none|none none none

23:24:00 WinXP 219.114.96.114 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 24 of 33 e54d224654
NEW none[none] none:none
none|none none none

T:23:27:00 Win2K-f 81.57.210.11 (RADIOFRHUB.COM):
PROXAD / FREE SAS,
PARIS, ILE-DE-FRANCE, FR. n/a US:chat-shqip.org
US:w3bs.chat-shqip.org
US:69.247.147.113:12351
US:69.247.147.113:13001 445 pcap raw alerts
ruleset ftp
40 lines Yeah : 1.3
profile none summary
tarball 10 of 33 d2c26e07fd
NEW none[none] none:none
none|none none none

T:23:28:00 Win2K-f 121.113.217.68 (PLALA.OR.JP):
PLALA NETWORKS INC,
JP. n/a 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 31 of 33 a558523d9e
NEW none[none] none:none
none|none none none

T:23:32:00 Win2K-f 123.225.21.116 (OCN.NE.JP):
NTT COMMUNICATIONS CORPORATION,
TOKYO, TOKYO, JP. n/a PL:proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset ftp
27 lines Yeah : 1.3
profile none summary
tarball 32 of 33 dd3e6dd560
NEW none[none] none:none
none|none none none

T:23:37:00 WinXP 82.155.221.40 (DSL.TELEPAC.PT):
TELEPAC - COMUNICACOES INTERACTIVAS SA,
MAIA, PORTO, PT. (DSL) 69.247.147.113:13001 US:chat-shqip.org 445 pcap raw alerts
ruleset ftp
irc
52 lines Yeah : 1.8
profile none summary
tarball 13 of 33 ffb3b175e5
NEW none[none] none:none
none|none none none

23:43:00 Win2K-f 82.54.247.142 (RETAIL.TELECOMITALIA.IT):
TELECOM ITALIA S.P.A. TIN EASY LITE,
VENICE, VENETO, IT. n/a US:hail.dns2go.com
SA:scorti1.dns2go.com
US:208.101.48.210:7000
SA:88.85.242.244:7000 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 14 of 32 a2a036466a
[Firefox:270 hits: 05-05 to 06-25] none[4] none:none
none|none none trace