pak004_932bdb768b3eeeec3fcd3540acd32aa0.pcap

MD5	932bdb768b3eeeec3fcd3540acd32aa0
Submission Date	2021-10-04 07:56:18
Tags	(not set)

Alert 6

Showing 1-6 of 6 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

Timestamp	2012-09-21T07:42:34.494625-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?

2012-09-21T07:42:34.494625-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:36.845858-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:36.845858-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:37.398726-0700
Flow Id	182514582651992
Source IP	80.239.254.72
Source Port	80
Destination IP	172.18.3.11
Destination Port	6512
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Server: Apache Last-Modified: Thu, 09 Mar 2006 21:32:31 GMT ETag: "9f40d-3a-40e969d2259c0" Accept-Ranges: bytes Content-Type: application/x-javascript Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 63 Date: Fri, 21 Sep 2012 14:35:47 GMT Connection: keep-alive ..........K+.K....Sp.O..M.+./.,I.P.(..Q.T.VH....#KX+... ...:...HTTP/1.1 200 OK Server: Apache Last-Modified: Tue, 28 Aug 2012 10:16:41 GMT ETag: "7572ed-997c-4c850bd04f440" Accept-Ranges: bytes Content-Length: 39292 Content-Type: application/x-shockwave-flash Date: Fri, 21 Sep 2012 14:35:47 GMT Connection: keep-alive CWS.....x..zuT[_.h...%X...[p...@." .$..).w.n..R\.C!P..o..R.X...........z.M.......{.9q.<k..rd.x........V........a.a.... W.....jj...........i........y.ZCw...p...E..X.q...X;;..X.......$e\|\,..`.tV0[8B..wG7........&................s..{. #M'.#.........qrD...H1.K.....i^....x8H1..C.{..C...............................................`x....F.......1)........[......_LL..O.W@........a...pg...E..............r...b`.w.N...............= 0....].......;{.Y........]...Go........Q.......PS.bx......WV.U.................@\|r". E9y.....d.....E...........A.\|......))...[V ..a....[.._.\|..........M.......c....n..B..'..O.ii G.3....._anp/..e7g'..eX..?x......\LHXTAXNXY^....c...7.?Y.}t.....O=..?..,.G.?.....f........_....<..'.K.P...w@./@.O.7._.'......=. ....... . .....a.p.. .?..k.AC.....~.....L..;..?Tl,....C...1.=#.y...:....@../G..k..@..T @B...S.<#.$D.;...[H.........>..B..... .S<f..a.,"6.....o..^lS.E .0...4VQ..H\ ..:.:.:...:...\|..c...._N.....bp..<..q.D....c...1E..'..}S)L/....x..R@t @.0..rL........v....].........'..,CX.........\2...W._k.......yH^o..n@.J......I.K.>.Z....92....3..\...fL...OK!.z..Ds...1....M\vk.).#Q..k .,.r.W..L....X.l..S&........Kg.#..pO...H_n..U...5.,W..e.....m.......u1.\|.I.U^..C.&duK..L.n..%......D.d)5....OY..[.G....M..2...6...Y3A.."T.t(.V..I......L.n.{$>....r..2.....2.....5,. 3R/-.\\....s.,.m_ ZQKO....0...+..d.:o.M..ux...?.C0..r.....b.[.....mO#Tn.....z..X%.{s.#.3........%....f.\|...,...S.?......Rl.s...C..Vj...~....T(.r..........Ik.b ..M./...n.H"Y0.=t.b.e..}.CW.........q)....d,.g.0j"..._g...g.u...%.{..(..j..n.....wl........V..Qq.YF-.B]).}.G...Gx....b.C..........N...4.(..,..2J............i.y...w ...\..../:d.@cYhd..;...?..m...9-.U..G......g.yx.s..>~..>1VX.........%..5'j..9..P...6d..dm8f.L].....iSrF...e:.m.,?(.b.O......U.JdiV.<gP.........._...~7E......?J....c.I....$......7..o5@].ub..\N........c;..2; e.........Ql...o...g.e0...e..-4.....%.%F...O..H.A.-......?C...g.m.@7.w.Z...K7...T0.... ....F..>...j..08.D........u..9...gD..F....=......nY..B..7...2...`4...-...U.W.>.Tj.[...../.7......L...J.G...,.z<.R.%.B~[S.....h.+.7)...(.._.F.~."..w.mPx.$o.O....uc..j.....s~......'.m....K...x.y..................K....>H..(xR.'y...7.?/.L.FWK...Hx&...?.=mK...u..._}H...y...<jR..I.....Z`..v.b]...R..&..E).&plMo....`8.A.B...E..h...Ll...o.... ..u..@yB:.7UB.#.......}.......~FqJ...u.o.............sH".u.[WN.............<.............."wQ...+..b..tu.S2.<...SGUT.Jx.f.K9q8.g.+c.G.......A...T...k...j)>.{s..,OD.....=....9_.}.....{.;................I..2U... B#.)..=.....%

2012-09-21T07:42:37.398726-0700

80.239.254.72

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:39.445690-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:39.445690-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:39.570006-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:39.570006-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:43:36.151476-0700
Flow Id	1113760125742992
Source IP	80.239.254.42
Source Port	80
Destination IP	172.18.3.11
Destination Port	6435
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 301 Moved Permanently Server: Apache Content-Type: text/html; charset=iso-8859-1 Location: http://emp.bbci.co.uk/emp/releases/bump/revisions/872744/embed.js?emp=worldwide&enableClear=1 Content-Length: 305 Vary: Accept-Encoding Cache-Control: max-age=269 Expires: Fri, 21 Sep 2012 14:39:23 GMT Date: Fri, 21 Sep 2012 14:34:54 GMT Connection: keep-alive <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://emp.bbci.co.uk/emp/releases/bump/revisions/872744/embed.js?emp=worldwide&enableClear=1">here</a>.</p> </body></html> HTTP/1.1 200 OK Last-Modified: Mon, 14 May 2012 13:04:14 GMT Vary: Accept-Encoding Server: Apache Accept-Ranges: bytes Content-Type: application/x-javascript Content-Encoding: gzip Content-Length: 2621 Cache-Control: max-age=84 Expires: Fri, 21 Sep 2012 14:36:18 GMT Date: Fri, 21 Sep 2012 14:34:54 GMT Connection: keep-alive ............ks.9.....+...{...2q9....YI.....aF..y!i.....ni.`....2.....w..e...$.l.vE'p.B..X.Cx......^bgKbM.B,.......pH.4t.. ..>....<v.!?..+.37...p..^'. ..8...n6..:.J....u.s.TI.F[..I.-Z'n..Q...._.pH.$.$...J.!...AQ%.N.w`..(UO)Of..x9y.8$.}>.b.....@..N../7."x.$......@+....M....l.\%...].)P...(.q2..c2.\e"...H.....A.k~:q.....6...,T..;#...... .H.E. ......g^.g....xH. .?.J_g#@...{C.. .Anh. .....;[..p`q!.1<.X.W.......d...m6\|=...f..........s........G'..r...".+p.d.p[.a.(..6* .;.Q.fe.<...(.................^....-BX}..~...fa.`.......h........h.+.X.X...J..H..fEN:.Llo..3E....= .!x4=fV..t\|<..P.d..f...&.L.......su.r\.wO_....qJ.'.T....X.h.:Z..K..J..`...I.)x.4SHBxF.qi .......>.~.z........a.F......../.SJ..Z.Tp.K.e..N.....S.^..L...Pc..............{.X...N.%...F....cF.eK...S.XN...8g.~..#...._...............-wz.1F.t<8.....i..x..6v_.........C qD.....I..n ..Z#G-.?j...<u....sB...e\8Z\969%.w........."].......R.;.MZ..B..l....I..Gr...- 1.e.....T..~........]&w.6.E..\|......N.l..20&...3.0....7'..a,!A...g[...0.....2...^T. .a.4)...>!...a..p......=.....j.e.4.D...8...1..P...-..........\...:.?. OH...S.I[.fJ.....(...N.tb...J:...../.....<w9.9......6Mc....$.I....}.I../...$...l......9f... C.D.9.%.<C..].K.........x..H.oV.^O.m-..2.U.l.4..l\.._3.YC.\|.7.X....%.b..0J.T$A.:..H6P..a..n\|$......Y/\y...D.r..@Q... )..-.5wf..3G..<o.........A...b...XA.......mp.M.4Kk.....z.)ci ..RQ.... ._...=8..p...&..7..6../...#..........\.1@...PJu..b.u\|i.."X..p.l.]I.~L6"P.....].......[.......o\`}5'...Z.........Q..bw^d.\..U.0..I..7...sQ...Q........`.Q...a..\..s]....s....h...@^..Do...+......n<..4.../..h..9..&P'.7....q:.......8..}.[..J.5.5....... (......R]vgoR..........BZ.d^.L.64.M..h.8..f..8...HXH....I...ZB$N.n......<.2.....2>..XL...-..b.y..&..:w..>..\|p(}..1.}j..8.d......v...Y.q..T..p.7...C].9..v).0....%..9....j....G..,..C.........1v&.8......H.5....7.../.y...o..4....(.._.S.I..y...aH.<._.~BV.Y.o....w..........x......u.<....V?.._@\|.........[.....S...IQ.1._:eO.w....m~.Y.. &.;p)..1....b....".R...............K....Iu.@z...N.\.E ..&=....6r.`x.wP.No.l..l8..2. ...;1.rjB.........P......d.......v..........6..)..u. t...S..._... +..J.7.uv..v.Oe.N.7)R =...q....N~...... .......~.s8.tb(..B...b.. . ..;.!C<4<....%... Q.{....X. ........._.Jrt...Q.......:......"........ ..<9Z.....Y......y...F.......=B...).;........5..}....fpd...PQ.....\|....gO...A.4.~V..k..}1..i7....z.m.......9........Z\|..pV.....Y...G..>..=:-.)...t..v.\|r!....QA..TH.G..}.. I.^T...w.p.c.hG.3.......O....@.c.<u2a....n.>6J>.t..........z9....[w..G.K;.)r..N+.M@.%^.n..<...F....8/..........P1......5'\|h.H.".....4l.j].m....,/.~..~..o.e... .....P^Uc .>..].sqC .s..(...D.....fQ..S...ZC..m.}..M..;........_<.....HTTP/1.1 301 Moved Permanently Server: Apache Content-Type: text/html; charset=iso-8859-1 Location: http://emp.bbci.co.uk/emp/releases/worldwide/revisions/749603_749269_749444_6/embed.js?mediaset=journalism-pc Content-Length: 317 Vary: Accept-Encoding Cache-Control: max-age=238 Expires: Fri, 21 Sep 2012 14:38:53 GMT Date: Fri, 21 Sep 2012 14:34:55 GMT Connection: keep-alive <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <ti

2012-09-21T07:43:36.151476-0700

80.239.254.42

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

DNS 327

Showing 1-20 of 327 items.

Timestamp

Src Ip

Dest Ip

Dns Type

Resource Record Name

Resource Record Type

Resource Data

2012-09-21T07:41:39.704863-0700

172.18.3.11

172.18.1.100

query

www.google.co.uk

(not set)

2012-09-21T07:41:40.288015-0700

172.18.3.11

172.18.1.100

query

play.google.com

(not set)

2012-09-21T07:41:40.309850-0700

172.18.3.11

172.18.1.100

query

www.youtube.com

(not set)

2012-09-21T07:41:40.337901-0700

172.18.1.100

172.18.3.11

answer

play.google.com

(not set)

2012-09-21T07:41:40.339156-0700

172.18.3.11

172.18.1.100

query

news.google.co.uk

(not set)

2012-09-21T07:41:40.339186-0700

172.18.3.11

172.18.1.100

query

mail.google.com

(not set)

2012-09-21T07:41:40.339973-0700

172.18.1.100

172.18.3.11

answer

www.youtube.com

(not set)

2012-09-21T07:41:40.339974-0700

172.18.1.100

172.18.3.11

answer

mail.google.com

(not set)

2012-09-21T07:41:40.340579-0700

172.18.3.11

172.18.1.100

query

docs.google.com

(not set)

2012-09-21T07:41:40.341765-0700

172.18.3.11

172.18.1.100

query

books.google.co.uk

(not set)

2012-09-21T07:41:40.342098-0700

172.18.1.100

172.18.3.11

answer

books.google.co.uk

(not set)

2012-09-21T07:41:40.342539-0700

172.18.3.11

172.18.1.100

query

www.blogger.com

(not set)

2012-09-21T07:41:40.363758-0700

172.18.1.100

172.18.3.11

answer

news.google.co.uk

(not set)

2012-09-21T07:41:40.363759-0700

172.18.1.100

172.18.3.11

answer

www.blogger.com

(not set)

2012-09-21T07:41:40.365252-0700

172.18.3.11

172.18.1.100

query

picasaweb.google.co.uk

(not set)

2012-09-21T07:41:40.380116-0700

172.18.1.100

172.18.3.11

answer

docs.google.com

(not set)

2012-09-21T07:41:40.409792-0700

172.18.1.100

172.18.3.11

answer

picasaweb.google.co.uk

(not set)

2012-09-21T07:41:40.287910-0700

172.18.3.11

172.18.1.100

query

maps.google.co.uk

(not set)

2012-09-21T07:41:40.337900-0700

172.18.1.100

172.18.3.11

answer

maps.google.co.uk

(not set)

2012-09-21T07:41:40.381273-0700

172.18.3.11

172.18.1.100

query

accounts.google.com

(not set)

TLS 8

Showing 1-8 of 8 items.

Timestamp

Source IP

Destination IP

TLS Version

Server Name Indication

2012-09-21T07:42:39.608580-0700

172.18.3.11

173.194.41.168

TLSv1

plusone.google.com

2012-09-21T07:42:39.469797-0700

172.18.3.11

173.194.41.174

TLSv1

apis.google.com

2012-09-21T07:42:39.679741-0700

172.18.3.11

173.194.41.175

TLSv1

ssl.gstatic.com

2012-09-21T07:42:40.459911-0700

172.18.3.11

2.23.130.110

TLSv1

s-static.ak.facebook.com

2012-09-21T07:42:47.097613-0700

172.18.3.11

173.194.41.185

TLSv1

googleads.g.doubleclick.net

2012-09-21T07:42:40.801600-0700

172.18.3.11

173.252.101.16

TLSv1

www.facebook.com

2012-09-21T07:42:59.520623-0700

172.18.3.11

173.194.67.95

TLSv1

ajax.googleapis.com

2012-09-21T07:43:34.176791-0700

172.18.3.11

173.194.41.163

TLSv1

sb-ssl.google.com

TFTP 0

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
No results found.

HTTP 687

Showing 81-100 of 687 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

2012-09-21T07:41:45.004622-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63021000/jpg/_63021371_eatrich144_getty.jpg

200

2012-09-21T07:41:44.893419-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/62967000/jpg/_62967972_hi016012954.jpg

200

2012-09-21T07:41:44.897784-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/62987000/jpg/_62987391_hi016011678.jpg

200

2012-09-21T07:41:45.254892-0700

172.18.3.11

sa.bbc.co.uk

GET

/bbc/bbc/s?name=news.page&cps_asset_id=10263779&page_type=index&section=front-page&app_version=6.2.104-RC6&first_pub=2010-06-10T14:18:30+00:00&last_editorial_update=2012-09-21T14:32:05+00:00&title=&comments_box=false&cps_media_type=&cps_media_state=&app_type=web&ml_name=SSI&ml_version=0.11.1&language=en-GB&bbc_mc=not_set&screen_resolution=1680x1050&blq_s=3.5&blq_r=3.5&blq_v=journalism-domestic&ns__t=1348238505204&ns_c=UTF-8&ns_ti=BBC%20News%20-%20Home&ns_jspageurl=http%3A//www.bbc.co.uk/news/&ns_referrer=

302

2012-09-21T07:41:44.904783-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63018000/jpg/_63018262_hi016017809.jpg

200

2012-09-21T07:41:45.380959-0700

172.18.3.11

news.bbcimg.co.uk

GET

/js/view/0_0_32/news-index.js

200

2012-09-21T07:41:44.933637-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63025000/jpg/_63025125_016028534-1.jpg

200

2012-09-21T07:41:45.414479-0700

172.18.3.11

sa.bbc.co.uk

GET

/bbc/bbc/s?name=news.page&ns_m2=yes&ns_setsiteck=505C7B0F67BF00B2&cps_asset_id=10263779&page_type=index&section=front-page&app_version=6.2.104-RC6&first_pub=2010-06-10T14:18:30+00:00&last_editorial_update=2012-09-21T14:32:05+00:00&title=&comments_box=false&cps_media_type=&cps_media_state=&app_type=web&ml_name=SSI&ml_version=0.11.1&language=en-GB&bbc_mc=not_set&screen_resolution=1680x1050&blq_s=3.5&blq_r=3.5&blq_v=journalism-domestic&ns__t=1348238505204&ns_c=UTF-8&ns_ti=BBC%20News%20-%20Home&ns_jspageurl=http%3A//www.bbc.co.uk/news/&ns_referrer=

200

2012-09-21T07:41:44.936981-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63028000/jpg/_63028641_binoche640.jpg

200

2012-09-21T07:41:45.380433-0700

172.18.3.11

static.bbci.co.uk

GET

/frameworks/demi/0.9.8/sharedmodules/demi-1.js

200

2012-09-21T07:41:44.950703-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63012000/jpg/_63012675_63012074.jpg

200

2012-09-21T07:41:45.418689-0700

172.18.3.11

static.bbci.co.uk

GET

/frameworks/barlesque/2.10.0/desktop/3.5/img/bbccookies/cookie_prompt_sprite.png

200

2012-09-21T07:41:45.435571-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/1_4_35/cream/hi/news/img/subnav-divider.png

200

2012-09-21T07:41:45.435721-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/img/transparencies/rgba-0-0-0-07.png

200

2012-09-21T07:41:45.481766-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/img/search.png

200

2012-09-21T07:41:45.478856-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/1_4_35/cream/hi/news/img/red-masthead.png

200

2012-09-21T07:41:45.521161-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/img/programmes-iplayer-brand.png

200

2012-09-21T07:41:45.524575-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/1_4_35/cream/hi/news/img/languages-sprite.gif

200

2012-09-21T07:41:45.566662-0700

172.18.3.11

static.bbci.co.uk

GET

/frameworks/istats/0.11.1/modules/istats-1.js

200

100

2012-09-21T07:41:45.508437-0700

172.18.3.11

emp.bbci.co.uk

GET

/emp/worldwide/embed.js?mediaset=journalism-pc

301

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 0

#		Timestamp	Source	Destination	Email From	Email To	Subject
No results found.

Flow 405

Showing 161-180 of 405 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

161

2012-09-21T07:43:38.102668-0700

1463600247564879

flow

172.18.3.11

6474

80.239.254.138

TCP

pcapanalyzer

162

2012-09-21T07:43:38.102668-0700

2027121431617043

flow

172.18.3.11

6477

80.239.221.43

TCP

pcapanalyzer

163

2012-09-21T07:43:38.102668-0700

901872211608047

flow

172.18.3.11

52490

172.18.1.100

UDP

pcapanalyzer

164

2012-09-21T07:43:38.102668-0700

620893308581305

flow

172.18.3.11

6639

80.239.149.44

TCP

pcapanalyzer

165

2012-09-21T07:43:38.102668-0700

621408697317743

flow

172.18.3.11

6449

87.249.105.58

TCP

pcapanalyzer

166

2012-09-21T07:43:38.102668-0700

1606785871149356

flow

172.18.3.11

61801

172.18.1.100

UDP

pcapanalyzer

167

2012-09-21T07:43:38.102668-0700

58699269040922

flow

172.18.3.11

6626

212.58.244.80

TCP

pcapanalyzer

168

2012-09-21T07:43:38.102668-0700

621928388892889

flow

172.18.3.11

6460

212.58.244.75

TCP

pcapanalyzer

169

2012-09-21T07:43:38.102668-0700

340481332420894

flow

172.18.3.11

6524

64.236.124.229

TCP

pcapanalyzer

170

2012-09-21T07:43:38.102668-0700

763142621311496

flow

172.18.3.11

49369

172.18.1.100

UDP

pcapanalyzer

171

2012-09-21T07:43:38.102668-0700

1889175675006049

flow

172.18.3.11

6605

213.174.142.29

TCP

pcapanalyzer

172

2012-09-21T07:43:38.102668-0700

1326403956875693

flow

172.18.3.11

6456

80.239.254.24

TCP

pcapanalyzer

173

2012-09-21T07:43:38.102668-0700

1326880701218610

flow

172.18.3.11

52464

172.18.1.100

UDP

pcapanalyzer

174

2012-09-21T07:43:38.102668-0700

905389791076026

flow

172.18.3.11

64110

172.18.1.100

UDP

pcapanalyzer

175

2012-09-21T07:43:38.102668-0700

2172787395330868

flow

172.18.3.11

6543

98.124.224.243

TCP

pcapanalyzer

176

2012-09-21T07:43:38.102668-0700

624803872458189

flow

172.18.3.11

63166

172.18.1.100

UDP

pcapanalyzer

177

2012-09-21T07:43:38.102668-0700

766061051761553

flow

172.18.3.11

53765

172.18.1.100

UDP

pcapanalyzer

178

2012-09-21T07:43:38.102668-0700

1892061890523973

flow

172.18.3.11

6557

173.252.101.16

443

TCP

pcapanalyzer

179

2012-09-21T07:43:38.102668-0700

1329605854638704

flow

172.18.3.11

6424

80.239.217.171

TCP

pcapanalyzer

180

2012-09-21T07:43:38.102668-0700

907563040781089

flow

172.18.3.11

6425

80.239.254.34

TCP

pcapanalyzer

File 654

Showing 161-180 of 654 items.

Timestamp

Source

Destination

File Name

File Magic

File Size

161

2012-09-21T07:41:45.643105-0700

80.239.254.34

172.18.3.11

/glow/glow/1.7.7/widgets/images/darkpanel/ctr.png

PNG image data, 14 x 14, 8-bit/color RGBA, non-interlaced

207

162

2012-09-21T07:42:12.049128-0700

173.194.41.175

172.18.3.11

/v6exp3/6.gif

GIF image data, version 89a, 1 x 1

163

2012-09-21T07:41:54.116429-0700

80.239.254.42

172.18.3.11

/emp/bump

HTML document, ASCII text

305

164

2012-09-21T07:41:54.252398-0700

212.58.244.130

172.18.3.11

/o.gif

GIF image data, version 89a, 1 x 1

165

2012-09-21T07:42:18.443981-0700

173.194.65.94

172.18.3.11

ASCII text, with very long lines, with no line terminators

1298

166

2012-09-21T07:41:45.731110-0700

80.239.254.24

172.18.3.11

/js/app/ticker/2_1_1/ticker.js

ASCII text, with very long lines, with no line terminators

9943

167

2012-09-21T07:41:54.275052-0700

80.239.254.42

172.18.3.11

/emp/worldwide/embed.js

HTML document, ASCII text

317

168

2012-09-21T07:41:49.838636-0700

80.239.254.24

172.18.3.11

/media/images/63031000/jpg/_63031105_000793140-1.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

3674

169

2012-09-21T07:41:49.847598-0700

80.239.254.24

172.18.3.11

/media/images/62978000/jpg/_62978075_62978004.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 112x63, frames 3

4552

170

2012-09-21T07:42:20.597822-0700

173.194.41.191

172.18.3.11

/news/tbn/Zslr3463hrQJ/6.jpg

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 80x80, frames 3

2293

171

2012-09-21T07:42:20.599260-0700

173.194.65.94

172.18.3.11

ASCII text, with very long lines, with no line terminators

78661

172

2012-09-21T07:42:20.771452-0700

173.194.34.24

172.18.3.11

/verify/EAAAAOUmQ06UkEvBLgmOHOaVuYg.gif

GIF image data, version 89a, 1 x 1

173

2012-09-21T07:41:49.879909-0700

80.239.254.24

172.18.3.11

/news/special/2012/newsspec_4095/widget/css/style_w.css

ASCII text, with CRLF line terminators

2384

174

2012-09-21T07:41:54.297266-0700

212.58.244.75

172.18.3.11

/modules/sharetools/v1/script/sharetools.js

ASCII text, with very long lines, with no line terminators

34128

175

2012-09-21T07:41:49.883367-0700

80.239.254.24

172.18.3.11

/media/images/62749000/jpg/_62749458_keyboard.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=3, xresolution=50, yresolution=58, resolutionunit=2], baseline, precision 8, 144x81, frames 3

4162

176

2012-09-21T07:41:49.887444-0700

80.239.254.24

172.18.3.11

/media/images/63020000/jpg/_63020748_pa-9961806.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

4751

177

2012-09-21T07:41:49.930854-0700

80.239.254.24

172.18.3.11

/media/images/62986000/jpg/_62986964_62985822.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

6259

178

2012-09-21T07:42:12.051138-0700

173.194.41.175

172.18.3.11

/v6exp3/6.gif

GIF image data, version 89a, 1 x 1

179

2012-09-21T07:41:49.934043-0700

80.239.254.24

172.18.3.11

/media/images/62999000/jpg/_62999545_000237650-1.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

3984

180

2012-09-21T07:42:22.113042-0700

173.194.65.94

172.18.3.11

/search

ASCII text, with very long lines, with no line terminators

75008

Comments	(not set)

Update Download PCAP Delete