pak004_932bdb768b3eeeec3fcd3540acd32aa0.pcap

MD5	932bdb768b3eeeec3fcd3540acd32aa0
Submission Date	2021-10-04 07:56:18
Tags	(not set)

Alert 6

Showing 1-6 of 6 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

Timestamp	2012-09-21T07:42:34.494625-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?

2012-09-21T07:42:34.494625-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:36.845858-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:36.845858-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:37.398726-0700
Flow Id	182514582651992
Source IP	80.239.254.72
Source Port	80
Destination IP	172.18.3.11
Destination Port	6512
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Server: Apache Last-Modified: Thu, 09 Mar 2006 21:32:31 GMT ETag: "9f40d-3a-40e969d2259c0" Accept-Ranges: bytes Content-Type: application/x-javascript Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 63 Date: Fri, 21 Sep 2012 14:35:47 GMT Connection: keep-alive ..........K+.K....Sp.O..M.+./.,I.P.(..Q.T.VH....#KX+... ...:...HTTP/1.1 200 OK Server: Apache Last-Modified: Tue, 28 Aug 2012 10:16:41 GMT ETag: "7572ed-997c-4c850bd04f440" Accept-Ranges: bytes Content-Length: 39292 Content-Type: application/x-shockwave-flash Date: Fri, 21 Sep 2012 14:35:47 GMT Connection: keep-alive CWS.....x..zuT[_.h...%X...[p...@." .$..).w.n..R\.C!P..o..R.X...........z.M.......{.9q.<k..rd.x........V........a.a.... W.....jj...........i........y.ZCw...p...E..X.q...X;;..X.......$e\|\,..`.tV0[8B..wG7........&................s..{. #M'.#.........qrD...H1.K.....i^....x8H1..C.{..C...............................................`x....F.......1)........[......_LL..O.W@........a...pg...E..............r...b`.w.N...............= 0....].......;{.Y........]...Go........Q.......PS.bx......WV.U.................@\|r". E9y.....d.....E...........A.\|......))...[V ..a....[.._.\|..........M.......c....n..B..'..O.ii G.3....._anp/..e7g'..eX..?x......\LHXTAXNXY^....c...7.?Y.}t.....O=..?..,.G.?.....f........_....<..'.K.P...w@./@.O.7._.'......=. ....... . .....a.p.. .?..k.AC.....~.....L..;..?Tl,....C...1.=#.y...:....@../G..k..@..T @B...S.<#.$D.;...[H.........>..B..... .S<f..a.,"6.....o..^lS.E .0...4VQ..H\ ..:.:.:...:...\|..c...._N.....bp..<..q.D....c...1E..'..}S)L/....x..R@t @.0..rL........v....].........'..,CX.........\2...W._k.......yH^o..n@.J......I.K.>.Z....92....3..\...fL...OK!.z..Ds...1....M\vk.).#Q..k .,.r.W..L....X.l..S&........Kg.#..pO...H_n..U...5.,W..e.....m.......u1.\|.I.U^..C.&duK..L.n..%......D.d)5....OY..[.G....M..2...6...Y3A.."T.t(.V..I......L.n.{$>....r..2.....2.....5,. 3R/-.\\....s.,.m_ ZQKO....0...+..d.:o.M..ux...?.C0..r.....b.[.....mO#Tn.....z..X%.{s.#.3........%....f.\|...,...S.?......Rl.s...C..Vj...~....T(.r..........Ik.b ..M./...n.H"Y0.=t.b.e..}.CW.........q)....d,.g.0j"..._g...g.u...%.{..(..j..n.....wl........V..Qq.YF-.B]).}.G...Gx....b.C..........N...4.(..,..2J............i.y...w ...\..../:d.@cYhd..;...?..m...9-.U..G......g.yx.s..>~..>1VX.........%..5'j..9..P...6d..dm8f.L].....iSrF...e:.m.,?(.b.O......U.JdiV.<gP.........._...~7E......?J....c.I....$......7..o5@].ub..\N........c;..2; e.........Ql...o...g.e0...e..-4.....%.%F...O..H.A.-......?C...g.m.@7.w.Z...K7...T0.... ....F..>...j..08.D........u..9...gD..F....=......nY..B..7...2...`4...-...U.W.>.Tj.[...../.7......L...J.G...,.z<.R.%.B~[S.....h.+.7)...(.._.F.~."..w.mPx.$o.O....uc..j.....s~......'.m....K...x.y..................K....>H..(xR.'y...7.?/.L.FWK...Hx&...?.=mK...u..._}H...y...<jR..I.....Z`..v.b]...R..&..E).&plMo....`8.A.B...E..h...Ll...o.... ..u..@yB:.7UB.#.......}.......~FqJ...u.o.............sH".u.[WN.............<.............."wQ...+..b..tu.S2.<...SGUT.Jx.f.K9q8.g.+c.G.......A...T...k...j)>.{s..,OD.....=....9_.}.....{.;................I..2U... B#.)..=.....%

2012-09-21T07:42:37.398726-0700

80.239.254.72

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:39.445690-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:39.445690-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:39.570006-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:39.570006-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:43:36.151476-0700
Flow Id	1113760125742992
Source IP	80.239.254.42
Source Port	80
Destination IP	172.18.3.11
Destination Port	6435
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 301 Moved Permanently Server: Apache Content-Type: text/html; charset=iso-8859-1 Location: http://emp.bbci.co.uk/emp/releases/bump/revisions/872744/embed.js?emp=worldwide&enableClear=1 Content-Length: 305 Vary: Accept-Encoding Cache-Control: max-age=269 Expires: Fri, 21 Sep 2012 14:39:23 GMT Date: Fri, 21 Sep 2012 14:34:54 GMT Connection: keep-alive <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://emp.bbci.co.uk/emp/releases/bump/revisions/872744/embed.js?emp=worldwide&enableClear=1">here</a>.</p> </body></html> HTTP/1.1 200 OK Last-Modified: Mon, 14 May 2012 13:04:14 GMT Vary: Accept-Encoding Server: Apache Accept-Ranges: bytes Content-Type: application/x-javascript Content-Encoding: gzip Content-Length: 2621 Cache-Control: max-age=84 Expires: Fri, 21 Sep 2012 14:36:18 GMT Date: Fri, 21 Sep 2012 14:34:54 GMT Connection: keep-alive ............ks.9.....+...{...2q9....YI.....aF..y!i.....ni.`....2.....w..e...$.l.vE'p.B..X.Cx......^bgKbM.B,.......pH.4t.. ..>....<v.!?..+.37...p..^'. ..8...n6..:.J....u.s.TI.F[..I.-Z'n..Q...._.pH.$.$...J.!...AQ%.N.w`..(UO)Of..x9y.8$.}>.b.....@..N../7."x.$......@+....M....l.\%...].)P...(.q2..c2.\e"...H.....A.k~:q.....6...,T..;#...... .H.E. ......g^.g....xH. .?.J_g#@...{C.. .Anh. .....;[..p`q!.1<.X.W.......d...m6\|=...f..........s........G'..r...".+p.d.p[.a.(..6* .;.Q.fe.<...(.................^....-BX}..~...fa.`.......h........h.+.X.X...J..H..fEN:.Llo..3E....= .!x4=fV..t\|<..P.d..f...&.L.......su.r\.wO_....qJ.'.T....X.h.:Z..K..J..`...I.)x.4SHBxF.qi .......>.~.z........a.F......../.SJ..Z.Tp.K.e..N.....S.^..L...Pc..............{.X...N.%...F....cF.eK...S.XN...8g.~..#...._...............-wz.1F.t<8.....i..x..6v_.........C qD.....I..n ..Z#G-.?j...<u....sB...e\8Z\969%.w........."].......R.;.MZ..B..l....I..Gr...- 1.e.....T..~........]&w.6.E..\|......N.l..20&...3.0....7'..a,!A...g[...0.....2...^T. .a.4)...>!...a..p......=.....j.e.4.D...8...1..P...-..........\...:.?. OH...S.I[.fJ.....(...N.tb...J:...../.....<w9.9......6Mc....$.I....}.I../...$...l......9f... C.D.9.%.<C..].K.........x..H.oV.^O.m-..2.U.l.4..l\.._3.YC.\|.7.X....%.b..0J.T$A.:..H6P..a..n\|$......Y/\y...D.r..@Q... )..-.5wf..3G..<o.........A...b...XA.......mp.M.4Kk.....z.)ci ..RQ.... ._...=8..p...&..7..6../...#..........\.1@...PJu..b.u\|i.."X..p.l.]I.~L6"P.....].......[.......o\`}5'...Z.........Q..bw^d.\..U.0..I..7...sQ...Q........`.Q...a..\..s]....s....h...@^..Do...+......n<..4.../..h..9..&P'.7....q:.......8..}.[..J.5.5....... (......R]vgoR..........BZ.d^.L.64.M..h.8..f..8...HXH....I...ZB$N.n......<.2.....2>..XL...-..b.y..&..:w..>..\|p(}..1.}j..8.d......v...Y.q..T..p.7...C].9..v).0....%..9....j....G..,..C.........1v&.8......H.5....7.../.y...o..4....(.._.S.I..y...aH.<._.~BV.Y.o....w..........x......u.<....V?.._@\|.........[.....S...IQ.1._:eO.w....m~.Y.. &.;p)..1....b....".R...............K....Iu.@z...N.\.E ..&=....6r.`x.wP.No.l..l8..2. ...;1.rjB.........P......d.......v..........6..)..u. t...S..._... +..J.7.uv..v.Oe.N.7)R =...q....N~...... .......~.s8.tb(..B...b.. . ..;.!C<4<....%... Q.{....X. ........._.Jrt...Q.......:......"........ ..<9Z.....Y......y...F.......=B...).;........5..}....fpd...PQ.....\|....gO...A.4.~V..k..}1..i7....z.m.......9........Z\|..pV.....Y...G..>..=:-.)...t..v.\|r!....QA..TH.G..}.. I.^T...w.p.c.hG.3.......O....@.c.<u2a....n.>6J>.t..........z9....[w..G.K;.)r..N+.M@.%^.n..<...F....8/..........P1......5'\|h.H.".....4l.j].m....,/.~..~..o.e... .....P^Uc .>..].sqC .s..(...D.....fQ..S...ZC..m.}..M..;........_<.....HTTP/1.1 301 Moved Permanently Server: Apache Content-Type: text/html; charset=iso-8859-1 Location: http://emp.bbci.co.uk/emp/releases/worldwide/revisions/749603_749269_749444_6/embed.js?mediaset=journalism-pc Content-Length: 317 Vary: Accept-Encoding Cache-Control: max-age=238 Expires: Fri, 21 Sep 2012 14:38:53 GMT Date: Fri, 21 Sep 2012 14:34:55 GMT Connection: keep-alive <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <ti

2012-09-21T07:43:36.151476-0700

80.239.254.42

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

DNS 327

Showing 161-180 of 327 items.

Timestamp

Src Ip

Dest Ip

Dns Type

Resource Record Name

Resource Record Type

Resource Data

161

2012-09-21T07:42:39.428980-0700

172.18.1.100

172.18.3.11

answer

apis.google.com

(not set)

162

2012-09-21T07:42:34.410332-0700

172.18.3.11

172.18.1.100

query

weather-news.sky.com

(not set)

163

2012-09-21T07:42:35.209416-0700

172.18.3.11

172.18.1.100

query

www.sky.com

(not set)

164

2012-09-21T07:42:35.209508-0700

172.18.3.11

172.18.1.100

query

go.sky.com

(not set)

165

2012-09-21T07:42:35.283145-0700

172.18.1.100

172.18.3.11

answer

www.sky.com

(not set)

166

2012-09-21T07:42:34.548717-0700

172.18.1.100

172.18.3.11

answer

weather-news.sky.com

(not set)

167

2012-09-21T07:42:35.306022-0700

172.18.1.100

172.18.3.11

answer

go.sky.com

(not set)

168

2012-09-21T07:42:35.322011-0700

172.18.3.11

172.18.1.100

query

uservideos.sky.com

(not set)

169

2012-09-21T07:42:35.341734-0700

172.18.1.100

172.18.3.11

answer

uservideos.sky.com

(not set)

170

2012-09-21T07:42:35.209396-0700

172.18.3.11

172.18.1.100

query

www.facebook.com

(not set)

171

2012-09-21T07:42:35.227144-0700

172.18.1.100

172.18.3.11

answer

www.facebook.com

(not set)

172

2012-09-21T07:42:35.227763-0700

172.18.3.11

172.18.1.100

query

go.microsoft.com

(not set)

173

2012-09-21T07:42:35.245814-0700

172.18.1.100

172.18.3.11

answer

go.microsoft.com

(not set)

174

2012-09-21T07:42:35.303057-0700

172.18.3.11

172.18.1.100

query

skynewspanel.com

(not set)

175

2012-09-21T07:42:35.307048-0700

172.18.3.11

172.18.1.100

query

accessibility.sky.com

(not set)

176

2012-09-21T07:42:35.312258-0700

172.18.3.11

172.18.1.100

query

yourphotos.news.sky.com

(not set)

177

2012-09-21T07:42:35.321165-0700

172.18.1.100

172.18.3.11

answer

skynewspanel.com

(not set)

178

2012-09-21T07:42:35.324507-0700

172.18.1.100

172.18.3.11

answer

accessibility.sky.com

(not set)

179

2012-09-21T07:42:35.325397-0700

172.18.3.11

172.18.1.100

query

www.skynewsarabia.com

(not set)

180

2012-09-21T07:42:35.342790-0700

172.18.3.11

172.18.1.100

query

skyliving.sky.com

(not set)

TLS 8

Showing 1-8 of 8 items.

Timestamp

Source IP

Destination IP

TLS Version

Server Name Indication

2012-09-21T07:42:39.608580-0700

172.18.3.11

173.194.41.168

TLSv1

plusone.google.com

2012-09-21T07:42:39.469797-0700

172.18.3.11

173.194.41.174

TLSv1

apis.google.com

2012-09-21T07:42:39.679741-0700

172.18.3.11

173.194.41.175

TLSv1

ssl.gstatic.com

2012-09-21T07:42:40.459911-0700

172.18.3.11

2.23.130.110

TLSv1

s-static.ak.facebook.com

2012-09-21T07:42:47.097613-0700

172.18.3.11

173.194.41.185

TLSv1

googleads.g.doubleclick.net

2012-09-21T07:42:40.801600-0700

172.18.3.11

173.252.101.16

TLSv1

www.facebook.com

2012-09-21T07:42:59.520623-0700

172.18.3.11

173.194.67.95

TLSv1

ajax.googleapis.com

2012-09-21T07:43:34.176791-0700

172.18.3.11

173.194.41.163

TLSv1

sb-ssl.google.com

TFTP 0

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
No results found.

HTTP 687

Showing 81-100 of 687 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

2012-09-21T07:41:45.004622-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63021000/jpg/_63021371_eatrich144_getty.jpg

200

2012-09-21T07:41:44.893419-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/62967000/jpg/_62967972_hi016012954.jpg

200

2012-09-21T07:41:44.897784-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/62987000/jpg/_62987391_hi016011678.jpg

200

2012-09-21T07:41:45.254892-0700

172.18.3.11

sa.bbc.co.uk

GET

/bbc/bbc/s?name=news.page&cps_asset_id=10263779&page_type=index&section=front-page&app_version=6.2.104-RC6&first_pub=2010-06-10T14:18:30+00:00&last_editorial_update=2012-09-21T14:32:05+00:00&title=&comments_box=false&cps_media_type=&cps_media_state=&app_type=web&ml_name=SSI&ml_version=0.11.1&language=en-GB&bbc_mc=not_set&screen_resolution=1680x1050&blq_s=3.5&blq_r=3.5&blq_v=journalism-domestic&ns__t=1348238505204&ns_c=UTF-8&ns_ti=BBC%20News%20-%20Home&ns_jspageurl=http%3A//www.bbc.co.uk/news/&ns_referrer=

302

2012-09-21T07:41:44.904783-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63018000/jpg/_63018262_hi016017809.jpg

200

2012-09-21T07:41:45.380959-0700

172.18.3.11

news.bbcimg.co.uk

GET

/js/view/0_0_32/news-index.js

200

2012-09-21T07:41:44.933637-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63025000/jpg/_63025125_016028534-1.jpg

200

2012-09-21T07:41:45.414479-0700

172.18.3.11

sa.bbc.co.uk

GET

/bbc/bbc/s?name=news.page&ns_m2=yes&ns_setsiteck=505C7B0F67BF00B2&cps_asset_id=10263779&page_type=index&section=front-page&app_version=6.2.104-RC6&first_pub=2010-06-10T14:18:30+00:00&last_editorial_update=2012-09-21T14:32:05+00:00&title=&comments_box=false&cps_media_type=&cps_media_state=&app_type=web&ml_name=SSI&ml_version=0.11.1&language=en-GB&bbc_mc=not_set&screen_resolution=1680x1050&blq_s=3.5&blq_r=3.5&blq_v=journalism-domestic&ns__t=1348238505204&ns_c=UTF-8&ns_ti=BBC%20News%20-%20Home&ns_jspageurl=http%3A//www.bbc.co.uk/news/&ns_referrer=

200

2012-09-21T07:41:44.936981-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63028000/jpg/_63028641_binoche640.jpg

200

2012-09-21T07:41:45.380433-0700

172.18.3.11

static.bbci.co.uk

GET

/frameworks/demi/0.9.8/sharedmodules/demi-1.js

200

2012-09-21T07:41:44.950703-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63012000/jpg/_63012675_63012074.jpg

200

2012-09-21T07:41:45.418689-0700

172.18.3.11

static.bbci.co.uk

GET

/frameworks/barlesque/2.10.0/desktop/3.5/img/bbccookies/cookie_prompt_sprite.png

200

2012-09-21T07:41:45.435571-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/1_4_35/cream/hi/news/img/subnav-divider.png

200

2012-09-21T07:41:45.435721-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/img/transparencies/rgba-0-0-0-07.png

200

2012-09-21T07:41:45.481766-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/img/search.png

200

2012-09-21T07:41:45.478856-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/1_4_35/cream/hi/news/img/red-masthead.png

200

2012-09-21T07:41:45.521161-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/img/programmes-iplayer-brand.png

200

2012-09-21T07:41:45.524575-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/1_4_35/cream/hi/news/img/languages-sprite.gif

200

2012-09-21T07:41:45.566662-0700

172.18.3.11

static.bbci.co.uk

GET

/frameworks/istats/0.11.1/modules/istats-1.js

200

100

2012-09-21T07:41:45.508437-0700

172.18.3.11

emp.bbci.co.uk

GET

/emp/worldwide/embed.js?mediaset=journalism-pc

301

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 0

#		Timestamp	Source	Destination	Email From	Email To	Subject
No results found.

Flow 405

Showing 181-200 of 405 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

181

2012-09-21T07:43:38.102668-0700

1189272096498069

flow

172.18.3.11

6500

80.239.148.152

TCP

pcapanalyzer

182

2012-09-21T07:43:38.102668-0700

2175338602048329

flow

172.18.3.11

6414

173.194.41.175

TCP

pcapanalyzer

183

2012-09-21T07:43:38.102668-0700

1049670627137070

flow

172.18.3.11

6507

89.207.18.182

TCP

pcapanalyzer

184

2012-09-21T07:43:38.102668-0700

1049685661059794

flow

172.18.3.11

60181

172.18.1.100

UDP

pcapanalyzer

185

2012-09-21T07:43:38.102668-0700

2175768099154373

flow

172.18.3.11

6446

212.58.244.80

TCP

pcapanalyzer

186

2012-09-21T07:43:38.102668-0700

909223045747338

flow

172.18.3.11

65535

172.18.1.100

UDP

pcapanalyzer

187

2012-09-21T07:43:38.102668-0700

487175939197661

flow

172.18.3.11

60419

172.18.1.100

UDP

pcapanalyzer

188

2012-09-21T07:43:38.102668-0700

628158238294770

flow

172.18.3.11

6438

80.239.254.34

TCP

pcapanalyzer

189

2012-09-21T07:43:38.102668-0700

1332038956865269

flow

172.18.3.11

51804

172.18.1.100

UDP

pcapanalyzer

190

2012-09-21T07:43:38.102668-0700

65427332334825

flow

172.18.3.11

6572

173.194.65.103

TCP

pcapanalyzer

191

2012-09-21T07:43:38.102668-0700

1473100717438479

flow

172.18.3.11

6591

46.229.160.183

TCP

pcapanalyzer

192

2012-09-21T07:43:38.102668-0700

66193979929418

flow

172.18.3.11

51088

172.18.1.100

UDP

pcapanalyzer

193

2012-09-21T07:43:38.102668-0700

68094506132828

flow

172.18.3.11

6471

80.239.254.138

TCP

pcapanalyzer

194

2012-09-21T07:43:38.102668-0700

1053317057843383

flow

172.18.3.11

65016

172.18.1.100

UDP

pcapanalyzer

195

2012-09-21T07:43:38.102668-0700

631179753294742

flow

172.18.3.11

6603

204.152.194.218

TCP

pcapanalyzer

196

2012-09-21T07:43:38.102668-0700

1053806677209041

flow

172.18.3.11

6421

80.239.217.171

TCP

pcapanalyzer

197

2012-09-21T07:43:38.102668-0700

1053993513723232

flow

172.18.3.11

6594

172.18.3.49

TCP

pcapanalyzer

198

2012-09-21T07:43:38.102668-0700

1194904945185682

flow

172.18.3.11

59153

172.18.1.100

UDP

pcapanalyzer

199

2012-09-21T07:43:38.102668-0700

1195338738136700

flow

172.18.3.11

61420

172.18.1.100

UDP

pcapanalyzer

200

2012-09-21T07:43:38.102668-0700

1336325338063501

flow

172.18.3.11

6615

184.169.78.33

TCP

pcapanalyzer

File 654

Showing 141-160 of 654 items.

Timestamp

Source

Destination

File Name

File Magic

File Size

141

2012-09-21T07:42:05.644569-0700

173.194.65.94

172.18.3.11

ASCII text, with very long lines, with no line terminators

1161

142

2012-09-21T07:42:05.651815-0700

173.194.41.175

172.18.3.11

/gb/images/j_e6a6aca6.png

PNG image data, 381 x 45, 8-bit/color RGBA, non-interlaced

15130

143

2012-09-21T07:41:45.494531-0700

80.239.254.24

172.18.3.11

/view/3_0_2/cream/hi/shared/img/gvl3-icons-0-2.png

PNG image data, 1344 x 48, 8-bit/color RGBA, non-interlaced

16784

144

2012-09-21T07:41:49.979235-0700

212.58.244.130

172.18.3.11

/o.gif

GIF image data, version 89a, 1 x 1

145

2012-09-21T07:42:05.831689-0700

173.194.65.94

172.18.3.11

ASCII text, with very long lines, with no line terminators

1167

146

2012-09-21T07:41:50.062268-0700

80.239.254.10

172.18.3.11

/modules/comments/getcount/

ASCII text, with very long lines, with no line terminators

501

147

2012-09-21T07:42:05.938968-0700

173.194.65.94

172.18.3.11

ASCII text, with very long lines, with no line terminators

1185

148

2012-09-21T07:41:45.498271-0700

80.239.254.24

172.18.3.11

/view/3_0_2/cream/hi/shared/img/livestats-sprite-ko.png

PNG image data, 650 x 96, 8-bit/color RGBA, non-interlaced

4729

149

2012-09-21T07:41:50.101114-0700

80.239.254.42

172.18.3.11

/emp/worldwide/embed.js

HTML document, ASCII text

317

150

2012-09-21T07:42:06.076947-0700

173.194.65.94

172.18.3.11

ASCII text, with very long lines, with no line terminators

1206

151

2012-09-21T07:41:50.192329-0700

212.58.244.66

172.18.3.11

/news/special/shared/js/istats/v2/istats.js

ASCII text, with CRLF line terminators

539

152

2012-09-21T07:42:06.146127-0700

173.194.65.94

172.18.3.11

ASCII text, with very long lines, with no line terminators

1170

153

2012-09-21T07:41:45.500514-0700

80.239.254.24

172.18.3.11

/view/3_0_2/cream/hi/shared/img/market-data-down.png

PNG image data, 9 x 7, 8-bit/color RGBA, non-interlaced

180

154

2012-09-21T07:41:45.535215-0700

80.239.254.24

172.18.3.11

/view/1_4_35/cream/hi/news/img/services.gif

GIF image data, version 89a, 554 x 35

1128

155

2012-09-21T07:41:54.045062-0700

212.58.244.66

172.18.3.11

/news/technology-19674761

HTML document, ASCII text, with CRLF, LF line terminators

61765

156

2012-09-21T07:42:06.659693-0700

173.194.65.94

172.18.3.11

ASCII text, with very long lines, with no line terminators

122597

157

2012-09-21T07:41:45.538245-0700

80.239.254.24

172.18.3.11

/view/3_0_2/cream/hi/shared/img/carousel-prev-next-3.png

PNG image data, 96 x 181, 8-bit/color RGBA, non-interlaced

1594

158

2012-09-21T07:41:45.620655-0700

212.58.244.80

172.18.3.11

/wurfldemi/network.jsonp

ASCII text, with no line terminators

159

2012-09-21T07:42:06.706940-0700

173.194.65.94

172.18.3.11

ASCII text, with very long lines, with no line terminators

1286

160

2012-09-21T07:41:54.080921-0700

80.239.254.24

172.18.3.11

/view/3_0_2/cream/hi/shared/story.css

ASCII text, with very long lines, with no line terminators

24536

Comments	(not set)

Update Download PCAP Delete