|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| 00:32:00 | WinXP | 196.20.167.221 (-): MAURITIUS TELECOM, MU. |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 [Firefox:1153 hits: 12-31 to 09-24] |
7a70e1b592 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| 01:18:00 | WinXP | 122.146.240.7 (SPARQNET.NET): NEW CENTURY INFOCOMM TECH. CO. LTD, TAIPEI, T'AI-PEI, TW. |
n/a | 135 | pcap | raw alerts ruleset |
other 2 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| 01:26:00 | WinXP | 4.178.60.107 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, SPOKANE, WASHINGTON, US. (DIAL) |
n/a | US:microsoft.com US:download.microsoft.com |
135 | pcap | raw alerts ruleset |
http 138 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] a08f3b74a4 [Firefox:861 hits: 06-18 to 09-24] |
none[4] a08f3b74a4[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| 01:40:00 | Win2K-f | 119.95.133.168 (-): . |
n/a | 135 | pcap | raw alerts ruleset |
other 19 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:01:57:00 | Win2K-f | 98.140.228.75 (-): . |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| 02:01:00 | WinXP | 24.189.169.219 (OPTONLINE.NET): OPTIMUM ONLINE (CABLEVISION SYSTEMS), UNIONDALE, NEW YORK, US. |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.173.46:80 US:208.111.173.47:80 |
135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] |
none[4] 73f1082158[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| 02:18:00 | Win2K-f | 61.220.116.19 (HINET.NET): DATA COMMUNICATION BUSINESS GROUP CHUNGHWA TELECOM CO. LTD, TAIPEI, T'AI-PEI, TW. |
n/a | US:microsoft.com US:download.microsoft.com US:192.221.108.126:80 US:192.221.99.124:80 US:8.12.202.125:80 |
135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 57ce4acac2 [Firefox:203 hits: 06-17 to 09-24] |
none[4] 57ce4acac2[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| T:02:37:00 | Win2K-f | 72.230.139.136 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. |
n/a | US:microsoft.com US:download.microsoft.com US:199.93.41.126:80 US:207.123.37.123:80 US:207.123.37.126:80 |
135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] a08f3b74a4 [Firefox:861 hits: 06-18 to 09-24] |
none[4] a08f3b74a4[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| T:02:49:00 | WinXP | 78.34.13.49 (NETCOLOGNE.DE): NETCOLOGNE GMBH, KOELN, NORDRHEIN-WESTFALEN, DE. |
n/a | :proxim.ircgalaxy.pl UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
35 of 36 | f353d4eed9 [Firefox:16 hits: 09-17 to 09-24] |
none[none] | none:none |
none|none | none | none |
| 02:51:00 | WinXP | 217.245.102.190 (T-DIALIN.NET): DEUTSCHE TELEKOM AG, BERLIN, BERLIN, DE. (DIAL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp shell shell 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 32 | 03f912899b [Firefox:138 hits: 01-08 to 09-24] |
83893bd25d [0] | ASM:Graph |
none|none | lines=65 | trace | |
| 03:04:00 | WinXP | 60.236.51.163 (MESH.AD.JP): NEC CORPORATION, JP. |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 15 lines |
Yeah : 1.3 profile |
none | summary tarball |
29 of 29 | 831f4ee0a7 [Firefox:559 hits: 01-01 to 09-24] |
eb7546c600 [0] | ASM:Graph |
none|none | lines=61 | trace | |
| T:03:06:00 | Win2K-f | 96.51.29.181 (-): . |
n/a | :proxim.ircgalaxy.pl US:microsoft.com US:download.microsoft.com |
135 | pcap | raw alerts ruleset |
http 127 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 36 27 of 32 0 of 32 |
b4397cd867 NEW b455f223d6 [Firefox: 2 hits: 06-20 to 09-14] b5919931fe [Firefox:649 hits: 06-20 to 09-24] |
none[none] b455f223d6[1] b5919931fe[1] |
none:none ASM:Graph ASM:Graph |
none|none Armadillo| ASProtect| |
none lines=81 lines=90 |
none trace trace |
| 03:19:00 | Win2K-f | 193.226.3.134 (ASTRAL.RO): C.A.R.U.S INFORMATION TECHNOLOGY ROMANIA SRL, BRASOV, BRASOV, RO. |
n/a | US:microsoft.com US:download.microsoft.com US:192.221.110.126:80 |
135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] a08f3b74a4 [Firefox:861 hits: 06-18 to 09-24] |
none[4] a08f3b74a4[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| T:03:28:00 | WinXP | 216.244.229.130 (COM.AR): SINECTIS S.A, AR. |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a0139d7ad8 [Firefox:113 hits: 01-03 to 09-24] |
d9e9662db1 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:04:07:00 | Win2K-f | 211.20.96.142 (HINET.NET): CHTD CHUNGHWA TELECOM CO. LTD, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.148.219:80 US:208.111.148.226:80 |
135 | pcap | raw alerts ruleset |
other 572 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 36 34 of 36 |
55d816f3e9 [Firefox: 3 hits: 09-20 to 09-24] 84a24d85f7 [Firefox: 3 hits: 09-20 to 09-24] |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| 04:07:00 | WinXP | 64.130.149.133 (SCRTC.COM): SOUTH CENTRAL RURAL TELEPHONE CO, SAN JOSE, CALIFORNIA, US. (DSL) |
n/a | UA:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 36 | e1b693266c NEW |
none[none] | none:none |
none|none | none | none |
| 04:09:00 | WinXP | 24.165.140.55 (RR.COM): ROAD RUNNER HOLDCO LLC, LORAIN, OHIO, US. |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef [Firefox:532 hits: 01-01 to 09-24] |
40f7f463c4 [0] | ASM:Graph |
ASPack| | lines=281 embedded dns |
trace | |
| T:04:09:00 | WinXP | 213.22.147.37 (CPE.NETCABO.PT): TVCABO-PORTUGAL CABLE MODEM NETWORK, PORTO, PORTO, PT. |
n/a | :proxim.ircgalaxy.pl UA:citi-bank.ru UA:194.54.90.246:80 HK:210.245.211.11:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 36 | 1724b36f09 NEW |
none[none] | none:none |
none|none | none | none |
| T:04:16:00 | Win2K-f | 68.118.77.222 (CHARTER.COM): CHARTER COMMUNICATIONS, NEWPORT, OREGON, US. |
n/a | US:microsoft.com :proxim.ircgalaxy.pl US:download.microsoft.com US:208.111.173.53:80 HK:210.245.211.11:65520 |
135 | pcap | raw alerts ruleset |
other 113 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 36 34 of 36 |
37be569696 NEW b2fa7ba3a5 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:04:19:00 | WinXP | 217.254.166.96 (T-DIALIN.NET): DEUTSCHE TELEKOM AG, DE. (DIAL) |
n/a | 445 | pcap | raw alerts ruleset |
ftp 12 lines |
Yeah : 0.8 profile |
none | summary tarball |
32 of 32 | 03f912899b [Firefox:138 hits: 01-08 to 09-24] |
83893bd25d [0] | ASM:Graph |
none|none | lines=65 | trace | |
| T:04:27:00 | Win2K-f | 65.68.19.187 (-): POPLAR PCS, JONESBORO, ARKANSAS, US. (100Mbps) |
n/a | :proxim.ircgalaxy.pl US:microsoft.com US:download.microsoft.com US:208.111.173.52:80 US:208.111.173.53:80 HK:210.245.211.11:65520 |
135 | pcap | raw alerts ruleset |
other 119 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 33 28 of 32 |
3f0a5b2ebe [Firefox:18 hits: 06-18 to 08-29] c6bfb5f0f2 [Firefox:18 hits: 06-18 to 08-29] |
none[4] c6bfb5f0f2[1] |
none:none ASM:Graph |
PolyEnE| Armadillo| |
none lines=81 |
trace trace |
| T:04:30:00 | Win2K-f | 203.73.68.14 (SEED.NET.TW): DIGITAL UNITED INC, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.173.52:80 |
135 | pcap | raw alerts ruleset |
other 115 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 36 32 of 36 |
214bc429e1 NEW 9ad48d782a NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| 04:34:00 | WinXP | 119.95.104.136 (-): . |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 36 | d958d1df14 NEW |
none[none] | none:none |
none|none | none | none |
| T:04:34:00 | WinXP | 119.95.104.136 (-): . |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 36 | d958d1df14 NEW |
none[none] | none:none |
none|none | none | none |
| 05:36:00 | WinXP | 93.156.139.246 (APEXCOVANTAGE.COM): EU-ZZ, UK. |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 36 | 726638fb22 NEW |
none[none] | none:none |
none|none | none | none |
| T:05:46:00 | WinXP | 213.48.83.13 (BLUEYONDER.CO.UK): TELEWEST DIALUP PLATFORM, BIRMINGHAM, ENGLAND, UK. (DIAL) |
n/a | 445 | pcap | raw alerts ruleset |
ftp 13 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 1a2c0e6130 [Firefox:423 hits: 12-31 to 09-24] |
048df78048 [0] | ASM:Graph |
none|none | lines=61 | trace | |
| T:05:57:00 | WinXP | 70.64.7.67 (GASOC.COM): SHAW COMMUNICATIONS INC, SASKATOON, SASKATCHEWAN, CA. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 11 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| 06:02:00 | WinXP | 60.47.40.196 (PLALA.OR.JP): PLALA NETWORKS INC, JP. |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 32 | 741e3b03b3 [Firefox:399 hits: 01-05 to 09-24] |
e0197e8a64 [0] | ASM:Graph |
none|none | lines=62 | trace | |
| 06:11:00 | Win2K-f | 69.239.122.13 (PACBELL.NET): DANIEL D CLAXTON, PLANO, TEXAS, US. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com US:199.93.44.124:80 US:199.93.53.125:80 US:4.23.60.125:80 |
135 | pcap | raw alerts ruleset |
http 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] a08f3b74a4 [Firefox:861 hits: 06-18 to 09-24] |
none[4] a08f3b74a4[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| T:06:29:00 | WinXP | 83.132.254.87 (CPE.NETCABO.PT): TVCABO-PORTUGAL CABLE MODEM NETWORK, LISBON, LISBOA, PT. |
n/a | :proxim.ircgalaxy.pl | 445 | pcap | raw alerts ruleset |
http irc 3 lines |
Yeah : 0.8 profile |
none | summary tarball |
35 of 36 | 8b76719555 NEW |
none[none] | none:none |
none|none | none | none |
| 06:31:00 | WinXP | 92.84.149.114 (APEXCOVANTAGE.COM): EU-ZZ, UK. |
n/a | :proxim.ircgalaxy.pl RU:moscow-advokat.ru HK:210.245.211.11:65520 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
33 of 36 | c3bc53e727 [Firefox: 3 hits: 09-14 to 09-22] |
none[none] | none:none |
none|none | none | none |
| T:06:31:00 | WinXP | 92.84.149.114 (APEXCOVANTAGE.COM): EU-ZZ, UK. |
210.245.211.11:65520 | :proxim.ircgalaxy.pl RU:moscow-advokat.ru DE:dl2.teenpassage.com RU:194.6.222.11:6667 |
445 | pcap | raw alerts ruleset |
http irc 7 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 36 | c3bc53e727 [Firefox: 3 hits: 09-14 to 09-22] |
none[none] | none:none |
none|none | none | none |
| T:06:36:00 | WinXP | 24.109.32.76 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, WINNIPEG, MANITOBA, CA. (DSL) |
n/a | :proxim.ircgalaxy.pl RU:moscow-advokat.ru SE:vancouver.dal.net RU:194.6.222.11:6667 HK:210.245.211.11:65520 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | 335cd761e7 NEW |
none[none] | none:none |
none|none | none | none |
| 06:47:00 | WinXP | 200.164.117.237 (STERLINGSTUDENTS.NET): COMITE GESTOR DA INTERNET NO BRASIL, BR. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 36 | 49d6cdaab4 [Firefox: 4 hits: 09-13 to 09-23] |
none[none] | none:none |
none|none | none | none | |
| 06:59:00 | WinXP | 61.124.119.204 (INFOWEB.NE.JP): INFOWEB(FUJITSU LTD.), TOKYO, TOKYO, JP. (DIAL) |
n/a | 445 | pcap | raw alerts ruleset |
ftp 12 lines |
Yeah : 0.8 profile |
none | summary tarball |
31 of 32 | 741e3b03b3 [Firefox:399 hits: 01-05 to 09-24] |
e0197e8a64 [0] | ASM:Graph |
none|none | lines=62 | trace | |
| 06:59:00 | WinXP | 122.17.47.243 (OCN.NE.JP): OPEN COMPUTER NETWORK, JP. |
n/a | 445 | pcap | raw alerts ruleset |
ftp 12 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 831f4ee0a7 [Firefox:559 hits: 01-01 to 09-24] |
eb7546c600 [0] | ASM:Graph |
none|none | lines=61 | trace | |
| 07:09:00 | WinXP | 4.237.44.64 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, NEW YORK, NEW YORK, US. (DIAL) |
n/a | US:microsoft.com US:download.microsoft.com |
135 | pcap | raw alerts ruleset |
http 117 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] |
none[4] 73f1082158[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| 07:12:00 | WinXP | 82.61.128.7 (RETAIL.TELECOMITALIA.IT): TELECOM ITALIA NET, PESCARA, ABRUZZI, IT. |
n/a | :proxim.ircgalaxy.pl UA:citi-bank.ru UA:194.54.90.246:80 HK:210.245.211.11:65520 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
35 of 36 | d67052824c [Firefox: 2 hits: 09-21 to 09-21] |
none[none] | none:none |
none|none | none | none |
| T:07:15:00 | WinXP | 84.217.235.45 (GLOCALNET.NET): GLOCALNET-SE-NET, STOCKHOLM, STOCKHOLM, SE. |
n/a | RU:moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
35 of 35 | b9e6a0c882 [Firefox: 5 hits: 09-12 to 09-23] |
none[none] | none:none |
none|none | none | none |
| 07:26:00 | WinXP | 66.188.66.218 (CHARTER.COM): CHARTER COMMUNICATIONS, ATHENS, GEORGIA, US. |
n/a | :proxim.ircgalaxy.pl US:microsoft.com US:download.microsoft.com US:192.221.110.125:80 US:204.160.126.124:80 US:205.128.73.126:80 HK:210.245.211.11:65520 |
135 | pcap | raw alerts ruleset |
other 205 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 33 29 of 33 |
7ba9e53288 [Firefox: 5 hits: 07-11 to 09-21] d2e7fab9c3 [Firefox: 5 hits: 07-11 to 09-21] |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| 07:38:00 | Win2K-f | 124.241.142.155 (STARCAT.NE.JP): KMN CORPORATION, NAGOYA, AICHI, JP. |
n/a | US:microsoft.com US:download.microsoft.com US:199.93.44.126:80 |
135 | pcap | raw alerts ruleset |
other 78 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 33 9 of 33 |
2851817490 [Firefox: 6 hits: 06-27 to 09-14] 624c441842 [Firefox: 3 hits: 06-27 to 08-24] |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| 07:49:00 | WinXP | 82.250.202.246 (PROXAD.NET): PROXAD / FREE SAS, NANTES, PAYS DE LA LOIRE, FR. (DSL) |
n/a | DE:siliconfireware.ru US:searchportal.information.com DE:ebookfinaltrash.ru :wpad US:208.73.210.32:80 |
445 | pcap | raw alerts ruleset |
http http http 3 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef [Firefox:532 hits: 01-01 to 09-24] |
40f7f463c4 [0] | ASM:Graph |
ASPack| | lines=281 embedded dns |
trace |
| T:08:12:00 | Win2K-f | 24.82.122.90 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, NORTH VANCOUVER, BRITISH COLUMBIA, CA. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.148.54:80 |
135 | pcap | raw alerts ruleset |
other 124 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 36 33 of 36 |
28ce5fc467 NEW e7335cb667 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:08:13:00 | WinXP | 203.67.1.173 (SEED.NET.TW): DIGITAL UNITED INC, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
31 of 32 | ea096a2bdf [Firefox:16 hits: 07-12 to 09-24] |
none[none] | none:none |
none|none | none | none |
| 08:15:00 | WinXP | 130.13.43.22 (QWEST.NET): QWEST BROADBAND SERVICES INC, PHOENIX, ARIZONA, US. |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 16 lines |
Yeah : 1.3 profile |
none | summary tarball |
29 of 29 | 1a2c0e6130 [Firefox:423 hits: 12-31 to 09-24] |
048df78048 [0] | ASM:Graph |
none|none | lines=61 | trace | |
| 08:24:00 | WinXP | 190.225.187.167 (-): . |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
36 of 36 | cc263a661d NEW |
none[none] | none:none |
none|none | none | none |
| T:08:24:00 | WinXP | 190.225.187.167 (-): . |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
36 of 36 | cc263a661d NEW |
none[none] | none:none |
none|none | none | none |
| T:08:26:00 | WinXP | 62.11.40.238 (DIALUP.TISCALI.IT): TISCALI ITALIA SPA, IT. (DIAL) |
n/a | EU:siliconfireware.ru GB:new.egg.com :wpad US:searchportal.information.com US:208.73.210.32:80 DE:212.227.111.29:80 DE:217.11.54.126:80 EU:78.47.200.154:80 |
445 | pcap | raw alerts ruleset |
http http http 25 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef [Firefox:532 hits: 01-01 to 09-24] |
40f7f463c4 [0] | ASM:Graph |
ASPack| | lines=281 embedded dns |
trace |
| 09:16:00 | WinXP | 67.150.168.250 (MDSG-PACWEST.COM): PAC-WEST MANAGED MODEM NAS POOL, LOS ANGELES, CALIFORNIA, US. |
n/a | UA:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 986b59708d [Firefox:83 hits: 01-14 to 09-24] |
8a00217866 [0] | ASM:Graph |
PolyEnE| | lines=57 | trace |
| T:09:16:00 | WinXP | 67.150.168.250 (MDSG-PACWEST.COM): PAC-WEST MANAGED MODEM NAS POOL, LOS ANGELES, CALIFORNIA, US. |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 986b59708d [Firefox:83 hits: 01-14 to 09-24] |
8a00217866 [0] | ASM:Graph |
PolyEnE| | lines=57 | trace |
| T:09:35:00 | WinXP | 208.61.169.81 (BELLSOUTH.NET): BELLSOUTH.NET INC, NASHVILLE, TENNESSEE, US. (DSL) |
n/a | RU:moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
25 of 25 | 7f60162c2c [Firefox:622 hits: 12-31 to 09-24] |
1aad8e4632 [0] | ASM:Graph |
PolyEnE| | lines=93 embedded dns |
trace |
| 09:49:00 | WinXP | 66.153.132.174 (SCCOAST.NET): HTC - CABLE MODEM POOL, CONWAY, SOUTH CAROLINA, US. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com US:198.78.201.126:80 US:207.123.37.125:80 US:207.123.42.126:80 |
135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] |
none[4] 73f1082158[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| T:09:51:00 | WinXP | 89.123.53.58 (PLATINUMGROUP.RO): ARTELECOM, RO. |
n/a | :proxim.ircgalaxy.pl UA:citi-bank.ru UA:194.54.90.246:80 HK:210.245.211.11:65520 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 36 | a639f0b353 NEW |
none[none] | none:none |
none|none | none | none |
| 10:03:00 | Win2K-f | 98.175.153.16 (-): . |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.173.47:80 |
135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] |
none[4] 73f1082158[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| T:10:13:00 | Win2K-f | 66.88.98.162 (XO.NET): XO COMMUNICATIONS, HOLLYWOOD, FLORIDA, US. |
n/a | US:microsoft.com US:download.microsoft.com |
135 | pcap | raw alerts ruleset |
http 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] |
none[4] 73f1082158[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| T:10:17:00 | WinXP | 4.88.30.40 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, COLUMBIA, SOUTH CAROLINA, US. (DIAL) |
n/a | DE:siliconfireware.ru US:searchportal.information.com :wpad US:208.73.210.32:80 |
445 | pcap | raw alerts ruleset |
http http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | df17a625ee [Firefox:250 hits: 01-01 to 09-24] |
9bbdd086c5 [0] | ASM:Graph |
ASPack| | lines=186 embedded dns |
trace |
| T:10:25:00 | WinXP | 213.22.71.208 (CPE.NETCABO.PT): TVCABO-PORTUGAL CABLE MODEM NETWORK, LISBON, LISBOA, PT. |
n/a | :proxim.ircgalaxy.pl RU:moscow-advokat.ru HK:210.245.211.11:65520 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
31 of 32 | 22999be88c [Firefox:21 hits: 04-05 to 09-22] |
eda2056971 [0] | ASM:Graph |
PolyEnE| | lines=154 embedded dns |
trace |
| 10:28:00 | WinXP | 4.88.30.40 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, COLUMBIA, SOUTH CAROLINA, US. (DIAL) |
n/a | DE:siliconfireware.ru US:searchportal.information.com :wpad US:208.73.210.32:80 |
445 | pcap | raw alerts ruleset |
http http http 3 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | df17a625ee [Firefox:250 hits: 01-01 to 09-24] |
9bbdd086c5 [0] | ASM:Graph |
ASPack| | lines=186 embedded dns |
trace |
| T:10:37:00 | WinXP | 88.162.158.207 (PROXAD.NET): PROXAD / FREE SAS, FR. |
n/a | RU:moscow-advokat.ru RU:194.6.222.11:6667 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
35 of 36 | 15ee4e7627 NEW |
none[none] | none:none |
none|none | none | none |
| T:10:45:00 | WinXP | 85.87.82.70 (CLIENTES.EUSKALTEL.ES): EUSKALTEL, ES. |
n/a | :proxim.ircgalaxy.pl UA:citi-bank.ru |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
35 of 36 | 5ab10310c8 NEW |
none[none] | none:none |
none|none | none | none |
| 10:49:00 | WinXP | 83.132.0.96 (CPE.NETCABO.PT): TVCABO-PORTUGAL CABLE MODEM NETWORK, LISBON, LISBOA, PT. |
n/a | :proxim.ircgalaxy.pl HK:210.245.211.11:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
35 of 36 | 8b76719555 NEW |
none[none] | none:none |
none|none | none | none |
| T:10:49:00 | WinXP | 83.132.0.96 (CPE.NETCABO.PT): TVCABO-PORTUGAL CABLE MODEM NETWORK, LISBON, LISBOA, PT. |
n/a | :proxim.ircgalaxy.pl UA:citi-bank.ru UA:194.54.90.246:80 HK:210.245.211.11:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
35 of 36 | 8b76719555 NEW |
none[none] | none:none |
none|none | none | none |
| 11:15:00 | WinXP | 124.241.185.234 (STARCAT.NE.JP): KMN CORPORATION, NAGOYA, AICHI, JP. |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.173.53:80 US:69.28.178.10:80 |
135 | pcap | raw alerts ruleset |
other 59 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 8 of 33 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] b7082104e4 [Firefox:148 hits: 06-18 to 09-24] |
none[4] none [4] |
none:none none:none |
tElock| tElock| |
none none |
trace trace |
| T:11:18:00 | WinXP | 195.174.18.106 (KABLONET.COM.TR): CABLE OPERATOR NETWORK OF TURK TELEKOM, ISTANBUL, ISTANBUL, TR. (DSL) |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 36 | 49d6cdaab4 [Firefox: 4 hits: 09-13 to 09-23] |
none[none] | none:none |
none|none | none | none |
| 11:23:00 | Win2K-f | 172.167.136.73 (AOL.COM): AMERICA ONLINE, RESTON, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.153.236:80 US:208.111.173.16:80 |
135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 36 29 of 33 |
0474b4b09f NEW 1c3210698a [Firefox: 2 hits: 07-13 to 09-24] |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:11:31:00 | WinXP | 24.238.16.200 (SPEAKEASY.NET): PENNSYLVANIA, US. |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.173.16:80 US:208.111.173.41:80 |
135 | pcap | raw alerts ruleset |
other 113 lines |
Yeah : 1.3 profile |
none | summary tarball |
35 of 36 28 of 36 |
57724f341d NEW 81bc4d7149 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| 11:34:00 | WinXP | 93.184.229.184 (APEXCOVANTAGE.COM): EU-ZZ, UK. |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 [Firefox:1153 hits: 12-31 to 09-24] |
7a70e1b592 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:11:41:00 | WinXP | 84.217.235.45 (GLOCALNET.NET): GLOCALNET-SE-NET, STOCKHOLM, STOCKHOLM, SE. |
n/a | RU:moscow-advokat.ru AT:graz.at.eu.undernet.org SE:ced.dal.net |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 1.3 profile |
none | summary tarball |
35 of 35 | b9e6a0c882 [Firefox: 5 hits: 09-12 to 09-23] |
none[none] | none:none |
none|none | none | none |
| T:11:41:00 | Win2K-f | 75.79.45.211 (-): . |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.153.236:80 US:208.111.173.16:80 |
135 | pcap | raw alerts ruleset |
other 79 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] a08f3b74a4 [Firefox:861 hits: 06-18 to 09-24] |
none[4] a08f3b74a4[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| T:11:43:00 | WinXP | 200.117.93.215 (NET.AR): APOLO -GOLD-TELECOM-PER, AR. |
n/a | :proxim.ircgalaxy.pl UA:citi-bank.ru UA:194.54.90.246:80 HK:210.245.211.11:65520 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
35 of 36 | 516f7aaac5 [Firefox: 6 hits: 09-19 to 09-21] |
none[none] | none:none |
none|none | none | none |
| T:12:12:00 | Win2K-f | 24.80.34.140 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, LANGLEY, BRITISH COLUMBIA, CA. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.173.46:80 US:208.111.173.47:80 |
135 | pcap | raw alerts ruleset |
other 123 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 36 33 of 36 |
28ce5fc467 NEW e7335cb667 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:12:14:00 | WinXP | 66.65.198.3 (RR.COM): ROAD RUNNER HOLDCO LLC, CLIFTON PARK, NEW YORK, US. |
n/a | EU:siliconfireware.ru US:searchportal.information.com :wpad :www.proxy-socks.net US:208.73.210.32:80 DE:212.227.111.29:80 EU:78.47.200.154:80 |
445 | pcap | raw alerts ruleset |
http http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | df17a625ee [Firefox:250 hits: 01-01 to 09-24] |
9bbdd086c5 [0] | ASM:Graph |
ASPack| | lines=186 embedded dns |
trace |
| 12:49:00 | WinXP | 75.180.36.29 (RR.COM): ROAD RUNNER HOLDCO LLC, DUBLIN, OHIO, US. |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 3ae357d17b [Firefox:176 hits: 01-01 to 09-24] |
462a7be171 [0] | ASM:Graph |
PolyEnE| | lines=73 | trace |
| 12:51:00 | Win2K-f | 71.115.183.61 (VERIZON.NET): VERIZON INTERNET SERVICES INC, DENTON, TEXAS, US. (100Mbps) |
n/a | US:microsoft.com US:download.microsoft.com US:198.78.201.126:80 US:207.123.37.124:80 US:207.123.46.126:80 |
135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] a08f3b74a4 [Firefox:861 hits: 06-18 to 09-24] |
none[4] a08f3b74a4[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| T:13:00:00 | WinXP | 79.26.64.14 (SRC.ORG): TELECOM ITALIA NET, ROME, LAZIO, IT. |
115.126.2.121:65520 | :proxim.ircgalaxy.pl DE:dl2.teenpassage.com 115.126.2.121:65520 DE:85.114.141.207:80 |
445 | pcap | raw alerts ruleset |
http irc 20 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 36 | 96dd1ffa53 NEW |
none[none] | none:none |
none|none | none | none |
| T:13:02:00 | Win2K-f | 68.180.117.38 (-): SAVANNAH AT PARK PLACE, ATLANTA, GEORGIA, US. |
n/a | US:microsoft.com US:download.microsoft.com US:207.123.37.124:80 US:207.123.37.125:80 US:4.23.60.126:80 |
135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] a08f3b74a4 [Firefox:861 hits: 06-18 to 09-24] |
none[4] a08f3b74a4[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| T:13:13:00 | Win2K-f | 124.61.38.40 (-): POWERCOM, KR. |
n/a | US:microsoft.com :proxim.ircgalaxy.pl US:download.microsoft.com 115.126.2.121:65520 US:208.111.153.236:80 US:208.111.173.16:80 |
135 | pcap | raw alerts ruleset |
other 124 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 36 34 of 36 |
09c3d90250 [Firefox: 8 hits: 08-04 to 09-24] 8f34a39070 [Firefox: 8 hits: 08-04 to 09-24] |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:13:25:00 | WinXP | 190.225.192.238 (-): . |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 1.3 profile |
none | summary tarball |
36 of 36 | cc263a661d NEW |
none[none] | none:none |
none|none | none | none |
| T:13:29:00 | Win2K-f | 87.18.252.151 (RETAIL.TELECOMITALIA.IT): TELECOM ITALIA S.P.A. TIN EASY LITE, IT. |
115.126.2.121:65520 | DE:dl2.teenpassage.com :proxim.ircgalaxy.pl DE:85.114.141.207:80 |
445 | pcap | raw alerts ruleset |
irc 18 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:13:38:00 | WinXP | 66.188.66.218 (CHARTER.COM): CHARTER COMMUNICATIONS, ATHENS, GEORGIA, US. |
115.126.2.121:65520 | :proxim.ircgalaxy.pl US:microsoft.com US:download.microsoft.com DE:dl2.teenpassage.com US:192.221.99.124:80 US:204.160.104.126:80 US:204.160.126.126:80 DE:85.114.141.207:80 |
135 | pcap | raw alerts ruleset |
irc 228 lines |
Yeah : 1.8 profile |
none | summary tarball |
31 of 33 29 of 33 |
7ba9e53288 [Firefox: 5 hits: 07-11 to 09-21] d2e7fab9c3 [Firefox: 5 hits: 07-11 to 09-21] |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| 13:38:00 | Win2K-f | 87.248.165.113 (87-248-162-10.STARNET.MD): SC STARNET SRL, CHISINAU, CHISINAU, MD. (DSL) |
n/a | US:www.yahoo.com :jbeegvia.ru SE:www.kavkazcenter.com US:www.worldbank.org 190.188.36.17:42 US:192.86.99.140:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
31 of 32 | 17028f1eda [Firefox:35 hits: 04-18 to 09-22] |
none[3] | none:none |
tElock| | none | trace |
| T:13:48:00 | WinXP | 122.146.241.120 (SPARQNET.NET): NEW CENTURY INFOCOMM TECH. CO. LTD, TAIPEI, T'AI-PEI, TW. |
n/a | US:microsoft.com US:download.microsoft.com US:192.221.108.126:80 US:204.160.126.126:80 US:8.12.222.126:80 |
135 | pcap | raw alerts ruleset |
other 382 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 33 30 of 35 |
3db2c812c0 [Firefox: 4 hits: 07-23 to 09-17] 797fdec34a [Firefox: 4 hits: 07-23 to 09-17] |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| 13:49:00 | WinXP | 66.61.139.2 (RR.COM): ROAD RUNNER HOLDCO LLC, COLUMBUS, OHIO, US. |
n/a | DE:siliconfireware.ru US:searchportal.information.com :www.proxy-socks.net :wpad US:208.73.210.32:80 EU:78.47.200.154:80 |
445 | pcap | raw alerts ruleset |
http http http 3 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef [Firefox:532 hits: 01-01 to 09-24] |
40f7f463c4 [0] | ASM:Graph |
ASPack| | lines=281 embedded dns |
trace |
| T:13:56:00 | WinXP | 78.82.208.18 (TELENOR.SE): TELENOR BUSINESS SOLUTION AB, SE. |
n/a | US:www.altavista.com :jbeegvia.ru |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
31 of 32 | 17028f1eda [Firefox:35 hits: 04-18 to 09-22] |
none[3] | none:none |
tElock| | none | trace |
| 14:04:00 | WinXP | 98.24.51.223 (-): . |
n/a | DE:siliconfireware.ru US:searchportal.information.com :wpad GB:new.egg.com US:208.73.210.32:80 DE:217.11.54.126:80 EU:78.47.200.154:80 |
445 | pcap | raw alerts ruleset |
http http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | df17a625ee [Firefox:250 hits: 01-01 to 09-24] |
9bbdd086c5 [0] | ASM:Graph |
ASPack| | lines=186 embedded dns |
trace |
| 14:05:00 | Win2K-f | 66.61.16.150 (RR.COM): ROAD RUNNER HOLDCO LLC, ALEXANDRIA, VIRGINIA, US. |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.173.41:80 US:208.111.173.42:80 |
135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] |
none[4] 73f1082158[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| 14:06:00 | WinXP | 67.213.13.122 (-): . |
n/a | 135 | pcap | raw alerts ruleset |
other 1008 lines |
Yeah : 1.3 profile |
none | summary tarball |
11 of 36 | c7428c259b NEW |
none[none] | none:none |
none|none | none | none | |
| T:14:09:00 | WinXP | 89.34.218.160 (-): SC-DIGITAL-CATV-SRL, BUZAU, BUZAU, RO. |
115.126.2.121:65520 | :proxim.ircgalaxy.pl | 445 | pcap | raw alerts ruleset |
http irc 3 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 36 | 5ed9c4adac NEW |
none[none] | none:none |
none|none | none | none |
| 14:26:00 | Win2K-f | 172.131.1.111 (AOL.COM): AMERICA ONLINE, RESTON, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com US:198.78.201.126:80 |
135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
30 of 33 29 of 33 |
3373948767 [Firefox:25 hits: 07-03 to 09-20] c73f738c30 [Firefox:25 hits: 07-03 to 09-20] |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:14:32:00 | Win2K-f | 70.65.155.105 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, LETHBRIDGE, ALBERTA, CA. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 131 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 | 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] |
73f1082158 [1] | ASM:Graph |
Armadillo| | lines=81 | trace | |
| 14:40:00 | WinXP | 92.17.60.121 (-): CARPHONE WAREHOUSE BROADBAND SERVICES, UK. |
n/a | :proxim.ircgalaxy.pl :fleshkatera.cn :lolika.cn 115.126.2.110:80 |
445 | pcap | raw alerts ruleset |
shell ftp irc http 28 lines |
Yeah : 1.3 profile |
none | summary tarball |
15 of 36 35 of 36 |
91dc355a93 NEW b632266bbd NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:14:50:00 | WinXP | 65.124.58.69 (QWEST.NET): OREGON TELECOM INC, APACHE JUNCTION, ARIZONA, US. |
n/a | RU:moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
25 of 25 | 7f60162c2c [Firefox:622 hits: 12-31 to 09-24] |
1aad8e4632 [0] | ASM:Graph |
PolyEnE| | lines=93 embedded dns |
trace |
| T:15:01:00 | WinXP | 157.161.55.207 (INTERGGA.CH): IMPROWARE AG, BASEL, BASEL-STADT, CH. (DSL) |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
36 of 36 | b872c76081 [Firefox:18 hits: 09-13 to 09-24] |
none[none] | none:none |
none|none | none | none |
| T:15:04:00 | WinXP | 190.128.9.88 (-): EMPRESA DE TELECOMUNICACIONES DE PEREIRA S.A. E.S.P, MANIZALES, CALDAS, CO. |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| 15:09:00 | WinXP | 91.36.97.193 (T-IPCONNECT.DE): DEUTSCHE TELEKOM AG, DE. (DIAL) |
n/a | EU:siliconfireware.ru US:searchportal.information.com SE:kavkazcenter.com SE:kavkazcenter.net FI:kavkazchat.com US:chechenpress.info GB:chechenpress.co.uk US:shaheeds.org US:daymohk.info :chripress.org :marsho.dk US:www.jamaatshariat.com US:www.counterdata.com DE:m1.webstats.motigo.com FI:static.kavkazchat.com FI:imgs2.kavkazcenter.com :www.google.com HK:yahoo-analytics.net :pinoc.org HK:google-analyze.org GB:www.chechenpress.co.uk US:www.google-analytics.com US:video.google.com :www.islamicfinder.org US:www.youtube.com US:208.73.210.32:80 |
445 | pcap | raw alerts ruleset |
http http 309 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | ab5e47bf8d [Firefox:40 hits: 01-02 to 09-23] |
none[3] | none:none |
ASPack| | none | trace |
| 15:28:00 | WinXP | 12.73.240.255 (ATT.NET): AT&T WORLDNET SERVICES, CHICAGO, ILLINOIS, US. (DIAL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 16 lines |
Yeah : 1.3 profile |
none | summary tarball |
29 of 29 | 1a2c0e6130 [Firefox:423 hits: 12-31 to 09-24] |
048df78048 [0] | ASM:Graph |
none|none | lines=61 | trace | |
| 15:39:00 | WinXP | 66.60.220.238 (NEWULMTEL.NET): NEW ULM TELECOM INC, NEW ULM, MINNESOTA, US. |
115.126.2.121:65520 | :proxim.ircgalaxy.pl US:microsoft.com US:download.microsoft.com :fleshkatera.cn :lolika.cn :www.upononjob.cn :reservjob.cn US:windowsupdate.microsoft.com US:a-vxp08.net :mulfika.cn US:stat.a-vxp08.net |
135 | pcap | raw alerts ruleset |
irc http http http http http http http 177 lines |
Yeah : 1.8 profile |
none | summary tarball |
34 of 35 32 of 36 15 of 36 12 of 36 0 of 33 |
86176b6a8e NEW 8a7d6cc74f NEW 91dc355a93 NEW ac0e6165e5 NEW e07c29c4ae [Firefox:496 hits: 06-19 to 09-24] |
none[none] none [none] none [none] none [none] e07c29c4ae[1] |
none:none none:none none:none none:none ASM:Graph |
none|none none|none none|none none|none FSG| |
none none none none lines=92 |
none none none none trace |
| 15:40:00 | WinXP | 12.77.254.222 (ATT.NET): AT&T WORLDNET SERVICES, HOLLYWOOD, FLORIDA, US. (DIAL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 0.8 profile |
none | summary tarball |
27 of 36 | 4de1b987a6 NEW |
none[none] | none:none |
none|none | none | none | |
| 15:43:00 | Win2K-f | 71.148.35.35 (SBCGLOBAL.NET): KASSA KASSA, PLANO, TEXAS, US. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com US:207.123.37.125:80 |
135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] a08f3b74a4 [Firefox:861 hits: 06-18 to 09-24] |
none[4] a08f3b74a4[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| T:15:49:00 | WinXP | 66.60.220.238 (NEWULMTEL.NET): NEW ULM TELECOM INC, NEW ULM, MINNESOTA, US. |
115.126.2.121:65520 | :proxim.ircgalaxy.pl US:microsoft.com US:download.microsoft.com :fleshkatera.cn :lolika.cn :www.upononjob.cn :reservjob.cn :mulfika.cn US:windowsupdate.microsoft.com US:a-vxp08.net US:stat.a-vxp08.net 200.63.45.19:80 |
135 | pcap | raw alerts ruleset |
irc http http http 147 lines |
Yeah : 1.8 profile |
none | summary tarball |
12 of 36 34 of 35 32 of 36 15 of 36 |
35c717e9d0 NEW 86176b6a8e NEW 8a7d6cc74f NEW 91dc355a93 NEW |
none[none] none [none] none [none] none [none] |
none:none none:none none:none none:none |
none|none none|none none|none none|none |
none none none none |
none none none none |
| T:16:04:00 | Win2K-f | 70.247.224.169 (SWBELL.NET): JORGE RICHARDO GARCIA , DALLAS, TEXAS, US. (100Mbps) |
n/a | US:microsoft.com US:download.microsoft.com US:205.128.66.126:80 |
135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] a08f3b74a4 [Firefox:861 hits: 06-18 to 09-24] |
none[4] a08f3b74a4[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| T:16:38:00 | WinXP | 76.187.185.41 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. (100Mbps) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 13 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 1a2c0e6130 [Firefox:423 hits: 12-31 to 09-24] |
048df78048 [0] | ASM:Graph |
none|none | lines=61 | trace | |
| 16:43:00 | Win2K-f | 24.85.95.50 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, VANCOUVER, BRITISH COLUMBIA, CA. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com US:207.123.37.125:80 |
135 | pcap | raw alerts ruleset |
http 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] a08f3b74a4 [Firefox:861 hits: 06-18 to 09-24] b5919931fe [Firefox:649 hits: 06-20 to 09-24] |
none[4] a08f3b74a4[1] b5919931fe[1] |
none:none ASM:Graph ASM:Graph |
tElock| Armadillo| ASProtect| |
none lines=81 lines=90 |
trace trace trace |
| T:16:52:00 | WinXP | 170.51.89.152 (COM.AR): CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A, AR. |
n/a | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| 16:55:00 | WinXP | 74.62.103.126 (RR.COM): ROAD RUNNER HOLDCO LLC, APPLETON, WISCONSIN, US. |
n/a | RU:moscow-advokat.ru SE:ced.dal.net :brussels.be.eu.undernet.org :los-angeles.ca.us.undernet.org :washington.dc.us.undernet.org :caen.fr.eu.undernet.org :lulea.se.eu.undernet.org SE:viking.dal.net SE:broadway.ny.us.dal.net SE:ozbytes.dal.net :flanders.be.eu.undernet.org AT:graz.at.eu.undernet.org |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 1.3 profile |
none | summary tarball |
35 of 36 | 1c544ae06d NEW |
none[none] | none:none |
none|none | none | none |
| T:16:55:00 | WinXP | 74.62.103.126 (RR.COM): ROAD RUNNER HOLDCO LLC, APPLETON, WISCONSIN, US. |
n/a | RU:moscow-advokat.ru AT:graz.at.eu.undernet.org NL:diemen.nl.eu.undernet.org US:lia.zanet.net SE:ced.dal.net SE:broadway.ny.us.dal.net SE:coins.dal.net RU:194.6.222.11:6667 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
35 of 36 | 1c544ae06d NEW |
none[none] | none:none |
none|none | none | none |
| 17:03:00 | WinXP | 122.30.145.46 (OCN.NE.JP): OPEN COMPUTER NETWORK, JP. |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 13 lines |
Yeah : 1.3 profile |
none | summary tarball |
29 of 29 | 831f4ee0a7 [Firefox:559 hits: 01-01 to 09-24] |
eb7546c600 [0] | ASM:Graph |
none|none | lines=61 | trace | |
| 17:18:00 | WinXP | 70.182.91.221 (COX.NET): COX COMMUNICATIONS, OKLAHOMA CITY, OKLAHOMA, US. |
115.126.2.121:65520 | US:microsoft.com US:download.microsoft.com :proxim.ircgalaxy.pl :fleshkatera.cn :lolika.cn :www.upononjob.cn :reservjob.cn :mulfika.cn US:windowsupdate.microsoft.com US:a-vxp08.net US:stat.a-vxp08.net US:199.93.53.125:80 US:204.160.104.126:80 |
135 | pcap | raw alerts ruleset |
http irc 136 lines |
Yeah : 1.8 profile |
none | summary tarball |
33 of 33 15 of 36 32 of 36 0 of 33 12 of 36 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 91dc355a93 NEW bea8cb1865 [Firefox:15 hits: 08-11 to 09-23] e07c29c4ae [Firefox:496 hits: 06-19 to 09-24] e3d3a5754d NEW |
none[4] none [none] none [none] e07c29c4ae[1] none [none] |
none:none none:none none:none ASM:Graph none:none |
tElock| none|none none|none FSG| none|none |
none none none lines=92 none |
trace none none trace none |
| 17:20:00 | WinXP | 88.172.253.207 (PROXAD.NET): PROXAD / FREE SAS, FR. |
115.126.2.121:65520 | :proxim.ircgalaxy.pl RU:moscow-advokat.ru RU:194.6.222.11:6667 |
445 | pcap | raw alerts ruleset |
http irc 3 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 36 | c6059fcbd5 NEW |
none[none] | none:none |
none|none | none | none |
| 17:24:00 | Win2K-f | 68.127.240.214 (PACBELL.NET): PPPOX POOL - RBACK4.IRVNCA, LOS ANGELES, CALIFORNIA, US. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com US:204.160.126.124:80 |
135 | pcap | raw alerts ruleset |
http 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] a08f3b74a4 [Firefox:861 hits: 06-18 to 09-24] b5919931fe [Firefox:649 hits: 06-20 to 09-24] |
none[4] a08f3b74a4[1] b5919931fe[1] |
none:none ASM:Graph ASM:Graph |
tElock| Armadillo| ASProtect| |
none lines=81 lines=90 |
trace trace trace |
| T:17:28:00 | WinXP | 66.19.151.144 (POPSITE.NET): USLEC CORP, CHARLOTTE, NORTH CAROLINA, US. (DIAL) |
n/a | RU:moscow-advokat.ru RU:194.6.222.11:6667 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
25 of 25 | 7f60162c2c [Firefox:622 hits: 12-31 to 09-24] |
1aad8e4632 [0] | ASM:Graph |
PolyEnE| | lines=93 embedded dns |
trace |
| 17:39:00 | Win2K-f | 75.15.167.103 (SBCGLOBAL.NET): PPPOX POOL - RBACK5.KSC2MO, KANSAS CITY, MISSOURI, US. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com |
135 | pcap | raw alerts ruleset |
http 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] |
none[4] 73f1082158[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| 17:42:00 | WinXP | 70.60.98.102 (RR.COM): ROAD RUNNER HOLDCO LLC, CHAPIN, SOUTH CAROLINA, US. |
n/a | 135 | pcap | raw alerts ruleset |
other 673 lines |
Yeah : 1.3 profile |
none | summary tarball |
10 of 36 | 6de4e92186 [Firefox: 3 hits: 09-24 to 09-24] |
none[none] | none:none |
none|none | none | none | |
| 17:54:00 | Win2K-f | 118.218.115.190 (-): . |
115.126.2.121:65520 | :proxima.ircgalaxy.pl US:microsoft.com US:download.microsoft.com :fleshkatera.cn :lolika.cn :www.upononjob.cn :reservjob.cn :mulfika.cn US:192.221.110.125:80 |
135 | pcap | raw alerts ruleset |
irc http 618 lines |
Yeah : 1.8 profile |
none | summary tarball |
31 of 33 31 of 33 15 of 36 11 of 36 0 of 36 0 of 36 12 of 36 |
168aab35a3 [Firefox:138 hits: 06-17 to 09-24] 667f0c59f3 [Firefox:24 hits: 07-04 to 09-20] 91dc355a93 NEW b807e46328 NEW cc2f861b1c NEW d9ac68f184 NEW f3cef1936d NEW |
none[4] none [none] none [none] none [none] none [none] none [none] none [none] |
none:none none:none none:none none:none none:none none:none none:none |
tElock| none|none none|none none|none none|none none|none none|none |
none none none none none none none |
trace none none none none none none |
| T:18:17:00 | WinXP | 75.191.171.112 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. |
n/a | UA:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 [Firefox:1153 hits: 12-31 to 09-24] |
7a70e1b592 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:18:32:00 | WinXP | 98.174.0.4 (-): . |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.173.52:80 |
135 | pcap | raw alerts ruleset |
http 77 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 0 of 33 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] e07c29c4ae [Firefox:496 hits: 06-19 to 09-24] |
none[4] 73f1082158[1] e07c29c4ae[1] |
none:none ASM:Graph ASM:Graph |
tElock| Armadillo| FSG| |
none lines=81 lines=92 |
trace trace trace |
| 18:35:00 | Win2K-f | 75.143.200.220 (CHARTER.COM): CHARTER COMMUNICATIONS, US. |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.173.47:80 US:208.111.173.52:80 |
135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
30 of 35 33 of 36 |
18369c36f5 [Firefox: 2 hits: 09-24 to 09-24] e1cf89c22d [Firefox: 2 hits: 09-24 to 09-24] |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| 18:42:00 | WinXP | 210.4.115.80 (-): COMCLARK, ROXAS, CAPIZ, PH. |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
36 of 36 | b872c76081 [Firefox:18 hits: 09-13 to 09-24] |
none[none] | none:none |
none|none | none | none |
| T:18:43:00 | WinXP | 92.40.191.218 (IKBCC.COM): EU-ZZ, UK. |
n/a | :proxim.ircgalaxy.pl 115.126.2.121:80 |
445 | pcap | raw alerts ruleset |
http irc 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
27 of 32 | 9c037c69f6 [Firefox: 4 hits: 04-21 to 09-22] |
none[3] | none:none |
ASPack| | none | trace |
| 18:58:00 | Win2K-f | 76.173.206.224 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. |
n/a | US:microsoft.com US:download.microsoft.com |
135 | pcap | raw alerts ruleset |
http 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] b5919931fe [Firefox:649 hits: 06-20 to 09-24] |
none[4] 73f1082158[1] b5919931fe[1] |
none:none ASM:Graph ASM:Graph |
tElock| Armadillo| ASProtect| |
none lines=81 lines=90 |
trace trace trace |
| T:18:59:00 | WinXP | 81.41.66.235 (RIMA-TDE.NET): TELEFONICA DE ESPANA SAU, ES. |
115.126.2.121:65520 | :proxim.ircgalaxy.pl RU:moscow-advokat.ru :fleshkatera.cn |
445 | pcap | raw alerts ruleset |
http irc 7 lines |
Yeah : 1.3 profile |
none | summary tarball |
35 of 36 | 83959d63ea [Firefox: 2 hits: 09-15 to 09-18] |
none[none] | none:none |
none|none | none | none |
| T:19:00:00 | WinXP | 70.62.226.28 (RR.COM): ROAD RUNNER HOLDCO LLC, FAIRFIELD, OHIO, US. |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.148.15:80 US:69.28.178.10:80 |
135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 33 of 33 |
73f1082158 [Firefox:1210 hits: 06-18 to 09-24] 79c01ec060 [Firefox:41 hits: 06-18 to 09-23] |
73f1082158 [1] none [4] |
ASM:Graph none:none |
Armadillo| tElock| |
lines=81 none |
trace trace |
| 19:01:00 | WinXP | 190.208.69.215 (-): . |
115.126.2.121:65520 | :proxim.ircgalaxy.pl UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http irc 3 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 36 | 2d815d2be3 NEW |
none[none] | none:none |
none|none | none | none |
| 19:32:00 | WinXP | 209.127.192.92 (-): TELSCAPE COMMUNICATIONS INC, TORONTO, OHIO, US. |
115.126.2.121:65520 | :proxim.ircgalaxy.pl :fleshkatera.cn US:microsoft.com US:download.microsoft.com 115.126.2.110:80 US:208.111.148.54:80 US:208.111.148.69:80 |
135 | pcap | raw alerts ruleset |
irc 132 lines |
Yeah : 1.8 profile |
none | summary tarball |
34 of 36 32 of 36 |
a8c074e136 NEW fc22cbd605 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| 19:54:00 | Win2K-f | 209.74.8.147 (EPIX.NET): FRONTIER COMMUNICATIONS OF AMERICA INC, MOUNTAIN TOP, PENNSYLVANIA, US. (DIAL) |
115.126.2.121:65520 | :proxim.ircgalaxy.pl US:microsoft.com US:download.microsoft.com :fleshkatera.cn :lolika.cn :www.upononjob.cn :reservjob.cn :mulfika.cn US:208.111.148.219:80 US:208.111.148.226:80 |
135 | pcap | raw alerts ruleset |
irc http 157 lines |
Yeah : 1.8 profile |
none | summary tarball |
12 of 36 15 of 36 28 of 33 31 of 33 0 of 36 |
1486739c36 NEW 91dc355a93 NEW ba4637f8f0 [Firefox:12 hits: 07-01 to 09-20] d02ae67164 [Firefox:12 hits: 07-01 to 09-20] d9ac68f184 NEW |
none[none] none [none] none [none] none [none] none [none] |
none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none |
none none none none none |
none none none none none |
| 19:56:00 | Win2K-f | 66.211.123.50 (SPEAKEASY.NET): US. |
n/a | 135 | pcap | raw alerts ruleset |
other 191 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 13 of 36 |
73f1082158 [Firefox:1210 hits: 06-18 to 09-24] a668cfca54 NEW |
73f1082158 [1] none [none] |
ASM:Graph none:none |
Armadillo| none|none |
lines=81 none |
trace none |
|
| 19:56:00 | WinXP | 4.158.219.42 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, MARSHFIELD, WISCONSIN, US. (DIAL) |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.148.219:80 US:208.111.148.226:80 |
135 | pcap | raw alerts ruleset |
other 128 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] |
none[4] 73f1082158[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| 20:23:00 | WinXP | 219.107.200.226 (MESH.AD.JP): BIGLOBE-CIDR-BLK, JP. |
n/a | 445 | pcap | raw alerts ruleset |
ftp 13 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 831f4ee0a7 [Firefox:559 hits: 01-01 to 09-24] |
eb7546c600 [0] | ASM:Graph |
none|none | lines=61 | trace | |
| 20:32:00 | WinXP | 76.227.80.26 (-): PPPOX POOL - BRAS8.SNDG, US. |
n/a | DE:siliconfireware.ru US:searchportal.information.com US:spi.domainsponsor.com GB:welcome3.smile.co.uk :wpad GB:195.92.84.198:80 |
445 | pcap | raw alerts ruleset |
http http http 17 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef [Firefox:532 hits: 01-01 to 09-24] |
40f7f463c4 [0] | ASM:Graph |
ASPack| | lines=281 embedded dns |
trace |
| 20:39:00 | WinXP | 66.52.226.9 (MDSG-PACWEST.COM): PAC-WEST MANAGED MODEM NAS POOL, SEATTLE, WASHINGTON, US. |
n/a | 445 | pcap | raw alerts ruleset |
ftp 16 lines |
Yeah : 0.8 profile |
none | summary tarball |
31 of 32 | 741e3b03b3 [Firefox:399 hits: 01-05 to 09-24] |
e0197e8a64 [0] | ASM:Graph |
none|none | lines=62 | trace | |
| 20:47:00 | Win2K-f | 89.179.71.69 (CORBINA.RU): INVESTELEKTROSVIAZ LTD, RU. |
115.126.2.121:65520 | :proxim.ircgalaxy.pl :fleshkatera.cn :lolika.cn US:microsoft.com US:download.microsoft.com 115.126.2.110:80 115.126.2.121:65520 US:205.128.73.126:80 92.241.164.155:80 |
445 | pcap | raw alerts ruleset |
irc http 21 lines |
Yeah : 1.3 profile |
none | summary tarball |
11 of 36 15 of 36 |
1e1f8459d6 NEW 91dc355a93 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:21:07:00 | Win2K-f | 67.213.13.122 (-): . |
n/a | 135 | pcap | raw alerts ruleset |
other 1008 lines |
Yeah : 1.3 profile |
none | summary tarball |
11 of 36 | 6dcb69f95a [Firefox: 5 hits: 09-14 to 09-24] |
none[none] | none:none |
none|none | none | none | |
| 21:09:00 | Win2K-f | 24.80.34.140 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, LANGLEY, BRITISH COLUMBIA, CA. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com |
135 | pcap | raw alerts ruleset |
http 127 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 36 33 of 36 |
28ce5fc467 NEW e7335cb667 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| 21:14:00 | Win2K-f | 24.76.71.243 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, BURNABY, BRITISH COLUMBIA, CA. |
115.126.2.121:65520 | US:microsoft.com :proxim.ircgalaxy.pl US:download.microsoft.com :fleshkatera.cn 115.126.2.110:80 US:207.123.42.126:80 |
135 | pcap | raw alerts ruleset |
irc 158 lines |
Yeah : 1.8 profile |
none | summary tarball |
none none |
40870345c3 NEW 6c539a9f23 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:21:17:00 | Win2K-f | 74.219.199.241 (-): . |
n/a | US:microsoft.com US:download.microsoft.com US:207.123.37.126:80 US:207.123.42.126:80 US:207.123.47.126:80 |
135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
35 of 36 0 of 32 |
126a1d4446 [Firefox: 3 hits: 08-19 to 09-18] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] |
none[none] 73f1082158[1] |
none:none ASM:Graph |
none|none Armadillo| |
none lines=81 |
none trace |
| 21:20:00 | Win2K-f | 4.227.2.126 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, CAMERON, TEXAS, US. (DIAL) |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.148.115:80 US:208.111.148.137:80 |
135 | pcap | raw alerts ruleset |
other 93 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 33 of 33 |
07fabc79ef [Firefox:14 hits: 06-19 to 08-15] 53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] |
07fabc79ef [1] none [4] |
ASM:Graph none:none |
Armadillo| tElock| |
lines=81 none |
trace trace |
| 21:21:00 | WinXP | 76.212.161.123 (SBCGLOBAL.NET): PPPOX POOL - BRAS8 SNDGCA, OCEANSIDE, CALIFORNIA, US. (DSL) |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a0139d7ad8 [Firefox:113 hits: 01-03 to 09-24] |
d9e9662db1 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:21:21:00 | WinXP | 76.212.161.123 (SBCGLOBAL.NET): PPPOX POOL - BRAS8 SNDGCA, OCEANSIDE, CALIFORNIA, US. (DSL) |
n/a | UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a0139d7ad8 [Firefox:113 hits: 01-03 to 09-24] |
d9e9662db1 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:21:23:00 | WinXP | 61.59.157.78 (SEED.NET.TW): DIGITAL UNITED INC, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.148.137:80 |
135 | pcap | raw alerts ruleset |
http 112 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 36 32 of 36 0 of 33 |
29da5b359b NEW 677277c61d NEW e07c29c4ae [Firefox:496 hits: 06-19 to 09-24] |
none[none] none [none] e07c29c4ae[1] |
none:none none:none ASM:Graph |
none|none none|none FSG| |
none none lines=92 |
none none trace |
| 21:29:00 | Win2K-f | 165.123.137.126 (UPENN.EDU): UNIVERSITY OF PENNSYLVANIA, PHILADELPHIA, PENNSYLVANIA, US. |
n/a | US:microsoft.com US:download.microsoft.com US:208.111.173.41:80 US:208.111.173.42:80 |
135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] |
none[4] 73f1082158[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |
| T:22:41:00 | WinXP | 82.245.166.103 (PROXAD.NET): PROXAD / FREE SAS, NICE, PROVENCE-ALPES-COTE D'AZUR, FR. |
115.126.2.121:65520 | :proxim.ircgalaxy.pl UA:citi-bank.ru UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http irc 3 lines |
Yeah : 1.3 profile |
none | summary tarball |
35 of 36 | f353d4eed9 [Firefox:16 hits: 09-17 to 09-24] |
none[none] | none:none |
none|none | none | none |
| 22:45:00 | WinXP | 24.165.140.55 (RR.COM): ROAD RUNNER HOLDCO LLC, LORAIN, OHIO, US. |
n/a | DE:siliconfireware.ru US:searchportal.information.com RU:www.bbin.ru RU:www.binbank.ru :wpad US:208.73.210.32:80 EU:78.47.200.154:80 |
445 | pcap | raw alerts ruleset |
http http http http 23 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef [Firefox:532 hits: 01-01 to 09-24] |
40f7f463c4 [0] | ASM:Graph |
ASPack| | lines=281 embedded dns |
trace |
| 22:55:00 | WinXP | 124.155.93.128 (ASAHI-NET.OR.JP): ASAHI-NET-CIDR-BLK, JP. |
n/a | 445 | pcap | raw alerts ruleset |
shell 3 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:23:00:00 | WinXP | 82.61.190.31 (RETAIL.TELECOMITALIA.IT): TELECOM ITALIA NET, IT. |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 32 | 741e3b03b3 [Firefox:399 hits: 01-05 to 09-24] |
e0197e8a64 [0] | ASM:Graph |
none|none | lines=62 | trace | |
| T:23:14:00 | Win2K-f | 4.173.222.117 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, BROOKLYN, NEW YORK, US. (DIAL) |
n/a | US:microsoft.com US:download.microsoft.com US:207.123.37.126:80 |
135 | pcap | raw alerts ruleset |
http 84 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] b5919931fe [Firefox:649 hits: 06-20 to 09-24] |
none[4] 73f1082158[1] b5919931fe[1] |
none:none ASM:Graph ASM:Graph |
tElock| Armadillo| ASProtect| |
none lines=81 lines=90 |
trace trace trace |
| 23:25:00 | WinXP | 61.59.157.78 (SEED.NET.TW): DIGITAL UNITED INC, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com US:download.microsoft.com US:199.93.53.125:80 US:207.123.46.126:80 US:209.84.20.126:80 |
135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 36 32 of 36 |
29da5b359b NEW 677277c61d NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| 23:27:00 | Win2K-f | 24.76.72.73 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, BURNABY, BRITISH COLUMBIA, CA. |
115.126.2.121:65520 | :proxim.ircgalaxy.pl US:microsoft.com US:download.microsoft.com :fleshkatera.cn 115.126.2.110:80 115.126.2.121:65520 US:209.84.20.126:80 |
135 | pcap | raw alerts ruleset |
irc 157 lines |
Yeah : 1.8 profile |
none | summary tarball |
none none |
40870345c3 NEW 6c539a9f23 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| 23:39:00 | WinXP | 151.80.75.131 (38-151.NET24.IT): IUNET-BNET, IT. |
115.126.2.121:65520 | :proxim.ircgalaxy.pl UA:citi-bank.ru :fleshkatera.cn :adult-empire.com UA:194.54.90.246:80 |
445 | pcap | raw alerts ruleset |
http irc 19 lines |
Yeah : 1.3 profile |
none | summary tarball |
35 of 36 | 516f7aaac5 [Firefox: 6 hits: 09-19 to 09-21] |
none[none] | none:none |
none|none | none | none |
| T:23:39:00 | WinXP | 117.99.56.161 (XLRI.AC.IN): BHARTI AIRTEL LTD, DELHI, DELHI, IN. |
n/a | RU:moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
25 of 25 | 7f60162c2c [Firefox:622 hits: 12-31 to 09-24] |
1aad8e4632 [0] | ASM:Graph |
PolyEnE| | lines=93 embedded dns |
trace |
| T:23:52:00 | Win2K-f | 24.189.169.219 (OPTONLINE.NET): OPTIMUM ONLINE (CABLEVISION SYSTEMS), UNIONDALE, NEW YORK, US. |
n/a | US:microsoft.com US:download.microsoft.com |
135 | pcap | raw alerts ruleset |
http 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 [Firefox:2452 hits: 06-17 to 09-24] 73f1082158 [Firefox:1210 hits: 06-18 to 09-24] |
none[4] 73f1082158[1] |
none:none ASM:Graph |
tElock| Armadillo| |
none lines=81 |
trace trace |