pak004_932bdb768b3eeeec3fcd3540acd32aa0.pcap

MD5	932bdb768b3eeeec3fcd3540acd32aa0
Submission Date	2021-10-04 07:56:18
Tags	(not set)

Alert 6

Showing 1-6 of 6 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

Timestamp	2012-09-21T07:42:34.494625-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?

2012-09-21T07:42:34.494625-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:36.845858-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:36.845858-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:37.398726-0700
Flow Id	182514582651992
Source IP	80.239.254.72
Source Port	80
Destination IP	172.18.3.11
Destination Port	6512
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Server: Apache Last-Modified: Thu, 09 Mar 2006 21:32:31 GMT ETag: "9f40d-3a-40e969d2259c0" Accept-Ranges: bytes Content-Type: application/x-javascript Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 63 Date: Fri, 21 Sep 2012 14:35:47 GMT Connection: keep-alive ..........K+.K....Sp.O..M.+./.,I.P.(..Q.T.VH....#KX+... ...:...HTTP/1.1 200 OK Server: Apache Last-Modified: Tue, 28 Aug 2012 10:16:41 GMT ETag: "7572ed-997c-4c850bd04f440" Accept-Ranges: bytes Content-Length: 39292 Content-Type: application/x-shockwave-flash Date: Fri, 21 Sep 2012 14:35:47 GMT Connection: keep-alive CWS.....x..zuT[_.h...%X...[p...@." .$..).w.n..R\.C!P..o..R.X...........z.M.......{.9q.<k..rd.x........V........a.a.... W.....jj...........i........y.ZCw...p...E..X.q...X;;..X.......$e\|\,..`.tV0[8B..wG7........&................s..{. #M'.#.........qrD...H1.K.....i^....x8H1..C.{..C...............................................`x....F.......1)........[......_LL..O.W@........a...pg...E..............r...b`.w.N...............= 0....].......;{.Y........]...Go........Q.......PS.bx......WV.U.................@\|r". E9y.....d.....E...........A.\|......))...[V ..a....[.._.\|..........M.......c....n..B..'..O.ii G.3....._anp/..e7g'..eX..?x......\LHXTAXNXY^....c...7.?Y.}t.....O=..?..,.G.?.....f........_....<..'.K.P...w@./@.O.7._.'......=. ....... . .....a.p.. .?..k.AC.....~.....L..;..?Tl,....C...1.=#.y...:....@../G..k..@..T @B...S.<#.$D.;...[H.........>..B..... .S<f..a.,"6.....o..^lS.E .0...4VQ..H\ ..:.:.:...:...\|..c...._N.....bp..<..q.D....c...1E..'..}S)L/....x..R@t @.0..rL........v....].........'..,CX.........\2...W._k.......yH^o..n@.J......I.K.>.Z....92....3..\...fL...OK!.z..Ds...1....M\vk.).#Q..k .,.r.W..L....X.l..S&........Kg.#..pO...H_n..U...5.,W..e.....m.......u1.\|.I.U^..C.&duK..L.n..%......D.d)5....OY..[.G....M..2...6...Y3A.."T.t(.V..I......L.n.{$>....r..2.....2.....5,. 3R/-.\\....s.,.m_ ZQKO....0...+..d.:o.M..ux...?.C0..r.....b.[.....mO#Tn.....z..X%.{s.#.3........%....f.\|...,...S.?......Rl.s...C..Vj...~....T(.r..........Ik.b ..M./...n.H"Y0.=t.b.e..}.CW.........q)....d,.g.0j"..._g...g.u...%.{..(..j..n.....wl........V..Qq.YF-.B]).}.G...Gx....b.C..........N...4.(..,..2J............i.y...w ...\..../:d.@cYhd..;...?..m...9-.U..G......g.yx.s..>~..>1VX.........%..5'j..9..P...6d..dm8f.L].....iSrF...e:.m.,?(.b.O......U.JdiV.<gP.........._...~7E......?J....c.I....$......7..o5@].ub..\N........c;..2; e.........Ql...o...g.e0...e..-4.....%.%F...O..H.A.-......?C...g.m.@7.w.Z...K7...T0.... ....F..>...j..08.D........u..9...gD..F....=......nY..B..7...2...`4...-...U.W.>.Tj.[...../.7......L...J.G...,.z<.R.%.B~[S.....h.+.7)...(.._.F.~."..w.mPx.$o.O....uc..j.....s~......'.m....K...x.y..................K....>H..(xR.'y...7.?/.L.FWK...Hx&...?.=mK...u..._}H...y...<jR..I.....Z`..v.b]...R..&..E).&plMo....`8.A.B...E..h...Ll...o.... ..u..@yB:.7UB.#.......}.......~FqJ...u.o.............sH".u.[WN.............<.............."wQ...+..b..tu.S2.<...SGUT.Jx.f.K9q8.g.+c.G.......A...T...k...j)>.{s..,OD.....=....9_.}.....{.;................I..2U... B#.)..=.....%

2012-09-21T07:42:37.398726-0700

80.239.254.72

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:39.445690-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:39.445690-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:39.570006-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:39.570006-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:43:36.151476-0700
Flow Id	1113760125742992
Source IP	80.239.254.42
Source Port	80
Destination IP	172.18.3.11
Destination Port	6435
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 301 Moved Permanently Server: Apache Content-Type: text/html; charset=iso-8859-1 Location: http://emp.bbci.co.uk/emp/releases/bump/revisions/872744/embed.js?emp=worldwide&enableClear=1 Content-Length: 305 Vary: Accept-Encoding Cache-Control: max-age=269 Expires: Fri, 21 Sep 2012 14:39:23 GMT Date: Fri, 21 Sep 2012 14:34:54 GMT Connection: keep-alive <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://emp.bbci.co.uk/emp/releases/bump/revisions/872744/embed.js?emp=worldwide&enableClear=1">here</a>.</p> </body></html> HTTP/1.1 200 OK Last-Modified: Mon, 14 May 2012 13:04:14 GMT Vary: Accept-Encoding Server: Apache Accept-Ranges: bytes Content-Type: application/x-javascript Content-Encoding: gzip Content-Length: 2621 Cache-Control: max-age=84 Expires: Fri, 21 Sep 2012 14:36:18 GMT Date: Fri, 21 Sep 2012 14:34:54 GMT Connection: keep-alive ............ks.9.....+...{...2q9....YI.....aF..y!i.....ni.`....2.....w..e...$.l.vE'p.B..X.Cx......^bgKbM.B,.......pH.4t.. ..>....<v.!?..+.37...p..^'. ..8...n6..:.J....u.s.TI.F[..I.-Z'n..Q...._.pH.$.$...J.!...AQ%.N.w`..(UO)Of..x9y.8$.}>.b.....@..N../7."x.$......@+....M....l.\%...].)P...(.q2..c2.\e"...H.....A.k~:q.....6...,T..;#...... .H.E. ......g^.g....xH. .?.J_g#@...{C.. .Anh. .....;[..p`q!.1<.X.W.......d...m6\|=...f..........s........G'..r...".+p.d.p[.a.(..6* .;.Q.fe.<...(.................^....-BX}..~...fa.`.......h........h.+.X.X...J..H..fEN:.Llo..3E....= .!x4=fV..t\|<..P.d..f...&.L.......su.r\.wO_....qJ.'.T....X.h.:Z..K..J..`...I.)x.4SHBxF.qi .......>.~.z........a.F......../.SJ..Z.Tp.K.e..N.....S.^..L...Pc..............{.X...N.%...F....cF.eK...S.XN...8g.~..#...._...............-wz.1F.t<8.....i..x..6v_.........C qD.....I..n ..Z#G-.?j...<u....sB...e\8Z\969%.w........."].......R.;.MZ..B..l....I..Gr...- 1.e.....T..~........]&w.6.E..\|......N.l..20&...3.0....7'..a,!A...g[...0.....2...^T. .a.4)...>!...a..p......=.....j.e.4.D...8...1..P...-..........\...:.?. OH...S.I[.fJ.....(...N.tb...J:...../.....<w9.9......6Mc....$.I....}.I../...$...l......9f... C.D.9.%.<C..].K.........x..H.oV.^O.m-..2.U.l.4..l\.._3.YC.\|.7.X....%.b..0J.T$A.:..H6P..a..n\|$......Y/\y...D.r..@Q... )..-.5wf..3G..<o.........A...b...XA.......mp.M.4Kk.....z.)ci ..RQ.... ._...=8..p...&..7..6../...#..........\.1@...PJu..b.u\|i.."X..p.l.]I.~L6"P.....].......[.......o\`}5'...Z.........Q..bw^d.\..U.0..I..7...sQ...Q........`.Q...a..\..s]....s....h...@^..Do...+......n<..4.../..h..9..&P'.7....q:.......8..}.[..J.5.5....... (......R]vgoR..........BZ.d^.L.64.M..h.8..f..8...HXH....I...ZB$N.n......<.2.....2>..XL...-..b.y..&..:w..>..\|p(}..1.}j..8.d......v...Y.q..T..p.7...C].9..v).0....%..9....j....G..,..C.........1v&.8......H.5....7.../.y...o..4....(.._.S.I..y...aH.<._.~BV.Y.o....w..........x......u.<....V?.._@\|.........[.....S...IQ.1._:eO.w....m~.Y.. &.;p)..1....b....".R...............K....Iu.@z...N.\.E ..&=....6r.`x.wP.No.l..l8..2. ...;1.rjB.........P......d.......v..........6..)..u. t...S..._... +..J.7.uv..v.Oe.N.7)R =...q....N~...... .......~.s8.tb(..B...b.. . ..;.!C<4<....%... Q.{....X. ........._.Jrt...Q.......:......"........ ..<9Z.....Y......y...F.......=B...).;........5..}....fpd...PQ.....\|....gO...A.4.~V..k..}1..i7....z.m.......9........Z\|..pV.....Y...G..>..=:-.)...t..v.\|r!....QA..TH.G..}.. I.^T...w.p.c.hG.3.......O....@.c.<u2a....n.>6J>.t..........z9....[w..G.K;.)r..N+.M@.%^.n..<...F....8/..........P1......5'\|h.H.".....4l.j].m....,/.~..~..o.e... .....P^Uc .>..].sqC .s..(...D.....fQ..S...ZC..m.}..M..;........_<.....HTTP/1.1 301 Moved Permanently Server: Apache Content-Type: text/html; charset=iso-8859-1 Location: http://emp.bbci.co.uk/emp/releases/worldwide/revisions/749603_749269_749444_6/embed.js?mediaset=journalism-pc Content-Length: 317 Vary: Accept-Encoding Cache-Control: max-age=238 Expires: Fri, 21 Sep 2012 14:38:53 GMT Date: Fri, 21 Sep 2012 14:34:55 GMT Connection: keep-alive <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <ti

2012-09-21T07:43:36.151476-0700

80.239.254.42

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

DNS 327

Showing 1-20 of 327 items.

Timestamp

Src Ip

Dest Ip

Dns Type

Resource Record Name

Resource Record Type

Resource Data

2012-09-21T07:41:39.704863-0700

172.18.3.11

172.18.1.100

query

www.google.co.uk

(not set)

2012-09-21T07:41:40.288015-0700

172.18.3.11

172.18.1.100

query

play.google.com

(not set)

2012-09-21T07:41:40.309850-0700

172.18.3.11

172.18.1.100

query

www.youtube.com

(not set)

2012-09-21T07:41:40.337901-0700

172.18.1.100

172.18.3.11

answer

play.google.com

(not set)

2012-09-21T07:41:40.339156-0700

172.18.3.11

172.18.1.100

query

news.google.co.uk

(not set)

2012-09-21T07:41:40.339186-0700

172.18.3.11

172.18.1.100

query

mail.google.com

(not set)

2012-09-21T07:41:40.339973-0700

172.18.1.100

172.18.3.11

answer

www.youtube.com

(not set)

2012-09-21T07:41:40.339974-0700

172.18.1.100

172.18.3.11

answer

mail.google.com

(not set)

2012-09-21T07:41:40.340579-0700

172.18.3.11

172.18.1.100

query

docs.google.com

(not set)

2012-09-21T07:41:40.341765-0700

172.18.3.11

172.18.1.100

query

books.google.co.uk

(not set)

2012-09-21T07:41:40.342098-0700

172.18.1.100

172.18.3.11

answer

books.google.co.uk

(not set)

2012-09-21T07:41:40.342539-0700

172.18.3.11

172.18.1.100

query

www.blogger.com

(not set)

2012-09-21T07:41:40.363758-0700

172.18.1.100

172.18.3.11

answer

news.google.co.uk

(not set)

2012-09-21T07:41:40.363759-0700

172.18.1.100

172.18.3.11

answer

www.blogger.com

(not set)

2012-09-21T07:41:40.365252-0700

172.18.3.11

172.18.1.100

query

picasaweb.google.co.uk

(not set)

2012-09-21T07:41:40.380116-0700

172.18.1.100

172.18.3.11

answer

docs.google.com

(not set)

2012-09-21T07:41:40.409792-0700

172.18.1.100

172.18.3.11

answer

picasaweb.google.co.uk

(not set)

2012-09-21T07:41:40.287910-0700

172.18.3.11

172.18.1.100

query

maps.google.co.uk

(not set)

2012-09-21T07:41:40.337900-0700

172.18.1.100

172.18.3.11

answer

maps.google.co.uk

(not set)

2012-09-21T07:41:40.381273-0700

172.18.3.11

172.18.1.100

query

accounts.google.com

(not set)

TLS 8

Showing 1-8 of 8 items.

Timestamp

Source IP

Destination IP

TLS Version

Server Name Indication

2012-09-21T07:42:39.608580-0700

172.18.3.11

173.194.41.168

TLSv1

plusone.google.com

2012-09-21T07:42:39.469797-0700

172.18.3.11

173.194.41.174

TLSv1

apis.google.com

2012-09-21T07:42:39.679741-0700

172.18.3.11

173.194.41.175

TLSv1

ssl.gstatic.com

2012-09-21T07:42:40.459911-0700

172.18.3.11

2.23.130.110

TLSv1

s-static.ak.facebook.com

2012-09-21T07:42:47.097613-0700

172.18.3.11

173.194.41.185

TLSv1

googleads.g.doubleclick.net

2012-09-21T07:42:40.801600-0700

172.18.3.11

173.252.101.16

TLSv1

www.facebook.com

2012-09-21T07:42:59.520623-0700

172.18.3.11

173.194.67.95

TLSv1

ajax.googleapis.com

2012-09-21T07:43:34.176791-0700

172.18.3.11

173.194.41.163

TLSv1

sb-ssl.google.com

TFTP 0

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
No results found.

HTTP 687

Showing 1-20 of 687 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

2012-09-21T07:41:40.427980-0700

172.18.3.11

www.google.com

GET

/textinputassistant/tia.png

200

2012-09-21T07:41:40.178861-0700

172.18.3.11

www.google.co.uk

GET

/images/srpr/logo3w.png

200

2012-09-21T07:41:40.291561-0700

172.18.3.11

www.google.co.uk

GET

/images/swxa.gif

200

2012-09-21T07:41:40.537934-0700

172.18.3.11

www.google.co.uk

GET

/csi?v=3&s=webhp&action=&e=17259,37102,39523,39976,4000116,4000354,4000472,4000519,4000545,4000553,4000624,4000648,4000723,4000784,4000833,4000841,4000949,4000974,4001007,4001013&ei=CXtcUPLCNoXF0QX3o4GIDQ&imc=1&imn=1&imp=1&rt=xjsls.36,prt.41,xjses.266,xjsee.318,xjs.320,ol.399,iml.61,wsrt.183,cst.0,dnst.22,rqst.103,rspt.31

204

2012-09-21T07:41:39.911086-0700

172.18.3.11

www.google.co.uk

GET

200

2012-09-21T07:41:44.482932-0700

172.18.3.11

www.bbc.co.uk

GET

/favicon.ico

200

2012-09-21T07:41:39.946369-0700

172.18.3.11

www.google.co.uk

GET

/images/icons/product/chrome-48.png

200

2012-09-21T07:41:44.597866-0700

172.18.3.11

static.bbci.co.uk

GET

/frameworks/barlesque/2.10.0/desktop/3.5/img/blq-blocks_grey_alpha.png

200

2012-09-21T07:41:44.585922-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/print.css

200

2012-09-21T07:41:40.204621-0700

172.18.3.11

www.google.co.uk

GET

/xjs/_/js/s/s,st,anim,jsa,c,sb,hv,wta,cr,cdos,nos,tbpr,tbui,rsn,ob,mb,lc,du,ada,amcl,klc,kat,aut,bihu,kp,lu,m,shb,tng,hsm,j,p,pcc,csi/rt=j/ver=Npnh78fj8FE.en_US./d=1/sv=1/rs=AItRSTPQPHplxSwT63aSYOfWgPS1dWhc4g

200

2012-09-21T07:41:44.590623-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/mobile.css

200

2012-09-21T07:41:44.614033-0700

172.18.3.11

news.bbc.co.uk

GET

301

2012-09-21T07:41:44.614931-0700

172.18.3.11

node1.bbcimg.co.uk

GET

/glow/gloader.0.1.6.js

200

2012-09-21T07:41:44.643648-0700

172.18.3.11

emp.bbci.co.uk

GET

/emp/bump?emp=worldwide&enableClear=1

301

2012-09-21T07:41:44.666045-0700

172.18.3.11

node2.bbcimg.co.uk

GET

/iplayer/images/episode/b01mxvlw_150_84.jpg

200

2012-09-21T07:41:40.283031-0700

172.18.3.11

www.google.co.uk

GET

/extern_chrome/ff301ef4d48490c5.js

200

2012-09-21T07:41:44.724056-0700

172.18.3.11

stats.bbc.co.uk

GET

/o.gif?~RS~s~RS~News~RS~t~RS~HighWeb_Index~RS~i~RS~0~RS~p~RS~99854~RS~a~RS~Domestic~RS~u~RS~/news/~RS~r~RS~(none)~RS~q~RS~~RS~z~RS~54~RS~

200

2012-09-21T07:41:44.732058-0700

172.18.3.11

www.bbc.co.uk

GET

/news/

200

2012-09-21T07:41:44.733613-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/components/components.css

200

2012-09-21T07:41:40.373773-0700

172.18.3.11

ssl.gstatic.com

GET

/gb/js/sem_9d2b852f41bb993a0833b0a332253abb.js

200

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 0

#		Timestamp	Source	Destination	Email From	Email To	Subject
No results found.

Flow 405

Showing 1-20 of 405 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

2012-09-21T07:41:39.704863-0700

954277252052231

flow

172.18.3.11

58234

255.255.255.255

1947

UDP

pcapanalyzer

2012-09-21T07:41:39.704863-0700

118968389913127

flow

172.18.3.11

6405

172.18.3.49

TCP

pcapanalyzer

2012-09-21T07:41:40.359876-0700

268514856517983

flow

172.18.3.11

50167

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:42:33.881814-0700

751578418267952

flow

172.18.3.11

58234

172.18.255.255

1947

UDP

pcapanalyzer

2012-09-21T07:42:33.881814-0700

268514856473418

flow

172.18.1.100

172.18.3.11

50167

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

141053112448034

flow

172.18.3.11

58471

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

1126275663755394

flow

172.18.3.11

56951

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

563830371169239

flow

172.18.3.11

6599

204.152.194.218

TCP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

1267732563203033

flow

172.18.3.11

62003

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

845689741651186

flow

172.18.3.11

56536

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

1690230639403618

flow

172.18.3.11

6484

64.236.124.229

TCP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

1972334825587849

flow

172.18.3.11

49568

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

284116325262502

flow

172.18.3.11

60687

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

426541739252755

flow

172.18.3.11

53110

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

1834479260316737

flow

172.18.3.11

6433

80.239.254.24

TCP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

145799055393495

flow

172.18.3.11

63879

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

568043728287493

flow

172.18.3.11

64864

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

568110305485653

flow

172.18.3.11

6586

213.174.142.29

TCP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

1975551755764055

flow

172.18.3.11

6410

173.194.65.94

TCP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

287150723368471

flow

172.18.3.11

6519

194.60.187.230

TCP

pcapanalyzer

File 654

Showing 101-120 of 654 items.

Timestamp

Source

Destination

File Name

File Magic

File Size

101

2012-09-21T07:41:49.858813-0700

80.239.254.24

172.18.3.11

/media/images/62965000/jpg/_62965186_baxter.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 112x63, frames 3

3811

102

2012-09-21T07:41:44.988509-0700

80.239.254.24

172.18.3.11

/media/images/63015000/jpg/_63015644_62984454.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

5719

103

2012-09-21T07:41:49.871861-0700

80.239.254.24

172.18.3.11

/news/special/2012/newsspec_4095/widget/js/widget.js

ASCII text, with CRLF line terminators

1541

104

2012-09-21T07:41:45.518295-0700

80.239.254.24

172.18.3.11

/view/3_0_2/cream/hi/shared/img/market-data-up.png

PNG image data, 9 x 7, 8-bit/color RGBA, non-interlaced

189

105

2012-09-21T07:41:49.900410-0700

80.239.254.24

172.18.3.11

/media/images/63033000/jpg/_63033678_0qc5dm92.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3, xresolution=50, yresolution=58, resolutionunit=2], baseline, precision 8, 144x81, frames 3

4228

106

2012-09-21T07:41:49.952148-0700

80.239.254.24

172.18.3.11

/media/images/62962000/jpg/_62962077_jex_1515425_de54-1.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

4637

107

2012-09-21T07:41:49.961316-0700

80.239.254.24

172.18.3.11

/media/images/49545000/gif/_49545337_tob304x171.gif

GIF image data, version 89a, 304 x 171

26690

108

2012-09-21T07:41:45.539921-0700

212.58.244.66

172.18.3.11

/js/app/ticker/ticker_initialiser.js

ASCII text, with very long lines, with no line terminators

1794

109

2012-09-21T07:41:49.992035-0700

80.239.254.24

172.18.3.11

/media/images/62972000/jpg/_62972523_62971152.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 112x63, frames 3

2969

110

2012-09-21T07:41:44.995976-0700

80.239.254.24

172.18.3.11

/media/images/63012000/jpg/_63012475_ngahuia.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 112x63, frames 3

3846

111

2012-09-21T07:41:45.555128-0700

212.58.244.66

172.18.3.11

/news/10284448/ticker.sjson

ASCII text, with CRLF, LF line terminators

2008

112

2012-09-21T07:41:50.199326-0700

212.58.244.66

172.18.3.11

/news/special/2012/newsspec_4095/js/jquery.placeholder.js

ASCII text, with CRLF line terminators

5271

113

2012-09-21T07:41:45.026796-0700

80.239.254.24

172.18.3.11

/media/images/63018000/jpg/_63018999_london_met_uni_afp.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 112x63, frames 3

4127

114

2012-09-21T07:41:50.207293-0700

80.239.254.24

172.18.3.11

/media/images/63009000/jpg/_63009359_jex_1514529_de27-1.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 112x63, frames 3

3409

115

2012-09-21T07:41:45.037350-0700

80.239.254.34

172.18.3.11

/glow/glow/1.7.7/widgets/widgets.js

ASCII text, with very long lines

113926

116

2012-09-21T07:41:50.219327-0700

80.239.254.24

172.18.3.11

/news/special/2012/newsspec_4095/img/search.png

PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced

469

117

2012-09-21T07:41:54.123780-0700

80.239.254.24

172.18.3.11

/media/images/62959000/jpg/_62959824_hacked.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=3, xresolution=50, yresolution=58, resolutionunit=2], baseline, precision 8, 304x171, frames 3

16033

118

2012-09-21T07:41:45.715077-0700

212.58.244.75

172.18.3.11

/frameworks/barlesque/1.3.2/newnav/img/search_icon.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

287

119

2012-09-21T07:41:45.192088-0700

80.239.254.24

172.18.3.11

/media/images/63038000/jpg/_63038944_63038940.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 112x63, frames 3

5742

120

2012-09-21T07:41:45.343096-0700

80.239.254.34

172.18.3.11

/glow/glow/1.7.7/widgets/widgets.css

ASCII text, with very long lines

40372

Comments	(not set)

Update Download PCAP Delete