pak004_932bdb768b3eeeec3fcd3540acd32aa0.pcap

MD5	932bdb768b3eeeec3fcd3540acd32aa0
Submission Date	2021-10-04 07:56:18
Tags	(not set)

Alert 6

Showing 1-6 of 6 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

Timestamp	2012-09-21T07:42:34.494625-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?

2012-09-21T07:42:34.494625-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:36.845858-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:36.845858-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:37.398726-0700
Flow Id	182514582651992
Source IP	80.239.254.72
Source Port	80
Destination IP	172.18.3.11
Destination Port	6512
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Server: Apache Last-Modified: Thu, 09 Mar 2006 21:32:31 GMT ETag: "9f40d-3a-40e969d2259c0" Accept-Ranges: bytes Content-Type: application/x-javascript Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 63 Date: Fri, 21 Sep 2012 14:35:47 GMT Connection: keep-alive ..........K+.K....Sp.O..M.+./.,I.P.(..Q.T.VH....#KX+... ...:...HTTP/1.1 200 OK Server: Apache Last-Modified: Tue, 28 Aug 2012 10:16:41 GMT ETag: "7572ed-997c-4c850bd04f440" Accept-Ranges: bytes Content-Length: 39292 Content-Type: application/x-shockwave-flash Date: Fri, 21 Sep 2012 14:35:47 GMT Connection: keep-alive CWS.....x..zuT[_.h...%X...[p...@." .$..).w.n..R\.C!P..o..R.X...........z.M.......{.9q.<k..rd.x........V........a.a.... W.....jj...........i........y.ZCw...p...E..X.q...X;;..X.......$e\|\,..`.tV0[8B..wG7........&................s..{. #M'.#.........qrD...H1.K.....i^....x8H1..C.{..C...............................................`x....F.......1)........[......_LL..O.W@........a...pg...E..............r...b`.w.N...............= 0....].......;{.Y........]...Go........Q.......PS.bx......WV.U.................@\|r". E9y.....d.....E...........A.\|......))...[V ..a....[.._.\|..........M.......c....n..B..'..O.ii G.3....._anp/..e7g'..eX..?x......\LHXTAXNXY^....c...7.?Y.}t.....O=..?..,.G.?.....f........_....<..'.K.P...w@./@.O.7._.'......=. ....... . .....a.p.. .?..k.AC.....~.....L..;..?Tl,....C...1.=#.y...:....@../G..k..@..T @B...S.<#.$D.;...[H.........>..B..... .S<f..a.,"6.....o..^lS.E .0...4VQ..H\ ..:.:.:...:...\|..c...._N.....bp..<..q.D....c...1E..'..}S)L/....x..R@t @.0..rL........v....].........'..,CX.........\2...W._k.......yH^o..n@.J......I.K.>.Z....92....3..\...fL...OK!.z..Ds...1....M\vk.).#Q..k .,.r.W..L....X.l..S&........Kg.#..pO...H_n..U...5.,W..e.....m.......u1.\|.I.U^..C.&duK..L.n..%......D.d)5....OY..[.G....M..2...6...Y3A.."T.t(.V..I......L.n.{$>....r..2.....2.....5,. 3R/-.\\....s.,.m_ ZQKO....0...+..d.:o.M..ux...?.C0..r.....b.[.....mO#Tn.....z..X%.{s.#.3........%....f.\|...,...S.?......Rl.s...C..Vj...~....T(.r..........Ik.b ..M./...n.H"Y0.=t.b.e..}.CW.........q)....d,.g.0j"..._g...g.u...%.{..(..j..n.....wl........V..Qq.YF-.B]).}.G...Gx....b.C..........N...4.(..,..2J............i.y...w ...\..../:d.@cYhd..;...?..m...9-.U..G......g.yx.s..>~..>1VX.........%..5'j..9..P...6d..dm8f.L].....iSrF...e:.m.,?(.b.O......U.JdiV.<gP.........._...~7E......?J....c.I....$......7..o5@].ub..\N........c;..2; e.........Ql...o...g.e0...e..-4.....%.%F...O..H.A.-......?C...g.m.@7.w.Z...K7...T0.... ....F..>...j..08.D........u..9...gD..F....=......nY..B..7...2...`4...-...U.W.>.Tj.[...../.7......L...J.G...,.z<.R.%.B~[S.....h.+.7)...(.._.F.~."..w.mPx.$o.O....uc..j.....s~......'.m....K...x.y..................K....>H..(xR.'y...7.?/.L.FWK...Hx&...?.=mK...u..._}H...y...<jR..I.....Z`..v.b]...R..&..E).&plMo....`8.A.B...E..h...Ll...o.... ..u..@yB:.7UB.#.......}.......~FqJ...u.o.............sH".u.[WN.............<.............."wQ...+..b..tu.S2.<...SGUT.Jx.f.K9q8.g.+c.G.......A...T...k...j)>.{s..,OD.....=....9_.}.....{.;................I..2U... B#.)..=.....%

2012-09-21T07:42:37.398726-0700

80.239.254.72

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:39.445690-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:39.445690-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:39.570006-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:39.570006-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:43:36.151476-0700
Flow Id	1113760125742992
Source IP	80.239.254.42
Source Port	80
Destination IP	172.18.3.11
Destination Port	6435
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 301 Moved Permanently Server: Apache Content-Type: text/html; charset=iso-8859-1 Location: http://emp.bbci.co.uk/emp/releases/bump/revisions/872744/embed.js?emp=worldwide&enableClear=1 Content-Length: 305 Vary: Accept-Encoding Cache-Control: max-age=269 Expires: Fri, 21 Sep 2012 14:39:23 GMT Date: Fri, 21 Sep 2012 14:34:54 GMT Connection: keep-alive <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://emp.bbci.co.uk/emp/releases/bump/revisions/872744/embed.js?emp=worldwide&enableClear=1">here</a>.</p> </body></html> HTTP/1.1 200 OK Last-Modified: Mon, 14 May 2012 13:04:14 GMT Vary: Accept-Encoding Server: Apache Accept-Ranges: bytes Content-Type: application/x-javascript Content-Encoding: gzip Content-Length: 2621 Cache-Control: max-age=84 Expires: Fri, 21 Sep 2012 14:36:18 GMT Date: Fri, 21 Sep 2012 14:34:54 GMT Connection: keep-alive ............ks.9.....+...{...2q9....YI.....aF..y!i.....ni.`....2.....w..e...$.l.vE'p.B..X.Cx......^bgKbM.B,.......pH.4t.. ..>....<v.!?..+.37...p..^'. ..8...n6..:.J....u.s.TI.F[..I.-Z'n..Q...._.pH.$.$...J.!...AQ%.N.w`..(UO)Of..x9y.8$.}>.b.....@..N../7."x.$......@+....M....l.\%...].)P...(.q2..c2.\e"...H.....A.k~:q.....6...,T..;#...... .H.E. ......g^.g....xH. .?.J_g#@...{C.. .Anh. .....;[..p`q!.1<.X.W.......d...m6\|=...f..........s........G'..r...".+p.d.p[.a.(..6* .;.Q.fe.<...(.................^....-BX}..~...fa.`.......h........h.+.X.X...J..H..fEN:.Llo..3E....= .!x4=fV..t\|<..P.d..f...&.L.......su.r\.wO_....qJ.'.T....X.h.:Z..K..J..`...I.)x.4SHBxF.qi .......>.~.z........a.F......../.SJ..Z.Tp.K.e..N.....S.^..L...Pc..............{.X...N.%...F....cF.eK...S.XN...8g.~..#...._...............-wz.1F.t<8.....i..x..6v_.........C qD.....I..n ..Z#G-.?j...<u....sB...e\8Z\969%.w........."].......R.;.MZ..B..l....I..Gr...- 1.e.....T..~........]&w.6.E..\|......N.l..20&...3.0....7'..a,!A...g[...0.....2...^T. .a.4)...>!...a..p......=.....j.e.4.D...8...1..P...-..........\...:.?. OH...S.I[.fJ.....(...N.tb...J:...../.....<w9.9......6Mc....$.I....}.I../...$...l......9f... C.D.9.%.<C..].K.........x..H.oV.^O.m-..2.U.l.4..l\.._3.YC.\|.7.X....%.b..0J.T$A.:..H6P..a..n\|$......Y/\y...D.r..@Q... )..-.5wf..3G..<o.........A...b...XA.......mp.M.4Kk.....z.)ci ..RQ.... ._...=8..p...&..7..6../...#..........\.1@...PJu..b.u\|i.."X..p.l.]I.~L6"P.....].......[.......o\`}5'...Z.........Q..bw^d.\..U.0..I..7...sQ...Q........`.Q...a..\..s]....s....h...@^..Do...+......n<..4.../..h..9..&P'.7....q:.......8..}.[..J.5.5....... (......R]vgoR..........BZ.d^.L.64.M..h.8..f..8...HXH....I...ZB$N.n......<.2.....2>..XL...-..b.y..&..:w..>..\|p(}..1.}j..8.d......v...Y.q..T..p.7...C].9..v).0....%..9....j....G..,..C.........1v&.8......H.5....7.../.y...o..4....(.._.S.I..y...aH.<._.~BV.Y.o....w..........x......u.<....V?.._@\|.........[.....S...IQ.1._:eO.w....m~.Y.. &.;p)..1....b....".R...............K....Iu.@z...N.\.E ..&=....6r.`x.wP.No.l..l8..2. ...;1.rjB.........P......d.......v..........6..)..u. t...S..._... +..J.7.uv..v.Oe.N.7)R =...q....N~...... .......~.s8.tb(..B...b.. . ..;.!C<4<....%... Q.{....X. ........._.Jrt...Q.......:......"........ ..<9Z.....Y......y...F.......=B...).;........5..}....fpd...PQ.....\|....gO...A.4.~V..k..}1..i7....z.m.......9........Z\|..pV.....Y...G..>..=:-.)...t..v.\|r!....QA..TH.G..}.. I.^T...w.p.c.hG.3.......O....@.c.<u2a....n.>6J>.t..........z9....[w..G.K;.)r..N+.M@.%^.n..<...F....8/..........P1......5'\|h.H.".....4l.j].m....,/.~..~..o.e... .....P^Uc .>..].sqC .s..(...D.....fQ..S...ZC..m.}..M..;........_<.....HTTP/1.1 301 Moved Permanently Server: Apache Content-Type: text/html; charset=iso-8859-1 Location: http://emp.bbci.co.uk/emp/releases/worldwide/revisions/749603_749269_749444_6/embed.js?mediaset=journalism-pc Content-Length: 317 Vary: Accept-Encoding Cache-Control: max-age=238 Expires: Fri, 21 Sep 2012 14:38:53 GMT Date: Fri, 21 Sep 2012 14:34:55 GMT Connection: keep-alive <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <ti

2012-09-21T07:43:36.151476-0700

80.239.254.42

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

DNS 327

Showing 161-180 of 327 items.

Timestamp

Src Ip

Dest Ip

Dns Type

Resource Record Name

Resource Record Type

Resource Data

161

2012-09-21T07:42:39.428980-0700

172.18.1.100

172.18.3.11

answer

apis.google.com

(not set)

162

2012-09-21T07:42:34.410332-0700

172.18.3.11

172.18.1.100

query

weather-news.sky.com

(not set)

163

2012-09-21T07:42:35.209416-0700

172.18.3.11

172.18.1.100

query

www.sky.com

(not set)

164

2012-09-21T07:42:35.209508-0700

172.18.3.11

172.18.1.100

query

go.sky.com

(not set)

165

2012-09-21T07:42:35.283145-0700

172.18.1.100

172.18.3.11

answer

www.sky.com

(not set)

166

2012-09-21T07:42:34.548717-0700

172.18.1.100

172.18.3.11

answer

weather-news.sky.com

(not set)

167

2012-09-21T07:42:35.306022-0700

172.18.1.100

172.18.3.11

answer

go.sky.com

(not set)

168

2012-09-21T07:42:35.322011-0700

172.18.3.11

172.18.1.100

query

uservideos.sky.com

(not set)

169

2012-09-21T07:42:35.341734-0700

172.18.1.100

172.18.3.11

answer

uservideos.sky.com

(not set)

170

2012-09-21T07:42:35.209396-0700

172.18.3.11

172.18.1.100

query

www.facebook.com

(not set)

171

2012-09-21T07:42:35.227144-0700

172.18.1.100

172.18.3.11

answer

www.facebook.com

(not set)

172

2012-09-21T07:42:35.227763-0700

172.18.3.11

172.18.1.100

query

go.microsoft.com

(not set)

173

2012-09-21T07:42:35.245814-0700

172.18.1.100

172.18.3.11

answer

go.microsoft.com

(not set)

174

2012-09-21T07:42:35.303057-0700

172.18.3.11

172.18.1.100

query

skynewspanel.com

(not set)

175

2012-09-21T07:42:35.307048-0700

172.18.3.11

172.18.1.100

query

accessibility.sky.com

(not set)

176

2012-09-21T07:42:35.312258-0700

172.18.3.11

172.18.1.100

query

yourphotos.news.sky.com

(not set)

177

2012-09-21T07:42:35.321165-0700

172.18.1.100

172.18.3.11

answer

skynewspanel.com

(not set)

178

2012-09-21T07:42:35.324507-0700

172.18.1.100

172.18.3.11

answer

accessibility.sky.com

(not set)

179

2012-09-21T07:42:35.325397-0700

172.18.3.11

172.18.1.100

query

www.skynewsarabia.com

(not set)

180

2012-09-21T07:42:35.342790-0700

172.18.3.11

172.18.1.100

query

skyliving.sky.com

(not set)

TLS 8

Showing 1-8 of 8 items.

Timestamp

Source IP

Destination IP

TLS Version

Server Name Indication

2012-09-21T07:42:39.608580-0700

172.18.3.11

173.194.41.168

TLSv1

plusone.google.com

2012-09-21T07:42:39.469797-0700

172.18.3.11

173.194.41.174

TLSv1

apis.google.com

2012-09-21T07:42:39.679741-0700

172.18.3.11

173.194.41.175

TLSv1

ssl.gstatic.com

2012-09-21T07:42:40.459911-0700

172.18.3.11

2.23.130.110

TLSv1

s-static.ak.facebook.com

2012-09-21T07:42:47.097613-0700

172.18.3.11

173.194.41.185

TLSv1

googleads.g.doubleclick.net

2012-09-21T07:42:40.801600-0700

172.18.3.11

173.252.101.16

TLSv1

www.facebook.com

2012-09-21T07:42:59.520623-0700

172.18.3.11

173.194.67.95

TLSv1

ajax.googleapis.com

2012-09-21T07:43:34.176791-0700

172.18.3.11

173.194.41.163

TLSv1

sb-ssl.google.com

TFTP 0

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
No results found.

HTTP 687

Showing 81-100 of 687 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

2012-09-21T07:41:45.004622-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63021000/jpg/_63021371_eatrich144_getty.jpg

200

2012-09-21T07:41:44.893419-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/62967000/jpg/_62967972_hi016012954.jpg

200

2012-09-21T07:41:44.897784-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/62987000/jpg/_62987391_hi016011678.jpg

200

2012-09-21T07:41:45.254892-0700

172.18.3.11

sa.bbc.co.uk

GET

/bbc/bbc/s?name=news.page&cps_asset_id=10263779&page_type=index&section=front-page&app_version=6.2.104-RC6&first_pub=2010-06-10T14:18:30+00:00&last_editorial_update=2012-09-21T14:32:05+00:00&title=&comments_box=false&cps_media_type=&cps_media_state=&app_type=web&ml_name=SSI&ml_version=0.11.1&language=en-GB&bbc_mc=not_set&screen_resolution=1680x1050&blq_s=3.5&blq_r=3.5&blq_v=journalism-domestic&ns__t=1348238505204&ns_c=UTF-8&ns_ti=BBC%20News%20-%20Home&ns_jspageurl=http%3A//www.bbc.co.uk/news/&ns_referrer=

302

2012-09-21T07:41:44.904783-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63018000/jpg/_63018262_hi016017809.jpg

200

2012-09-21T07:41:45.380959-0700

172.18.3.11

news.bbcimg.co.uk

GET

/js/view/0_0_32/news-index.js

200

2012-09-21T07:41:44.933637-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63025000/jpg/_63025125_016028534-1.jpg

200

2012-09-21T07:41:45.414479-0700

172.18.3.11

sa.bbc.co.uk

GET

/bbc/bbc/s?name=news.page&ns_m2=yes&ns_setsiteck=505C7B0F67BF00B2&cps_asset_id=10263779&page_type=index&section=front-page&app_version=6.2.104-RC6&first_pub=2010-06-10T14:18:30+00:00&last_editorial_update=2012-09-21T14:32:05+00:00&title=&comments_box=false&cps_media_type=&cps_media_state=&app_type=web&ml_name=SSI&ml_version=0.11.1&language=en-GB&bbc_mc=not_set&screen_resolution=1680x1050&blq_s=3.5&blq_r=3.5&blq_v=journalism-domestic&ns__t=1348238505204&ns_c=UTF-8&ns_ti=BBC%20News%20-%20Home&ns_jspageurl=http%3A//www.bbc.co.uk/news/&ns_referrer=

200

2012-09-21T07:41:44.936981-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63028000/jpg/_63028641_binoche640.jpg

200

2012-09-21T07:41:45.380433-0700

172.18.3.11

static.bbci.co.uk

GET

/frameworks/demi/0.9.8/sharedmodules/demi-1.js

200

2012-09-21T07:41:44.950703-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63012000/jpg/_63012675_63012074.jpg

200

2012-09-21T07:41:45.418689-0700

172.18.3.11

static.bbci.co.uk

GET

/frameworks/barlesque/2.10.0/desktop/3.5/img/bbccookies/cookie_prompt_sprite.png

200

2012-09-21T07:41:45.435571-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/1_4_35/cream/hi/news/img/subnav-divider.png

200

2012-09-21T07:41:45.435721-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/img/transparencies/rgba-0-0-0-07.png

200

2012-09-21T07:41:45.481766-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/img/search.png

200

2012-09-21T07:41:45.478856-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/1_4_35/cream/hi/news/img/red-masthead.png

200

2012-09-21T07:41:45.521161-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/img/programmes-iplayer-brand.png

200

2012-09-21T07:41:45.524575-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/1_4_35/cream/hi/news/img/languages-sprite.gif

200

2012-09-21T07:41:45.566662-0700

172.18.3.11

static.bbci.co.uk

GET

/frameworks/istats/0.11.1/modules/istats-1.js

200

100

2012-09-21T07:41:45.508437-0700

172.18.3.11

emp.bbci.co.uk

GET

/emp/worldwide/embed.js?mediaset=journalism-pc

301

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 0

#		Timestamp	Source	Destination	Email From	Email To	Subject
No results found.

Flow 405

Showing 1-20 of 405 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

2012-09-21T07:41:39.704863-0700

954277252052231

flow

172.18.3.11

58234

255.255.255.255

1947

UDP

pcapanalyzer

2012-09-21T07:41:39.704863-0700

118968389913127

flow

172.18.3.11

6405

172.18.3.49

TCP

pcapanalyzer

2012-09-21T07:41:40.359876-0700

268514856517983

flow

172.18.3.11

50167

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:42:33.881814-0700

751578418267952

flow

172.18.3.11

58234

172.18.255.255

1947

UDP

pcapanalyzer

2012-09-21T07:42:33.881814-0700

268514856473418

flow

172.18.1.100

172.18.3.11

50167

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

141053112448034

flow

172.18.3.11

58471

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

1126275663755394

flow

172.18.3.11

56951

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

563830371169239

flow

172.18.3.11

6599

204.152.194.218

TCP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

1267732563203033

flow

172.18.3.11

62003

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

845689741651186

flow

172.18.3.11

56536

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

1690230639403618

flow

172.18.3.11

6484

64.236.124.229

TCP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

1972334825587849

flow

172.18.3.11

49568

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

284116325262502

flow

172.18.3.11

60687

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

426541739252755

flow

172.18.3.11

53110

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

1834479260316737

flow

172.18.3.11

6433

80.239.254.24

TCP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

145799055393495

flow

172.18.3.11

63879

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

568043728287493

flow

172.18.3.11

64864

172.18.1.100

UDP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

568110305485653

flow

172.18.3.11

6586

213.174.142.29

TCP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

1975551755764055

flow

172.18.3.11

6410

173.194.65.94

TCP

pcapanalyzer

2012-09-21T07:43:38.102668-0700

287150723368471

flow

172.18.3.11

6519

194.60.187.230

TCP

pcapanalyzer

File 654

Showing 221-240 of 654 items.

Timestamp

Source

Destination

File Name

File Magic

File Size

221

2012-09-21T07:42:34.108222-0700

80.239.221.43

172.18.3.11

/media/images/generated/2012/9/13/192913/default/v1/james-anderson-1-176x99.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: "Generated by IJG JPEG LibraryGenerated by IJG JPEG Library"

15274

222

2012-09-21T07:42:33.670149-0700

80.239.221.43

172.18.3.11

/media/images/generated/2012/4/12/4096/default/v1/goldfinger-1-104x57.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16

5165

223

2012-09-21T07:42:34.140787-0700

80.239.221.43

172.18.3.11

/media/images/generated/2012/9/20/194136/default/v1/rtr38575-1-176x99.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16

9225

224

2012-09-21T07:42:34.169663-0700

80.239.221.43

172.18.3.11

/media/images/generated/2012/9/20/194140/default/v1/8644545-1-1-176x99.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16

16294

225

2012-09-21T07:42:34.196521-0700

80.239.221.43

172.18.3.11

/media/images/generated/sky-news/content/StaticFile/jpg/2012/Apr/Week1/3234/default/v0/16201944-176x99.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16

6339

226

2012-09-21T07:42:33.745902-0700

80.239.221.43

172.18.3.11

/media/images/generated/2012/9/21/194367/default/v1/t-132711fr-mitchell-boris-conf-grab-01h00m00s01-1-176x99.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16

5333

227

2012-09-21T07:42:33.432514-0700

80.239.254.138

172.18.3.11

HTML document, ASCII text, with very long lines

125009

228

2012-09-21T07:42:33.760840-0700

80.239.254.138

172.18.3.11

/static/QjaZt2VayUxROsX6fqWJch4Np6kMFTZixDysxLz8BaO.png

PNG image data, 211 x 71, 8-bit/color RGBA, non-interlaced

23555

229

2012-09-21T07:42:33.513626-0700

80.239.221.43

172.18.3.11

/media/images/generated/2012/6/25/176829/default/v1/108192314-1-198x111.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: "LEAD Technologies Inc. V1.01Generated by IJG JPEG Library"

12722

230

2012-09-21T07:42:33.791836-0700

95.172.69.18

172.18.3.11

/gateway/gw.js

HTML document, ASCII text, with very long lines

5099

231

2012-09-21T07:42:33.515438-0700

80.239.254.138

172.18.3.11

/images/favicon.ico

PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced

962

232

2012-09-21T07:42:33.516174-0700

80.239.221.43

172.18.3.11

/media/images/generated/2012/9/21/194328/default/v1/leroy-james-1-136x75.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: "LEAD Technologies Inc. V1.01"

5997

233

2012-09-21T07:42:34.268178-0700

80.239.221.43

172.18.3.11

/media/images/generated/2012/9/21/194325/default/v2/explosion1-1-306x172.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16

12304

234

2012-09-21T07:42:34.281498-0700

80.239.221.43

172.18.3.11

/media/images/generated/2012/4/27/5444/default/v1/children-hands-1-176x99.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16

18486

235

2012-09-21T07:42:33.814742-0700

80.239.254.138

172.18.3.11

/static/wb5zXuVVRlMPAPwtsmsO74wyIr0pWvrH7Kc1WDHMEmX.js

HTML document, ASCII text, with very long lines, with CRLF, LF line terminators

181780

236

2012-09-21T07:42:34.315211-0700

80.239.221.43

172.18.3.11

/media/images/generated/sky-news/content/StaticFile/jpg/2012/Apr/Week3/4800/default/v3/16212636-145x82.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16

6168

237

2012-09-21T07:42:33.855794-0700

80.239.221.43

172.18.3.11

/media/images/generated/2012/9/21/194272/default/v1/114263390-1-176x99.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16

28789

238

2012-09-21T07:42:33.861874-0700

80.239.254.138

172.18.3.11

/static/IqB8LvIorLLmsJ1SMxbmKbZdLsX5MsoCbGgYLUi9Whc.js

HTML document, ASCII text, with very long lines

58615

239

2012-09-21T07:42:33.871888-0700

80.239.254.138

172.18.3.11

/static/IKfETRJERwBRdVMGxGDGgTIvzB2B464w7472lQKpd3b.js

HTML document, ASCII text, with very long lines

93868

240

2012-09-21T07:42:33.896627-0700

80.239.221.43

172.18.3.11

/media/images/generated/sky-news/content/StaticFile/jpg/2012/Feb/Week2/428/default/v1/16165948-176x99.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16

7112

Comments	(not set)

Update Download PCAP Delete